Analysis
- max time kernel
31s - max time network
151s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
- submitted
05/08/2024, 18:35
General
- Target Redeyes Minecraft Checker.exe
- Size 1.2MB
- Sample240805-w8cc7ayblb
- SHA256 4f34cddcd5792c3afff2880f5d84c8ea452b8b7d9ae5e38d1b98486227b4f0d9
Score
10/10
Malware Config
Extracted
Family
-
redline
Botnet
-
UltimateCrackPack
C2
-
51.83.170.23:16128
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 5 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 5 IoCs
- Executes dropped EXE 64 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 64 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'7⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'8⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'9⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'10⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'11⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'12⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'13⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'16⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'17⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'18⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'19⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"19⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'20⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'21⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"21⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'22⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'23⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'24⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'25⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'26⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'27⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'28⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'29⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"29⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'30⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"30⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'31⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'32⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'33⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"33⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'34⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'35⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"35⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'36⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'37⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"37⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'38⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'39⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'40⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'41⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'42⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"42⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'43⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'44⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'45⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'46⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"46⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'47⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'48⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'49⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'50⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'51⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'52⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'53⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"53⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'54⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'55⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'56⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'57⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'58⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'59⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'60⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'61⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'62⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'63⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'64⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'65⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'66⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"66⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'67⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"67⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'68⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"68⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'69⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"69⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'70⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"70⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'71⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"71⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'72⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"72⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'73⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"73⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'74⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"74⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'75⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"75⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'76⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"76⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'77⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"77⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'78⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"78⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'79⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"79⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'80⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"80⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'81⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"81⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'82⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"82⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'83⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"83⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'84⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"84⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'85⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"85⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'86⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"86⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'87⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"87⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'88⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"C:\Users\Admin\AppData\Local\Temp\Redeyes Minecraft Checker.exe"87⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-21280006902537371268623698571365317387933041104999741221687726843600533476"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-101546851-1687235232-711817171-430949911636810478-7403361841076179017-209974175"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1002992915-1548295975-1067194250970610321-1272947346-13303039491080047558-950107417"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1902712224710770703-209351808711735332472140998798915723857832108734-455417914"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1853497148-3825230951553869244111831677419619615211439786412-1008028357-525207771"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "17977459281230590739-1464698667-555988755780987359-284763860-12849734601395566367"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "907153272-296394746-1130535057-148708954723490917-973677367-681327331-606215906"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Ultimate-Crack-Pack.exe
tmpE418.tmp
tmpE43F.tmp
tmpE517.tmp
tmpF1AF.tmp
tmpF1B0.tmp
tmpF1B1.tmp
HU4F6S2PAVTP08IC0214.temp
memory/432-567-0x0000000000640000-0x0000000000662000-memory.dmp
memory/572-616-0x00000000005F0000-0x0000000000612000-memory.dmp
memory/704-950-0x0000000000630000-0x0000000000652000-memory.dmp
memory/848-909-0x0000000000270000-0x0000000000292000-memory.dmp
memory/936-579-0x0000000000450000-0x0000000000472000-memory.dmp
memory/1152-494-0x00000000004A0000-0x00000000004C2000-memory.dmp
memory/1268-346-0x00000000002A0000-0x00000000002C2000-memory.dmp
memory/1328-115-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1328-117-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1328-122-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1328-121-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1328-119-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1328-113-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1328-134-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1328-133-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1712-672-0x00000000003B0000-0x00000000003D2000-memory.dmp
memory/1804-234-0x0000000000420000-0x0000000000442000-memory.dmp
memory/1848-759-0x00000000005C0000-0x00000000005E2000-memory.dmp
memory/2168-839-0x0000000000450000-0x0000000000472000-memory.dmp
memory/2444-8-0x0000000000EE0000-0x0000000000F04000-memory.dmp
memory/2480-1-0x0000000000E10000-0x0000000000F52000-memory.dmp
memory/2480-0-0x000007FEF4D53000-0x000007FEF4D54000-memory.dmp
memory/2496-292-0x00000000008C0000-0x00000000008E2000-memory.dmp
memory/2528-724-0x0000000000450000-0x0000000000472000-memory.dmp
memory/2532-67-0x0000000000590000-0x00000000005B2000-memory.dmp
memory/2584-1074-0x0000000000430000-0x0000000000452000-memory.dmp
memory/2624-131-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2664-1092-0x00000000004A0000-0x00000000004C2000-memory.dmp
memory/2756-441-0x0000000000740000-0x0000000000762000-memory.dmp
memory/2796-470-0x0000000000590000-0x00000000005B2000-memory.dmp
memory/2964-157-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2988-77-0x0000000000410000-0x0000000000432000-memory.dmp
memory/3172-1126-0x0000000000760000-0x0000000000782000-memory.dmp
memory/3636-1167-0x0000000000490000-0x00000000004B2000-memory.dmp
memory/3764-1220-0x0000000000680000-0x00000000006A2000-memory.dmp
memory/4944-1499-0x00000000004E0000-0x0000000000502000-memory.dmp
memory/5460-1638-0x00000000004A0000-0x00000000004C2000-memory.dmp
memory/5660-1576-0x0000000000400000-0x0000000000422000-memory.dmp
memory/5860-1582-0x0000000000500000-0x0000000000522000-memory.dmp