Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'bargains' = '"<Full path to file>"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'kunkel' = '"%ProgramFiles(x86)%\acrostic\eisenmann.exe"'
- %TEMP%\nsrd3a4.tmp\execcmd.dll
- '%WINDIR%\syswow64\cmd.exe' /C <SYSTEM32>\tasklist /NH /FI "IMAGENAME eq eisenmann.exe" | <SYSTEM32>\find /I "eisenmann.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C <SYSTEM32>\tasklist /NH /FI "IMAGENAME eq eisenmann.exe" | <SYSTEM32>\find /I "eisenmann.exe"
- '%WINDIR%\syswow64\tasklist.exe' /NH /FI "IMAGENAME eq eisenmann.exe"
- '%WINDIR%\syswow64\find.exe' /I "eisenmann.exe"