Analysis
-
max time kernel
28s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05/08/2024, 19:21
General
-
Target
TextUtils.exe
-
Size
398KB
-
MD5
1c09825dd1fa0637c1d5089a65702ede
-
SHA1
a1da9a5c8d8b79689c9153adf459960fbccde80b
-
SHA256
3eadfa021e89e69ffe4dbf5c3d3eec4843ceb7ad5033498477b914ba6316657b
-
SHA512
948252d25c6a481432c52c762637c66d764f7fd90b0fa65d7c44b21af048b87950f918831b7d716fe65f6d10da42c337cb8b5860f2a223d7dc4c8f9d38d9fc00
-
SSDEEP
12288:kdJoSpPkFtttttttCttttttttttttttpst8ZcxruaZ4A3G31111111111111111/:kdlPgrua13Q11111111111111111D11x
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
UltimateCrackPack
C2
51.83.170.23:16128
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 1 IoCs
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Using powershell.exe command.
-
Suspicious use of SetThreadContext 8 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 37 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies data under HKEY_USERS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 45 IoCs
-
Suspicious use of FindShellTrayWindow 26 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "8408" "1916" "1864" "1920" "0" "0" "1924" "0" "0" "0" "0" "0"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "8968" "1928" "1880" "1932" "0" "0" "1936" "0" "0" "0" "0" "0"8⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'8⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'10⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'11⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"10⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'12⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"11⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"12⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"12⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"13⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"13⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"14⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'15⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"14⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'16⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"15⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"16⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'17⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"16⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"17⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'18⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"18⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"18⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"19⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"19⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"20⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"22⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"23⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"24⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"25⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'28⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'29⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"29⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"31⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"32⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'33⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "10304" "1916" "1840" "1920" "0" "0" "1924" "0" "0" "0" "0" "0"34⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"33⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'37⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'38⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'40⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'41⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"41⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'42⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"42⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 91645⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'45⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"45⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'46⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"45⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV148⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"46⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'48⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"48⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'49⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"48⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"49⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10960 -s 76851⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10960 -s 76851⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10960 -s 79251⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"50⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'51⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"50⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'52⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'53⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"52⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'54⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"53⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"54⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'55⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"55⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'56⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"55⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'57⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV158⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"56⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"57⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'58⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"58⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"58⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"59⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"59⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"60⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'61⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV162⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"61⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'62⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"61⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'63⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"62⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"63⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'64⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"64⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'66⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"66⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'67⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"67⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'68⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"68⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'69⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"69⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"70⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"71⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"72⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"73⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'74⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"73⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"74⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"75⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'76⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"76⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"76⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"78⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"79⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'80⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"79⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"80⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'81⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"81⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'82⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"82⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'83⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV184⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"83⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'84⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"84⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'85⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"85⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"86⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'87⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"87⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"88⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"88⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"89⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"90⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"90⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"91⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"91⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"92⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"93⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"93⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"94⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"94⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"96⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"97⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'98⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"98⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"98⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"98⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"99⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"100⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'101⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12508 -s 72102⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"101⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"101⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"102⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"103⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'104⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"104⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'105⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"104⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"105⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"106⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"107⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"108⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'109⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"109⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"110⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 1008111⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"111⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"112⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7380 -s 1008113⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"113⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7456 -s 1016114⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7456 -s 1016114⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"114⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"115⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'116⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"116⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"117⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'118⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"118⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"119⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"120⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'121⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-