Analysis
- max time kernel
646s - max time network
857s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 20:11
Errors
Reason
Machine shutdown
General
- Target https://www.dropbox.com/scl/fo/qy2qk79x2gtuwswxjxcla/h?rlkey=9ophpx1zlqaopl8j3d53sf3wi&dl=0
- Sample240327-yyb1saec6z
Score
10/10
Malware Config
Extracted
Family
-
crimsonrat
C2
-
185.136.161.124
Extracted
Family
-
danabot
C2
-
51.178.195.151
-
51.222.39.81
-
149.255.35.125
-
38.68.50.179
-
51.77.7.204
rsa_pubkey.plain
Signatures
- CrimsonRAT main payload 1 IoCs
- CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- RevengeRat Executable 1 IoCs
- Disables Task Manager via registry modification
- Downloads MZ/PE file
- Drops file in Drivers directory 21 IoCs
- Modifies RDP port number used by Windows 1 TTPs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Sets service image path in registry 2 TTPs 2 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 46 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers COM server for autorun 1 TTPs 64 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Uses the VBS compiler for execution 1 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
- Drops file in System32 directory 64 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 9 IoCs
- Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 5 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 45 IoCs
- Modifies system certificate store 2 TTPs 22 IoCs
- NTFS ADS 2 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 4 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 55 IoCs
- Suspicious behavior: LoadsDriver 16 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 42 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/scl/fo/qy2qk79x2gtuwswxjxcla/h?rlkey=9ophpx1zlqaopl8j3d53sf3wi&dl=02⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa35a146f8,0x7ffa35a14708,0x7ffa35a147183⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5980 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5988 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6028 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5728 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6160 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5844 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6472 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\MBSetup.exe"C:\Users\Admin\Downloads\MBSetup.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /t 1 & "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi6⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6020.0.1181096102\2117944522" -parentBuildID 20221007134813 -prefsHandle 1772 -prefMapHandle 1764 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {134e58e3-6220-4c44-a4f4-f748bef8b1c0} 6020 "\\.\pipe\gecko-crash-server-pipe.6020" 1872 1ab358d6158 gpu7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6020.1.2129259290\856175768" -parentBuildID 20221007134813 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c8b34b7-21bd-436e-8926-53218cead511} 6020 "\\.\pipe\gecko-crash-server-pipe.6020" 2400 1ab353e8358 socket7⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6020.2.367612019\1249982686" -childID 1 -isForBrowser -prefsHandle 2596 -prefMapHandle 2812 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca6bb40a-bb5d-431a-ad08-0df2ef41e3cb} 6020 "\\.\pipe\gecko-crash-server-pipe.6020" 3044 1ab38a8d858 tab7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6020.3.1825375744\1356496232" -childID 2 -isForBrowser -prefsHandle 3456 -prefMapHandle 3452 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c3dbea7-cefb-494a-8cb7-a3e841ef390d} 6020 "\\.\pipe\gecko-crash-server-pipe.6020" 3484 1ab3c7e2558 tab7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6020.4.656201489\1155280935" -childID 3 -isForBrowser -prefsHandle 4904 -prefMapHandle 5016 -prefsLen 26286 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c683733-f2a6-469b-82de-e4f060339995} 6020 "\\.\pipe\gecko-crash-server-pipe.6020" 5028 1ab3a5c9758 tab7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6020.5.1094439805\1352600565" -childID 4 -isForBrowser -prefsHandle 5172 -prefMapHandle 5176 -prefsLen 26286 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e69c22c4-ffb1-47bd-8073-0bb514583bd4} 6020 "\\.\pipe\gecko-crash-server-pipe.6020" 5164 1ab3a5d5658 tab7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6020.6.619363447\43134981" -childID 5 -isForBrowser -prefsHandle 5364 -prefMapHandle 5368 -prefsLen 26286 -prefMapSize 233444 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7c9f21f-6392-469b-81b3-e24069d217b1} 6020 "\\.\pipe\gecko-crash-server-pipe.6020" 5356 1ab3a5d5c58 tab7⤵
-
-
C:\Program Files\Malwarebytes\Anti-Malware\mbambgnativemsg.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbambgnativemsg.exe" "C:\Program Files\Malwarebytes\Anti-Malware\mbam.firefox.manifest.json" {242af0bb-db11-4734-b7a0-61cb8a9b20fb}7⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\Downloads\MBSetup.exe"C:\Users\Admin\Downloads\MBSetup.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7184 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3984 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6352 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5760 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6204 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5144 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4284940542361891854,8522175429206133599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:13⤵
