Analysis
- max time kernel
72s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
20/08/2024, 04:36
General
- Target a22922cba62b835d2678e89171c34ef0N.exe
- Size 231KB
- Sample240820-e8m19axdqm
- SHA256 768f9b0b8ef122996a9759ad090764b17d78d017f7c6f1d9959c431e351414e0
Score
10/10
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Modifies firewall policy service 3 TTPs 6 IoCs
- Sality
Sality is backdoor written in C++, first discovered in 2003.
- UAC bypass 3 TTPs 2 IoCs
- Windows security bypass 2 TTPs 12 IoCs
- Detects Floxif payload 1 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Deletes itself 1 IoCs
- Executes dropped EXE 50 IoCs
- Loads dropped DLL 1 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 14 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery 1 TTPs 9 IoCs
Attempt to gather information on host's network.
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 13 IoCs
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 51 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\a22922cba62b835d2678e89171c34ef0N.exe"C:\Users\Admin\AppData\Local\Temp\a22922cba62b835d2678e89171c34ef0N.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\arp.exearp -a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 d2-97-c0-5f-e4-743⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 59-7f-cb-73-fc-d03⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 136.243.76.173 b7-76-b5-d4-73-563⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 c0-0e-04-36-89-553⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 d4-47-ca-36-b6-a53⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 da-0e-fa-19-ec-0f3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 57-60-87-3c-96-cf3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 e8-4e-e3-c4-3c-dc3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe5⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe6⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe14⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe16⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe20⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe21⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe22⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe23⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe24⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe25⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe19⤵
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe16⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe15⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe16⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe14⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe15⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe16⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe13⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe14⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe15⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe16⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe14⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe15⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe16⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe13⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe14⤵
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe14⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe15⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe16⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe13⤵
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe10⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe14⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe15⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe16⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe13⤵
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe14⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe15⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe16⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe13⤵
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe14⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe15⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe16⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe13⤵
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe7⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- System policy modification
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe14⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe15⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe16⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe13⤵
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
- Executes dropped EXE
- Enumerates connected drives
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe14⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe15⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe16⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe13⤵
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe7⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe5⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe14⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe15⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe16⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe13⤵
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe7⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe6⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe7⤵
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe6⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe14⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe15⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe16⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe13⤵
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe7⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe6⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe7⤵
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe5⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe6⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe7⤵
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe6⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\arp.exearp -d3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe5⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe14⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe15⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe16⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe17⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe18⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe19⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe13⤵
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe7⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe6⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe7⤵
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe5⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe6⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe7⤵
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe6⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe5⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe6⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe8⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe9⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe10⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe11⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe12⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe13⤵
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe7⤵
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe6⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
-
-
-
-
C:\Windows\SysWOW64\dllyqexumu\smss.exeC:\Windows\system32\dllyqexumu\smss.exe5⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe6⤵
-
C:\Windows\SysWOW64\rtvvxnckyr\explorer.exeC:\Windows\system32\rtvvxnckyr\explorer.exe7⤵
-
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
CB011298E88.tmp
SYSTEM.INI
hrnvj.pif
memory/464-399-0x0000000000400000-0x0000000000469000-memory.dmp
memory/640-328-0x0000000000400000-0x0000000000469000-memory.dmp
