Analysis
- max time kernel
25s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
05/08/2024, 18:33
General
- Target Redeye Email Checker.exe
- Size 1.8MB
- Sample240805-w665savarp
- SHA256 8b904606790976539fd73805d8a8283a30b67907bc35f7e98e3f679d500d0aca
Score
10/10
Malware Config
Extracted
Family
-
redline
Botnet
-
UltimateCrackPack
C2
-
51.83.170.23:16128
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 62 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 64 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 7 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "6888" "2104" "2276" "2184" "0" "0" "2132" "0" "0" "0" "0" "0"7⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'8⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'9⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'10⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'11⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'12⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"11⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "7976" "2184" "2140" "2188" "0" "0" "2192" "0" "0" "0" "0" "0"14⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"12⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"13⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"14⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"16⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'17⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "7368" "2172" "2136" "2176" "0" "0" "2180" "0" "0" "0" "0" "0"18⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"16⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'18⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"17⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'19⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"18⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'20⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 164421⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"20⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'21⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "8300" "2168" "2128" "2172" "0" "0" "2176" "0" "0" "0" "0" "0"22⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"20⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"21⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'22⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8588 -s 165623⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"21⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'23⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "8716" "2164" "2116" "2168" "0" "0" "2172" "0" "0" "0" "0" "0"24⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"22⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'24⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "8416" "2160" "2116" "2164" "0" "0" "2168" "0" "0" "0" "0" "0"25⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"24⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'25⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"25⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'26⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'27⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'28⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"28⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'29⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'30⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"30⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'31⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'32⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"32⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'33⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9024 -s 135634⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'34⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'35⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "9220" "2088" "2040" "2092" "0" "0" "2096" "0" "0" "0" "0" "0"36⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'36⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'37⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'38⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"38⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'43⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"43⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'44⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9604 -s 176445⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"44⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'46⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"46⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"47⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"48⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"48⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"49⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"50⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10528 -s 24053⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"51⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"52⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'53⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10364 -s 208854⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"52⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"53⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"53⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"54⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"55⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"56⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"56⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"59⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"60⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'62⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "11536" "1924" "1860" "1928" "0" "0" "1932" "0" "0" "0" "0" "0"63⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"61⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"64⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"65⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"66⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"66⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"67⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"68⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"68⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"69⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"69⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"70⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"71⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"71⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"72⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"73⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"73⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"74⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'75⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"75⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"75⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"76⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"78⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"79⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"79⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"80⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"81⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"82⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"82⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"83⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'84⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"83⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"84⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"85⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"85⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"87⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"88⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"89⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"89⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"90⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"91⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"91⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"92⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"93⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"93⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"94⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"94⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"95⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"95⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"96⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'97⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "13188" "1912" "1856" "1916" "0" "0" "1920" "0" "0" "0" "0" "0"98⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"97⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"98⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"98⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'99⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"99⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"99⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'100⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"99⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"100⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'101⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"100⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"101⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'102⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13160 -s 1412103⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"101⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"102⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"102⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"103⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'104⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"104⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"105⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"105⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"106⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'107⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"107⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"106⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"107⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"108⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"107⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"108⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1110⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"109⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"110⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"110⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'111⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"110⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"111⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"111⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"112⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"113⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"114⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"114⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"115⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"115⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'116⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"116⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'117⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"117⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'118⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"118⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'119⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"119⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"120⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-