-
-
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"2⤵
- Executes dropped EXE
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\stuff\" -ad -an -ai#7zMap17319:68:7zEvent272312⤵
-
-
C:\Users\Admin\Desktop\stuff\$uckyLocker.exe"C:\Users\Admin\Desktop\stuff\$uckyLocker.exe"2⤵
- Sets desktop wallpaper using registry
-
-
C:\Users\Admin\Desktop\stuff\CrimsonRAT.exe"C:\Users\Admin\Desktop\stuff\CrimsonRAT.exe"2⤵
-
C:\ProgramData\Hdlharas\dlrarhsiva.exe"C:\ProgramData\Hdlharas\dlrarhsiva.exe"3⤵
-
-
-
C:\Users\Admin\Desktop\stuff\DanaBot.exe"C:\Users\Admin\Desktop\stuff\DanaBot.exe"2⤵
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\Desktop\stuff\DanaBot.dll f1 C:\Users\Admin\Desktop\stuff\DanaBot.exe@58523⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\Desktop\stuff\DanaBot.dll,f04⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5264 -s 9445⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 4603⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\stuff\FreeDownloadManagerPortable_3.9.7.1641.paf.exe"C:\Users\Admin\Desktop\stuff\FreeDownloadManagerPortable_3.9.7.1641.paf.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\FreeDownloadManagerPortable_3.9.7.1641.paf.exe"C:\Users\Admin\Desktop\stuff\FreeDownloadManagerPortable_3.9.7.1641.paf.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\KLauncher-Installer.exe"C:\Users\Admin\Desktop\stuff\KLauncher-Installer.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\MEmu-setup-abroad-360-20240322.exe"C:\Users\Admin\Desktop\stuff\MEmu-setup-abroad-360-20240322.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\Nadlote.exe"C:\Users\Admin\Desktop\stuff\Nadlote.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C "c:\RECYCLER\smss.exe"3⤵
-
\??\c:\RECYCLER\smss.exec:\RECYCLER\smss.exe4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ipconfig > c:\RECYCLER\IP.dlx5⤵
-
C:\Windows\SysWOW64\ipconfig.exeipconfig6⤵
- Gathers network information
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net share Love2="c:\Documents and Settings" /unlimited | net share Love1=C:\Windows /unlimited | net share Love3=d:\ /unlimited5⤵
-
C:\Windows\SysWOW64\net.exenet share Love2="c:\Documents and Settings" /unlimited6⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share Love2="c:\Documents and Settings" /unlimited7⤵
-
-
-
C:\Windows\SysWOW64\net.exenet share Love1=C:\Windows /unlimited6⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share Love1=C:\Windows /unlimited7⤵
-
-
-
C:\Windows\SysWOW64\net.exenet share Love3=d:\ /unlimited6⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share Love3=d:\ /unlimited7⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "smss\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "smss\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 0 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 0 -n 2 -w 36⤵
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 1 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 1 -n 2 -w 36⤵
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 2 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 2 -n 2 -w 36⤵
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f6⤵
- Modifies registry key
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f4⤵
- Modifies registry key
-
-
-
-
C:\Users\Admin\Desktop\stuff\DriverUpdate.exe"C:\Users\Admin\Desktop\stuff\DriverUpdate.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\fdm_x64_setup.exe"C:\Users\Admin\Desktop\stuff\fdm_x64_setup.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-MC7CJ.tmp\fdm_x64_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-MC7CJ.tmp\fdm_x64_setup.tmp" /SL5="$303E4,42295280,832512,C:\Users\Admin\Desktop\stuff\fdm_x64_setup.exe"3⤵
-
-
-
C:\Users\Admin\Desktop\stuff\EternalRocks.exe"C:\Users\Admin\Desktop\stuff\EternalRocks.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\DanaBot.exe"C:\Users\Admin\Desktop\stuff\DanaBot.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 1403⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\stuff\fdm_x64_setup.exe"C:\Users\Admin\Desktop\stuff\fdm_x64_setup.exe" "C:\Users\Admin\Desktop\stuff\fdm_x64_setup.exe - Shortcut.lnk"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-JDUOE.tmp\fdm_x64_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-JDUOE.tmp\fdm_x64_setup.tmp" /SL5="$30404,42295280,832512,C:\Users\Admin\Desktop\stuff\fdm_x64_setup.exe" "C:\Users\Admin\Desktop\stuff\fdm_x64_setup.exe - Shortcut.lnk"3⤵
-
-
-
C:\Users\Admin\Desktop\stuff\7ev3n.exe"C:\Users\Admin\Desktop\stuff\7ev3n.exe"2⤵
-
C:\Users\Admin\AppData\Local\system.exe"C:\Users\Admin\AppData\Local\system.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat4⤵
-
-
C:\Windows\SysWOW64\SCHTASKS.exeC:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f4⤵
- Creates scheduled task(s)