memory/960-254-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1092-192-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1228-193-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1228-245-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1248-262-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1376-424-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1428-197-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1656-421-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1656-466-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1688-406-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1708-239-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1764-412-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1768-257-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1852-413-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1852-464-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1960-393-0x0000000000400000-0x0000000000469000-memory.dmp
memory/2068-323-0x0000000000400000-0x0000000000469000-memory.dmp
memory/2328-121-0x0000000000400000-0x0000000000469000-memory.dmp
memory/2328-92-0x0000000000930000-0x0000000000932000-memory.dmp
memory/2328-89-0x0000000000980000-0x0000000000981000-memory.dmp
memory/2424-204-0x0000000000400000-0x0000000000469000-memory.dmp
memory/2516-587-0x0000000000400000-0x0000000000469000-memory.dmp
memory/2540-468-0x0000000000400000-0x0000000000469000-memory.dmp
memory/2656-276-0x0000000000400000-0x0000000000469000-memory.dmp
memory/2736-428-0x0000000000400000-0x0000000000469000-memory.dmp
memory/2736-374-0x0000000000400000-0x0000000000469000-memory.dmp
memory/3120-409-0x0000000000400000-0x0000000000469000-memory.dmp
memory/3180-208-0x0000000000400000-0x0000000000469000-memory.dmp
memory/3208-454-0x0000000000400000-0x0000000000469000-memory.dmp
memory/3256-178-0x0000000000400000-0x0000000000469000-memory.dmp
memory/3296-373-0x0000000000400000-0x0000000000469000-memory.dmp
memory/3700-359-0x0000000000400000-0x0000000000469000-memory.dmp
memory/3720-66-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-13-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-5-0x0000000010000000-0x0000000010033000-memory.dmp
memory/3720-79-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-80-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-10-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-478-0x0000000000400000-0x0000000000469000-memory.dmp
memory/3720-75-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-70-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-12-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-67-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-11-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-82-0x0000000010000000-0x0000000010033000-memory.dmp
memory/3720-100-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-103-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-14-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-19-0x00000000045D0000-0x00000000045D1000-memory.dmp
memory/3720-109-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-110-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-432-0x0000000000400000-0x0000000000469000-memory.dmp
memory/3720-0-0x0000000000400000-0x0000000000469000-memory.dmp
memory/3720-16-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-22-0x0000000004480000-0x0000000004482000-memory.dmp
memory/3720-20-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-64-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-21-0x0000000004480000-0x0000000004482000-memory.dmp
memory/3720-18-0x0000000004480000-0x0000000004482000-memory.dmp
memory/3720-59-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-17-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-55-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-15-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-54-0x0000000004480000-0x0000000004482000-memory.dmp
memory/3720-53-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-52-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-50-0x0000000010000000-0x0000000010033000-memory.dmp
memory/3720-25-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-32-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-37-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-39-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-352-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-350-0x0000000010000000-0x0000000010033000-memory.dmp
memory/3720-349-0x0000000000400000-0x0000000000469000-memory.dmp
memory/3720-40-0x0000000000400000-0x0000000000469000-memory.dmp
memory/3720-38-0x00000000028F0000-0x000000000397E000-memory.dmp
memory/3720-41-0x0000000010000000-0x0000000010033000-memory.dmp
memory/3784-186-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4044-188-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4048-440-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4200-143-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4220-111-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4220-87-0x0000000000700000-0x0000000000701000-memory.dmp
memory/4220-91-0x00000000006F0000-0x00000000006F2000-memory.dmp
memory/4220-108-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4244-153-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4764-356-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4764-420-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4796-36-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4796-447-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4796-57-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4796-105-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4796-47-0x00000000005E0000-0x00000000005E2000-memory.dmp
memory/4796-46-0x0000000000680000-0x0000000000681000-memory.dmp
memory/4848-248-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4864-161-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4884-51-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4884-78-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4884-83-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4884-90-0x00000000005C0000-0x00000000005C2000-memory.dmp
memory/4884-85-0x0000000000940000-0x0000000000941000-memory.dmp
memory/4884-561-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4896-252-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4896-202-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4900-357-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4924-476-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4924-429-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4960-332-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4992-280-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4996-273-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5036-460-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5044-431-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5080-270-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5140-480-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5168-483-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5168-441-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5284-455-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5284-555-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5304-565-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5324-572-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5336-461-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5336-566-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5388-573-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5388-467-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5396-571-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5452-580-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5524-582-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5524-477-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5572-586-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5572-479-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5604-588-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5644-484-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5644-591-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5680-597-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5680-485-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5728-556-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5756-581-0x0000000000400000-0x0000000000469000-memory.dmp
memory/5868-583-0x0000000000400000-0x0000000000469000-memory.dmp
memory/6012-598-0x0000000000400000-0x0000000000469000-memory.dmp
memory/6116-592-0x0000000000400000-0x0000000000469000-memory.dmp