Analysis
- max time kernel
1200s - max time network
1200s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
06/01/2024, 04:58
General
- Target Synapse X.exe
- Size 7.6MB
- Sample240106-fmcttshbbj
- SHA256 e739c99d25d4b9ed3cf1c0ce093505adcdec5f97fd38df45310b1e0a850ea801
Score
10/10
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Process spawned unexpected child process 42 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- DCRat payload 62 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Blocklisted process makes network request 3 IoCs
- Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Drops file in Program Files directory 5 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 42 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "5⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"4⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "6⤵
-
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"5⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"6⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "8⤵
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"7⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "10⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "11⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"11⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "13⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"16⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"17⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "18⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"17⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "19⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"20⤵
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"18⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "20⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"21⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "23⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"24⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"21⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"22⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "24⤵
-
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"23⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"23⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "25⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"24⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "26⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"25⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"26⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "27⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"26⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "28⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"27⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"28⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "29⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"28⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"29⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "30⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"29⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"30⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "31⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"30⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"31⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "32⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"31⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"32⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "33⤵
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"32⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "34⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"33⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"34⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "35⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"34⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "36⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"35⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"36⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "37⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"36⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "38⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"36⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"37⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"38⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "39⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"38⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "40⤵
-
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"39⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"39⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"40⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "41⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"40⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "42⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"41⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"42⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "43⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"42⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "44⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"43⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"44⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "45⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"44⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "46⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"47⤵
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"47⤵
-
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"45⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"46⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "47⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"48⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV148⤵
-
-
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"46⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"46⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "48⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"47⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"48⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "49⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"50⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"48⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "50⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"50⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "52⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"51⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"52⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"52⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"52⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"53⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"54⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "55⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"54⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "56⤵
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"56⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "57⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"56⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "58⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"59⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"57⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"58⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "59⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"58⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "60⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"59⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"60⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "61⤵
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"61⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"60⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "62⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"61⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"62⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"62⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "64⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"63⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"64⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "65⤵
-
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"64⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV164⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"64⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "66⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"65⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"66⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "67⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"66⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "68⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"67⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"68⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "69⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"68⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "70⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"69⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"70⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "71⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"70⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"71⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "72⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"73⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"71⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"72⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "73⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"74⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV174⤵
-
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"73⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"72⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "74⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"72⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"73⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"74⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "75⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"74⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "76⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"75⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"76⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "77⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"76⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"77⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "78⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"77⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"78⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "79⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"78⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"79⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "80⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"79⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"80⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "81⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"80⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "82⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"83⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"81⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"82⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "83⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"82⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "84⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"83⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"84⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "85⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"86⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"84⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "86⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"85⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"86⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "87⤵
-
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"86⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"87⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"86⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"87⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "88⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"87⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"88⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "89⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"88⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "90⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"89⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"90⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "91⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"90⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "92⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"91⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"92⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "93⤵
-
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"92⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"92⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "94⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"93⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"94⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "95⤵
-
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"94⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"94⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "96⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"95⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"96⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "97⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"95⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"96⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "98⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"99⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"97⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"98⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "99⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"97⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"98⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"99⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"100⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "101⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"100⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "102⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"101⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"102⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "103⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"102⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "104⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"103⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"104⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "105⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"104⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "106⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"105⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"106⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "107⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"106⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "108⤵
- Checks computer location settings
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"107⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"107⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"108⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "109⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"108⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "110⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"109⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"110⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "111⤵
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1110⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"110⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "112⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"111⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"112⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "113⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"114⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"112⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"113⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "114⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"113⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"114⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "115⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"114⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "116⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"114⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"115⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"116⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "117⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"116⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "118⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"117⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"118⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "119⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"120⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"C:\Users\Admin\AppData\Local\Temp\Synapse X.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"118⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msserverbrowser\HnyaohP9M4fFcL.vbe"119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msserverbrowser\76ROYidD3raXzrN.bat" "120⤵
-
C:\msserverbrowser\browserCommon.exe"C:\msserverbrowser\browserCommon.exe"121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-