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:644⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:645⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:644⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:645⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:644⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:645⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:644⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:645⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:644⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:645⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:644⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:645⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6492 -s 13644⤵
- Program crash
-
-
-
-
C:\Users\Admin\Desktop\stuff\7ev3n.exe"C:\Users\Admin\Desktop\stuff\7ev3n.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat3⤵
-
-
C:\Windows\SysWOW64\SCHTASKS.exeC:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:644⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:644⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:644⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:644⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:644⤵
-
-
-
C:\windows\SysWOW64\cmd.exeC:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:644⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 13603⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\stuff\AdwereCleaner.exe"C:\Users\Admin\Desktop\stuff\AdwereCleaner.exe"2⤵
-
C:\Users\Admin\AppData\Local\6AdwCleaner.exe"C:\Users\Admin\AppData\Local\6AdwCleaner.exe"3⤵
-
-
-
C:\Users\Admin\Desktop\stuff\$uckyLocker.exe"C:\Users\Admin\Desktop\stuff\$uckyLocker.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\$uckyLocker.exe"C:\Users\Admin\Desktop\stuff\$uckyLocker.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\7ev3n.exe"C:\Users\Admin\Desktop\stuff\7ev3n.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7936 -s 14643⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\stuff\AdwereCleaner.exe"C:\Users\Admin\Desktop\stuff\AdwereCleaner.exe"2⤵
-
C:\Users\Admin\AppData\Local\6AdwCleaner.exe"C:\Users\Admin\AppData\Local\6AdwCleaner.exe"3⤵
-
-
-
C:\Users\Admin\Desktop\stuff\DanaBot.exe"C:\Users\Admin\Desktop\stuff\DanaBot.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 1523⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\stuff\DriverUpdate.exe"C:\Users\Admin\Desktop\stuff\DriverUpdate.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\EternalRocks.exe"C:\Users\Admin\Desktop\stuff\EternalRocks.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\EternalRocks.exe"C:\Users\Admin\Desktop\stuff\EternalRocks.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\fdm_x64_setup.exe"C:\Users\Admin\Desktop\stuff\fdm_x64_setup.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-VUV88.tmp\fdm_x64_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-VUV88.tmp\fdm_x64_setup.tmp" /SL5="$40522,42295280,832512,C:\Users\Admin\Desktop\stuff\fdm_x64_setup.exe"3⤵
-
-
-
C:\Users\Admin\Desktop\stuff\OneLaunch - Easy PDF_bfmsa.exe"C:\Users\Admin\Desktop\stuff\OneLaunch - Easy PDF_bfmsa.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-TBFRH.tmp\OneLaunch - Easy PDF_bfmsa.tmp"C:\Users\Admin\AppData\Local\Temp\is-TBFRH.tmp\OneLaunch - Easy PDF_bfmsa.tmp" /SL5="$40470,2484380,893952,C:\Users\Admin\Desktop\stuff\OneLaunch - Easy PDF_bfmsa.exe"3⤵
-
C:\Users\Admin\Desktop\stuff\OneLaunch - Easy PDF_bfmsa.exe"C:\Users\Admin\Desktop\stuff\OneLaunch - Easy PDF_bfmsa.exe" /PDATA=eyJ1dG1fY2FtcGFpZ24iOiIxNzQyODAxMDA4NiIsImxvd2VyIjoiaGVhZGxpbmUzIiwidXRtX21lZGl1bSI6IjE1OTM3NjQ0MzUyNyIsInByb2ZpbGUiOiJwZGYiLCJtYWluIjoiaGVhZGxpbmUzIiwidWEiOiJlZGdlIiwidXRtX3Rlcm0iOiJ3d3cubWVtdXBsYXkuY29tIiwiZ2NsaWQiOiJFQUlhSVFvYkNoTUlvOVRkdHBTVmhRTVZOMlFWQ0IyWjNRb3pFQUVZQVNBQUVnSXVBUERfQndFIiwiZGlzdGluY3RfaWQiOiI5NWU3MGNiYS00NDFjLTQ4MGItOWRjOS02Y2NiYWI0MGYzZDUiLCJscF91cmwiOiJodHRwczovL2dldGVhc3lwZGYuY29tL3BkZi9scDUiLCJ3aGl0ZWxhYmVsIjoiZWFzeXBkZiIsImxwYyI6MCwidXRtX3NvdXJjZSI6Im9oLWdkbiIsInV0bV9jb250ZW50IjoiNjg4ODk4NjE4ODE4IiwiaW5zdGFsbF90aW1lIjoxNzExNTcxMDI3LCJkZWZhdWx0X2Jyb3dzZXIiOiJNU0VkZ2VIVE0iLCJpbml0aW5hbF92ZXJzaW9uIjoiNS4yOS4yLjAiLCJwYWNrYWdlZF9icm93c2VyIjoiTm9uZSIsInNwbGl0IjoiYyIsIm5vX3NwbGl0IjpmYWxzZSwic3BsaXQyIjoiYiIsInNlcnZlcl9zaWRlX3NwbGl0XzI0XzAzX2ZvY3VzX2N1cnNvcl9udHAiOiJ2YXJpYXRpb24iLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoidmFyaWF0aW9uIiwic2VydmVyX3NpZGVfc3BsaXRfMjRfMDNfZGVza3RvcF9zaG9ydGN1dF9uYW1lIjoidmFyaWF0aW9uIiwiZW5jb2RlZF9zcGxpdHMiOiIwMDAifQ== /LAUNCHER /VERYSILENT4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-SAG3F.tmp\OneLaunch - Easy PDF_bfmsa.tmp"C:\Users\Admin\AppData\Local\Temp\is-SAG3F.tmp\OneLaunch - Easy PDF_bfmsa.tmp" /SL5="$30690,2484380,893952,C:\Users\Admin\Desktop\stuff\OneLaunch - Easy PDF_bfmsa.exe" /PDATA=eyJ1dG1fY2FtcGFpZ24iOiIxNzQyODAxMDA4NiIsImxvd2VyIjoiaGVhZGxpbmUzIiwidXRtX21lZGl1bSI6IjE1OTM3NjQ0MzUyNyIsInByb2ZpbGUiOiJwZGYiLCJtYWluIjoiaGVhZGxpbmUzIiwidWEiOiJlZGdlIiwidXRtX3Rlcm0iOiJ3d3cubWVtdXBsYXkuY29tIiwiZ2NsaWQiOiJFQUlhSVFvYkNoTUlvOVRkdHBTVmhRTVZOMlFWQ0IyWjNRb3pFQUVZQVNBQUVnSXVBUERfQndFIiwiZGlzdGluY3RfaWQiOiI5NWU3MGNiYS00NDFjLTQ4MGItOWRjOS02Y2NiYWI0MGYzZDUiLCJscF91cmwiOiJodHRwczovL2dldGVhc3lwZGYuY29tL3BkZi9scDUiLCJ3aGl0ZWxhYmVsIjoiZWFzeXBkZiIsImxwYyI6MCwidXRtX3NvdXJjZSI6Im9oLWdkbiIsInV0bV9jb250ZW50IjoiNjg4ODk4NjE4ODE4IiwiaW5zdGFsbF90aW1lIjoxNzExNTcxMDI3LCJkZWZhdWx0X2Jyb3dzZXIiOiJNU0VkZ2VIVE0iLCJpbml0aW5hbF92ZXJzaW9uIjoiNS4yOS4yLjAiLCJwYWNrYWdlZF9icm93c2VyIjoiTm9uZSIsInNwbGl0IjoiYyIsIm5vX3NwbGl0IjpmYWxzZSwic3BsaXQyIjoiYiIsInNlcnZlcl9zaWRlX3NwbGl0XzI0XzAzX2ZvY3VzX2N1cnNvcl9udHAiOiJ2YXJpYXRpb24iLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoidmFyaWF0aW9uIiwic2VydmVyX3NpZGVfc3BsaXRfMjRfMDNfZGVza3RvcF9zaG9ydGN1dF9uYW1lIjoidmFyaWF0aW9uIiwiZW5jb2RlZF9zcGxpdHMiOiIwMDAifQ== /LAUNCHER /VERYSILENT5⤵
-
C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_bfmsa.exe"C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_bfmsa.exe" /PDATA=eyJ1dG1fY2FtcGFpZ24iOiIxNzQyODAxMDA4NiIsImxvd2VyIjoiaGVhZGxpbmUzIiwidXRtX21lZGl1bSI6IjE1OTM3NjQ0MzUyNyIsInByb2ZpbGUiOiJwZGYiLCJtYWluIjoiaGVhZGxpbmUzIiwidWEiOiJlZGdlIiwidXRtX3Rlcm0iOiJ3d3cubWVtdXBsYXkuY29tIiwiZ2NsaWQiOiJFQUlhSVFvYkNoTUlvOVRkdHBTVmhRTVZOMlFWQ0IyWjNRb3pFQUVZQVNBQUVnSXVBUERfQndFIiwiZGlzdGluY3RfaWQiOiI5NWU3MGNiYS00NDFjLTQ4MGItOWRjOS02Y2NiYWI0MGYzZDUiLCJscF91cmwiOiJodHRwczovL2dldGVhc3lwZGYuY29tL3BkZi9scDUiLCJ3aGl0ZWxhYmVsIjoiZWFzeXBkZiIsImxwYyI6MCwidXRtX3NvdXJjZSI6Im9oLWdkbiIsInV0bV9jb250ZW50IjoiNjg4ODk4NjE4ODE4IiwiaW5zdGFsbF90aW1lIjoxNzExNTcxMDI3LCJkZWZhdWx0X2Jyb3dzZXIiOiJNU0VkZ2VIVE0iLCJpbml0aW5hbF92ZXJzaW9uIjoiNS4yOS4yLjAiLCJwYWNrYWdlZF9icm93c2VyIjoiTm9uZSIsInNwbGl0IjoiYyIsIm5vX3NwbGl0IjpmYWxzZSwic3BsaXQyIjoiYiIsInNlcnZlcl9zaWRlX3NwbGl0XzI0XzAzX2ZvY3VzX2N1cnNvcl9udHAiOiJ2YXJpYXRpb24iLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoidmFyaWF0aW9uIiwic2VydmVyX3NpZGVfc3BsaXRfMjRfMDNfZGVza3RvcF9zaG9ydGN1dF9uYW1lIjoidmFyaWF0aW9uIiwiZW5jb2RlZF9zcGxpdHMiOiIwMDAifQ==6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-2T25S.tmp\OneLaunch Setup_bfmsa.tmp"C:\Users\Admin\AppData\Local\Temp\is-2T25S.tmp\OneLaunch Setup_bfmsa.tmp" /SL5="$4028E,105360929,893952,C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_bfmsa.exe" /PDATA=eyJ1dG1fY2FtcGFpZ24iOiIxNzQyODAxMDA4NiIsImxvd2VyIjoiaGVhZGxpbmUzIiwidXRtX21lZGl1bSI6IjE1OTM3NjQ0MzUyNyIsInByb2ZpbGUiOiJwZGYiLCJtYWluIjoiaGVhZGxpbmUzIiwidWEiOiJlZGdlIiwidXRtX3Rlcm0iOiJ3d3cubWVtdXBsYXkuY29tIiwiZ2NsaWQiOiJFQUlhSVFvYkNoTUlvOVRkdHBTVmhRTVZOMlFWQ0IyWjNRb3pFQUVZQVNBQUVnSXVBUERfQndFIiwiZGlzdGluY3RfaWQiOiI5NWU3MGNiYS00NDFjLTQ4MGItOWRjOS02Y2NiYWI0MGYzZDUiLCJscF91cmwiOiJodHRwczovL2dldGVhc3lwZGYuY29tL3BkZi9scDUiLCJ3aGl0ZWxhYmVsIjoiZWFzeXBkZiIsImxwYyI6MCwidXRtX3NvdXJjZSI6Im9oLWdkbiIsInV0bV9jb250ZW50IjoiNjg4ODk4NjE4ODE4IiwiaW5zdGFsbF90aW1lIjoxNzExNTcxMDI3LCJkZWZhdWx0X2Jyb3dzZXIiOiJNU0VkZ2VIVE0iLCJpbml0aW5hbF92ZXJzaW9uIjoiNS4yOS4yLjAiLCJwYWNrYWdlZF9icm93c2VyIjoiTm9uZSIsInNwbGl0IjoiYyIsIm5vX3NwbGl0IjpmYWxzZSwic3BsaXQyIjoiYiIsInNlcnZlcl9zaWRlX3NwbGl0XzI0XzAzX2ZvY3VzX2N1cnNvcl9udHAiOiJ2YXJpYXRpb24iLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoidmFyaWF0aW9uIiwic2VydmVyX3NpZGVfc3BsaXRfMjRfMDNfZGVza3RvcF9zaG9ydGN1dF9uYW1lIjoidmFyaWF0aW9uIiwiZW5jb2RlZF9zcGxpdHMiOiIwMDAifQ==7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8916 -s 20768⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8916 -s 21168⤵
- Program crash
-
-
-
-
-
-
-
-
C:\Users\Admin\Desktop\stuff\MEmu-setup-abroad-360-20240322.exe"C:\Users\Admin\Desktop\stuff\MEmu-setup-abroad-360-20240322.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\OneLaunch - Easy PDF_bfmsa.exe"C:\Users\Admin\Desktop\stuff\OneLaunch - Easy PDF_bfmsa.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-36T9E.tmp\OneLaunch - Easy PDF_bfmsa.tmp"C:\Users\Admin\AppData\Local\Temp\is-36T9E.tmp\OneLaunch - Easy PDF_bfmsa.tmp" /SL5="$105EE,2484380,893952,C:\Users\Admin\Desktop\stuff\OneLaunch - Easy PDF_bfmsa.exe"3⤵
-
-
-
C:\Users\Admin\Desktop\stuff\NuancePDFReader_English.exe"C:\Users\Admin\Desktop\stuff\NuancePDFReader_English.exe"2⤵
-
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{C8FB9EA8-FE82-4A65-ACBE-6B619821B6C0}\Nuance PDF Reader.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Downloaded Installations\{C8FB9EA8-FE82-4A65-ACBE-6B619821B6C0}\1033.MST" SETUPEXEDIR="C:\Users\Admin\Desktop\stuff" SETUPEXENAME="NuancePDFReader_English.exe"3⤵
-
-
-
C:\Users\Admin\Desktop\stuff\RevengeRAT.exe"C:\Users\Admin\Desktop\stuff\RevengeRAT.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jvm-w_n7.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE6FF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc541F702548840349843473750C9B3B7.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lxit_5iz.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF1AD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD9D296F8836F4C22A2B6487BC3DC045.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\82h6qi8n.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6C32A78C572E4382B8289A55186DEC7.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\d7cn1_jo.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7D5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB13FA5FB29C44D94A985723D7A3F153.TMP"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"6⤵
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qupronr4.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES72E4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8FC2C30CA3B24B799CE01870B357475.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\g70acews.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES741C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBD2D1800F38A4826B11DE6E9698AE5A.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1q4fwjwi.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES75B2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2267DC1D27DE4F8781631A2B5C71D44F.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\emvh2vsh.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7814.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc81A66B159B13498C9234968B27E5FC64.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sojxznji.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES79E8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc39BFF766E67543478084D0F130386F15.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0baossuq.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7BCD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB8883092B0B044AB9DE1E3B82B2A1B5.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\znatzakm.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7FF3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE2839160F8146BF8C3AFF1DEDFEE0E4.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\niep9_-u.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8235.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6AB0079BA52D4089923FD2BADF5EF85B.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\au0weexp.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES833F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3E15BBCA61A546838B5D10E5EFD8447C.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\icsfuokn.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8478.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE3C8860BE4A9449E8E7D51F34B928298.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wnvnwy_w.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8552.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B8E8E4CED5541C39F2F305269188B.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v9nwthue.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES89F6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9A2808047AF7484DB179E366DCB5154.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8wgoigw-.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8BF9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc83A0DF5A6A4CF59858D99D159BE02B.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nvvj1nnh.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E2C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3143F04043214811803D2A47CBCF9D69.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\irokbujd.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES90AD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEB067E865B79477DAFEA6375636DFD63.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2puhs0ae.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9272.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE584EF331224E8294E51671A518818C.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\j1kyf_4j.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES936C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc607557653F4E49C59FFB4BADB48E29ED.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1qzczxwn.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9437.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB02A509642134A00ABC7979A3B437280.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pr5izu99.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9531.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD3C55337B0848FC86A4D5548336B.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gmeg_ubf.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES95DD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1A1C62E628FF44758F63D4FD391C17F.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y_7izhmq.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES96F6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFB914FC8AA1044EBA07FECE677449E48.TMP"7⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"6⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zbjnwm92.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES97A2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc31F47EC48F894D7F9C46799D98FB40CA.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xpfjlxkz.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES97F0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2363F59B95748BD9A851E1689237E79.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wolqbllq.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES982E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3989C04784D74F23BC6C1B7C47652AD.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f-cujnbw.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES987D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC35169B0E0BA4DE4A8A427D0CE6BC3A.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_ojt-got.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES98AB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE2B69E71D7054DFCB6E664F15B7B178E.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\o3xmnm5m.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9938.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5B2416D1A44F4CBCBF9BFBD4D8869A27.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ytqyesbs.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A51.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3259960FA734254B2CCD8AA93224A1.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tserct4k.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B99.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc934B0BCEC895499599A02B9272D615F3.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uwjyrvts.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C65.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB539C84314C44E6B2D8DBA2CBB370B3.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ak3_q6x8.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9DDC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc124CFBA4B2614795AF583FB2F254D1CA.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nyqrxla9.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F14.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7393F9FCE354609A7B93CF281557DC7.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hk2qd9px.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA06C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc82F51EA6626A4CEE94BF1C74FDE2E1CD.TMP"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mgb9v10x.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA0F8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3F42C3A1266C4297AC926CCE70FCC5F.TMP"7⤵
-
-
-
-
-
-
-
C:\Users\Admin\Desktop\stuff\Setup.exe"C:\Users\Admin\Desktop\stuff\Setup.exe"2⤵
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\stuff\Smallpdf.msi"2⤵
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\stuff\Smallpdf.msi"2⤵
-
-
C:\Users\Admin\Desktop\stuff\Wave Browser.exe"C:\Users\Admin\Desktop\stuff\Wave Browser.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\Remcos.exe"C:\Users\Admin\Desktop\stuff\Remcos.exe" C:\Users\Admin\Desktop\stuff\RevengeRAT.exe2⤵
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "3⤵
-
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 24⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\Userdata\Userdata.exe"C:\Windows\SysWOW64\Userdata\Userdata.exe"4⤵
-
-
-
-
C:\Users\Admin\Desktop\stuff\RevengeRAT.exe"C:\Users\Admin\Desktop\stuff\RevengeRAT.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"4⤵
-
-
-
-
C:\Users\Admin\Desktop\stuff\PDFSuite20.exe"C:\Users\Admin\Desktop\stuff\PDFSuite20.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\Remcos.exe"C:\Users\Admin\Desktop\stuff\Remcos.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\WarzoneRAT.exe"C:\Users\Admin\Desktop\stuff\WarzoneRAT.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9F86.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
-
C:\Users\Admin\Desktop\stuff\AdwereCleaner.exe"C:\Users\Admin\Desktop\stuff\AdwereCleaner.exe"2⤵
-
C:\Users\Admin\AppData\Local\6AdwCleaner.exe"C:\Users\Admin\AppData\Local\6AdwCleaner.exe"3⤵
-
-
-
C:\Users\Admin\Desktop\stuff\AdwereCleaner.exe"C:\Users\Admin\Desktop\stuff\AdwereCleaner.exe"2⤵
-
C:\Users\Admin\AppData\Local\6AdwCleaner.exe"C:\Users\Admin\AppData\Local\6AdwCleaner.exe"3⤵
-
-
-
C:\Users\Admin\Desktop\stuff\$uckyLocker.exe"C:\Users\Admin\Desktop\stuff\$uckyLocker.exe"2⤵
-
-
C:\Users\Admin\Desktop\stuff\Annabelle.exe"C:\Users\Admin\Desktop\stuff\Annabelle.exe"2⤵
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\NetSh.exeNetSh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" -r -t 00 -f3⤵
-
-
-
C:\Users\Admin\Desktop\stuff\Birele.exe"C:\Users\Admin\Desktop\stuff\Birele.exe"2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM explorer.exe3⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\Desktop\stuff\Annabelle.exe"C:\Users\Admin\Desktop\stuff\Annabelle.exe"2⤵
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\NetSh.exeNetSh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000138" "Service-0x0-3e7$\Default" "0000000000000154" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe" nowindow2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status on true /updatesubstatus none /scansubstatus none /settingssubstatus none2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe"C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe" "C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\config\UpdateControllerConfig.json" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbclsupdate\staging" /db:dbupdate /su:no2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\LocalLow\IGDump\hzpejtiydmunbolozihyyphnuaelfqsu\ig.exeig.exe timer 4000 nqodcssfxkavtrxezezqlmtsnnnswavn.ext2⤵
-
-
C:\Users\Admin\AppData\LocalLow\IGDump\fbqqibrjwdvicysvxueicitlgvajxpbv\ig.exeig.exe timer 4000 ezptxxjdknppdqlfdjfsvdzjidtqnlmn.ext2⤵
-
-
C:\Users\Admin\AppData\LocalLow\IGDump\inltrhnuyszkfxzfuseaxuilghmffmcd\ig.exeig.exe timer 4000 lcqrudhekjdaoishgtzqdtzxviamejvg.ext2⤵
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status off true /updatesubstatus none /scansubstatus none /settingssubstatus none2⤵
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5852 -ip 58521⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4204 -ip 42041⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5896 -ip 58961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4704 -ip 47041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7936 -ip 79361⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 719F0A37157A320C106DAB5901B9E5D6 C2⤵
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6492 -ip 64921⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 8916 -ip 89161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 8916 -ip 89161⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa387b055 /state1:0x41c64e6d1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5264 -ip 52641⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
2File Deletion
2Modify Registry
5Scripting
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
LicenseControllerImpl.dll
PoliciesControllerImpl.dll
UpdateControllerImpl.dll
pkgvers.dat
dbmanifest2.dat
mbtun.cat
mbtun.sys
MBAMInstallerService.exe
MBVpnTunnelService.exe
Malwarebytes.exe
ServiceConfig.json
ServiceConfig.json
ctlrvers.dat
mb5uns.exe
mbshlext.dll
mbtun.dll
mbtun.inf
offreg.dll
MBAMSwissArmy.cat
MBAMSwissArmy.inf
MBAMSwissArmy.sys
farflt.cat
farflt.inf
farflt.sys
farflt.tmf
mbamchameleon.cat
mbamchameleon.inf
mbamchameleon.sys
srvversion.dat
version.dat
dlrarhsiva.exe
mdkhm.zip
ARWFI.dat
mbarwind.arw
mbae-default.log
e3b65a62-ec76-11ee-bcd6-e27d0092c90a.json
AeConfig.json
AeConfig.json
AeConfig.json
AeConfig.json
AeConfig.json
ArwControllerConfig.json
ArwControllerConfig.json
CleanControllerConfig.json
CleanControllerConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
LicenseConfig.json
LicenseConfig.json
LicenseConfig.json
MwacControllerConfig.json
MwacControllerConfig.json
PoliciesConfig.json
PoliciesConfig.json
RtpConfig.json
RtpConfig.json
RtpConfig.json
RtpConfig.json
ScanConfig.json
ScanConfig.json
ScanConfig.json
ScanConfig.json
ScanConfig.json
ScanConfig.json
ScanConfig.json
ScanConfig.json
ScanConfig.json
ScanConfig.json
ScanConfig.json
ScanConfig.json
ScanConfig.json
ScanConfig.json
ScanConfig.json
SpConfigFile.json
SpConfigFile.json
TelemCtrlConfig.json
TelemCtrlConfig.json
TelemCtrlConfig.json
TelemCtrlConfig.json
TelemCtrlConfig.json
TelemCtrlConfig.json
TelemCtrlConfig.json
TelemCtrlConfig.json
UpdateControllerConfig.json
UpdateControllerConfig.json
UpdateControllerConfig.json
UpdateControllerConfig.json
UpdateControllerConfig.json
UpdateControllerConfig.json.bak
UpdateControllerConfig.json.bak
VPNControllerConfig.json
VPNControllerConfig.json
VPNServerListConfig.json
telemetry.json
d1333aa0-131a-9a03-b18d8d5d80aa5689
D2A.tmp
D35.tmp
D36.tmp
D3C.tmp
D3E.tmp
D45.tmp
D57.tmp
D5A.tmp
D5E.tmp
D5F.tmp
D60.tmp
D61.tmp
D65.tmp
D68.tmp
D69.tmp
D6A.tmp
D9D.tmp
DAC.tmp
Actions.dll
BrowserSDKDLL.dll
Global.nm
Global.sr
cfg.bin
clean.mbdb
dynconfig.dat
exclusions.txt
ig.exe
mbdigsig2.dat
prot.mbdb
rdefs.mbdb
rules.mbdb
sample.dll
scan.mbdb
tids.mbdb
wprot2.mbdb
ebd2ce00ec7711ee82b1e27d0092c90a
f91128b4ec7711eeb71ce27d0092c90a
f936d816ec7711eebf8fe27d0092c90a
f967fa36ec7711eeaf95e27d0092c90a
f989da48ec7711eea599e27d0092c90a
f9b46e84ec7711ee9ecde27d0092c90a
f9dc40bcec7711ee9e60e27d0092c90a
SdkDbUpdatrV5.dll
expapply64.dll
mbupdatrV5.exe
version.dat
vcredist2012_x86_0_vcRuntimeMinimum_x86.ico
autorun.INF
6AdwCleaner.exe
Nuance PDF Reader.msi
2feabdb0-fe27-4d8b-8c44-0cba38d2cabe.tmp
settings.dat
settings.dat
6e67c50f-ce2a-4acf-b84d-577e243cd5bb.tmp
the-real-index
the-real-index
the-real-index
MANIFEST-000001
messages.json
manifest.json
CURRENT
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe579069.TMP
CURRENT
Local State
Local State
Local State
OneLaunch Setup.exe
_is7844.tmp
Win32Library.dll
min-10-light.png
OneLaunch - Easy PDF_bfmsa.tmp
checkmark-10-light.png
exit-rest.bmp
fdm_x64_setup.tmp
mbsetup.log
LangDLL.dll
UserInfo.dll
nsDialogs.dll
FindProcDLL.dll
modern-wizard.bmp
LangDLL.dll
System.dll
inetc.dll
System.dll
messages.json
level_up_illustration.svg
no-items.svg
block_page_back_arrow.svg
close_icon.svg
cog_icon.svg
learn_more_info_icon.svg
level_up_illustration.svg
no_items.svg
content-debugging.js
content-scripts.js
mbgc.db.rulesetoverride.3.0.1
ca8a1ecf-eaeb-4bca-8cbf-cb6d92a66048.tmp
smss.exe
vbc124CFBA4B2614795AF583FB2F254D1CA.TMP
vbc3259960FA734254B2CCD8AA93224A1.TMP
vbcB539C84314C44E6B2D8DBA2CBB370B3.TMP
0x0409.ini
1033.MST
_ISMSIDEL.INI
_ISMSIDEL.INI
~68FC.tmp
system.exe
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
svchost.exe
data.safe.bin
36c4e64e-61eb-47a0-b099-e04ee1ec0324
52c9a92f-f636-426f-9b47-7f38fe6747c1
{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi
prefs.js
prefs.js
sessionCheckpoints.json
sessionstore.jsonlz4
2791846577cearcohteSdsLgo.sqlite
READ_IT.txt
MBSetup.exe
logs.dat
logs.dat
dberr.txt
dberr.txt
21EA03E12A6F9D076B6BC3318EA9363E_6EF0095DA824AE045AE9FC5B645DF095
mbam.sys
7z.dll
Malwarebytes_Assistant.runtimeconfig.json
mbae64.sys
MBAMCoreV5.dll
mscordaccore.dll
MBAMService.exe
mbamelam.cat
mbamelam.inf
mbamelam.sys
memory/740-10079-0x00007FFA08880000-0x00007FFA09341000-memory.dmp
memory/740-10088-0x000000001B6F0000-0x000000001B700000-memory.dmp
memory/1800-9890-0x000000006E060000-0x000000006E3FA000-memory.dmp
memory/1800-9771-0x000000006E4C0000-0x000000006E4C9000-memory.dmp
memory/1800-10054-0x000000006E4C0000-0x000000006E4C9000-memory.dmp
memory/2324-9996-0x000000001AF80000-0x000000001AF90000-memory.dmp
memory/2324-10001-0x000000001AF80000-0x000000001AF90000-memory.dmp
memory/2324-10086-0x00007FFA08880000-0x00007FFA09341000-memory.dmp
memory/2324-9934-0x000000001AF80000-0x000000001AF90000-memory.dmp
memory/2324-10106-0x000000001AF80000-0x000000001AF90000-memory.dmp
memory/2324-9999-0x000000001AF80000-0x000000001AF90000-memory.dmp
memory/2324-9929-0x0000000000120000-0x000000000014E000-memory.dmp
memory/2324-9933-0x00007FFA08880000-0x00007FFA09341000-memory.dmp
memory/2356-5006-0x00000216193A0000-0x00000216198AE000-memory.dmp
memory/2356-8795-0x00000216193A0000-0x00000216198AE000-memory.dmp
memory/2356-9295-0x00000216193A0000-0x00000216198AE000-memory.dmp
memory/2356-8372-0x00000216193A0000-0x00000216198AE000-memory.dmp
memory/2356-9217-0x00000216193A0000-0x00000216198AE000-memory.dmp
memory/2356-9060-0x00000216193A0000-0x00000216198AE000-memory.dmp
memory/2356-8899-0x00000216193A0000-0x00000216198AE000-memory.dmp
memory/2356-9043-0x00000216193A0000-0x00000216198AE000-memory.dmp
memory/2356-9432-0x00000216193A0000-0x00000216198AE000-memory.dmp
memory/2356-9222-0x00000216193A0000-0x00000216198AE000-memory.dmp
memory/2356-8718-0x00000216193A0000-0x00000216198AE000-memory.dmp
memory/2356-8773-0x00000216193A0000-0x00000216198AE000-memory.dmp
memory/2356-9228-0x00000216193A0000-0x00000216198AE000-memory.dmp
memory/2996-9909-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/2996-9701-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/4204-9911-0x00000000026C0000-0x0000000002945000-memory.dmp
memory/4204-9912-0x0000000000400000-0x0000000000AAD000-memory.dmp
memory/4204-10031-0x0000000000400000-0x0000000000AAD000-memory.dmp
memory/4960-9988-0x00007FFA03870000-0x00007FFA04211000-memory.dmp
memory/4960-9937-0x000000001D700000-0x000000001DC0E000-memory.dmp
memory/4960-9708-0x00007FFA03870000-0x00007FFA04211000-memory.dmp
memory/4960-9789-0x000000001C4E0000-0x000000001C9AE000-memory.dmp
memory/4960-9709-0x00007FFA03870000-0x00007FFA04211000-memory.dmp
memory/4960-9989-0x0000000001290000-0x00000000012A0000-memory.dmp
memory/4960-9952-0x0000000001290000-0x00000000012A0000-memory.dmp
memory/4960-9783-0x000000001B920000-0x000000001BD4E000-memory.dmp
memory/4960-9942-0x000000001B7D0000-0x000000001B7D8000-memory.dmp
memory/4960-9940-0x000000001DCB0000-0x000000001DD4C000-memory.dmp
memory/5264-9900-0x0000000000400000-0x000000000066B000-memory.dmp
memory/5348-9749-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/5348-9928-0x0000000000400000-0x000000000071C000-memory.dmp
memory/5392-9780-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/5392-9791-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/5392-10067-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/5564-9531-0x00007FFA08880000-0x00007FFA09341000-memory.dmp
memory/5564-9876-0x00007FFA08880000-0x00007FFA09341000-memory.dmp
memory/5564-9534-0x00000185AB500000-0x00000185ABE14000-memory.dmp
memory/5564-9913-0x00000185C6550000-0x00000185C6560000-memory.dmp
memory/5564-9542-0x00000185C6550000-0x00000185C6560000-memory.dmp
memory/5852-9577-0x0000000002750000-0x00000000029D0000-memory.dmp
memory/5852-9775-0x0000000000400000-0x0000000000AAD000-memory.dmp
memory/5852-9582-0x00000000029D0000-0x0000000002C5D000-memory.dmp
memory/5852-9583-0x0000000000400000-0x0000000000AAD000-memory.dmp
memory/5852-9672-0x0000000000400000-0x0000000000AAD000-memory.dmp
memory/5928-9666-0x0000000000E90000-0x0000000000E91000-memory.dmp
memory/5928-9787-0x00000000004D0000-0x0000000000D15000-memory.dmp
memory/5928-9935-0x0000000000E90000-0x0000000000E91000-memory.dmp
memory/6100-5125-0x00007FFA194E0000-0x00007FFA199DE000-memory.dmp
memory/6100-8774-0x00007FFA194E0000-0x00007FFA199DE000-memory.dmp
memory/6252-9907-0x00000000025D0000-0x00000000025D1000-memory.dmp
memory/6404-9694-0x0000000000E90000-0x0000000000E91000-memory.dmp
memory/6404-9688-0x0000000002210000-0x000000000247B000-memory.dmp
memory/6404-9947-0x0000000000E90000-0x0000000000E91000-memory.dmp
memory/6552-9464-0x00007FFA08880000-0x00007FFA09341000-memory.dmp
memory/6552-9463-0x000001AA64700000-0x000001AA6471E000-memory.dmp
memory/6552-9541-0x00007FFA08880000-0x00007FFA09341000-memory.dmp
memory/6552-9467-0x000001AA7EBD0000-0x000001AA7EBE0000-memory.dmp
memory/6776-10057-0x0000000074540000-0x0000000074CF0000-memory.dmp
memory/6776-10056-0x0000000004EF0000-0x0000000004F00000-memory.dmp
memory/8300-9675-0x0000000000400000-0x0000000000445000-memory.dmp
memory/8432-10120-0x0000000074540000-0x0000000074CF0000-memory.dmp
memory/8432-9936-0x0000000074540000-0x0000000074CF0000-memory.dmp
memory/8468-8942-0x00007FFA194E0000-0x00007FFA199DE000-memory.dmp
memory/8468-8944-0x00007FFA194E0000-0x00007FFA199DE000-memory.dmp
memory/8556-8947-0x00007FFA194E0000-0x00007FFA199DE000-memory.dmp
memory/8556-8943-0x00007FFA194E0000-0x00007FFA199DE000-memory.dmp
memory/8604-9286-0x00000000050F0000-0x0000000005182000-memory.dmp
memory/8604-9283-0x0000000000690000-0x00000000006FE000-memory.dmp
memory/8604-9284-0x0000000074540000-0x0000000074CF0000-memory.dmp
memory/8604-9285-0x0000000005600000-0x0000000005BA4000-memory.dmp
memory/8604-9661-0x0000000074540000-0x0000000074CF0000-memory.dmp
memory/8604-9287-0x0000000005250000-0x0000000005260000-memory.dmp
memory/8604-9669-0x0000000005250000-0x0000000005260000-memory.dmp
memory/8604-9288-0x00000000051A0000-0x00000000051AA000-memory.dmp