Analysis
-
max time kernel
1800s -
max time network
1802s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10-08-2024 16:52
General
-
Target
CryptoFactory.exe
-
Size
6.0MB
-
MD5
606d9403c952670ed0566c1d1bce5dc8
-
SHA1
179b8c773a470d6e273808e8b25482810e90efcd
-
SHA256
dffa9b80560b0d59cfce787ef033857edc141646a1496b0cf50a00b1a5b03078
-
SHA512
ecbe8bf0eda38d1cb1cdecf03be58edb1f34b7cb3a17d60d98cabbc7b55429a1b3a69fbca380388f8e8f9de82620047c423464df8190dcc2211f795170c36299
-
SSDEEP
98304:H1GZtGOYln80EisK9yJND14r0Uhmkl1qa1Egu2Wh/X9Tm0OXcPwQESF/IKc6:+FqnPEZZzeJmkl1qHd2i/9TjElH8QKc
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.5.8
Botnet
Default
C2
176.111.174.140:6606
176.111.174.140:7707
176.111.174.140:8808
Mutex
QaF6X2cpj8fc
Attributes
-
delay
3
-
install
true
-
install_file
svchost.exe
-
install_folder
%AppData%
aes.plain
Extracted
Family
redline
Botnet
diamotrix
C2
176.111.174.140:1912
Extracted
Path
C:\HdbtqCuyh.README.txt
Ransom Note
[Your Files Have Been Encrypted]
Hello,
Your files have been encrypted with strong encryption algorithms. To regain access to your data, you need to follow the instructions below:
Do Not Attempt to Recover Your Files: Any attempt to recover your files using third-party tools will result in permanent data loss.
Pay the Ransom: You must pay a ransom of 1 Bitcoin to receive the decryption key. Payment must be made within 72 hours to avoid data loss.
Contact Us on Telegram: To get the payment details and further instructions, contact us via Telegram at @BIBIL_0DAY.
Decryption Key: After payment is confirmed, we will send you the decryption key and instructions on how to unlock your files.
Warning: If you do not contact us or pay within the given timeframe, your data will be permanently lost.
Do not attempt to contact us via any other means. We will not respond.
Your encrypted files are your responsibility.
Telegram Username: @BIBIL_0DAY
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Async RAT payload 1 IoCs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 64 IoCs
-
Adds Run key to start application 2 TTPs 64 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 64 IoCs
-
Detects Pyinstaller 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Delays execution with timeout.exe 2 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f4⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f5⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe5⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f6⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f7⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f8⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f9⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f10⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe10⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f11⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe11⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f12⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe12⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f13⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f14⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"13⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f15⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f16⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"15⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f17⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe17⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"16⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f18⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe18⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"17⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f19⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe19⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f20⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe20⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"19⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"20⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f21⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe21⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"20⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f22⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe22⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"21⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"22⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f23⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe23⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"22⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f24⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe24⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"23⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"24⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f25⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe25⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"24⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f26⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe26⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"25⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"26⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f27⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe27⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"26⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f28⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe28⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"27⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"28⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f29⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe29⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"28⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f30⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe30⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"29⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"30⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f31⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe31⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"30⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f32⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe32⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"31⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"32⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f33⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe33⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"32⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"33⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f34⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe34⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"33⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"34⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f35⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe35⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"34⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"35⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f36⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe36⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"35⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"36⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f37⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe37⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"36⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"37⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f38⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe38⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"37⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"38⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f39⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe39⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"38⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"39⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "" /sc onstart /f40⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe40⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"39⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"40⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f41⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe41⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"40⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"41⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f42⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe42⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"41⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"42⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f43⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe43⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"42⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"43⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f44⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe44⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"43⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"44⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f45⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe45⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"44⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"45⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f46⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe46⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"45⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"46⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f47⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe47⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"46⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"47⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f48⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe48⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"47⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"48⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f49⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe49⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"48⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"49⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f50⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe50⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"49⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"50⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f51⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe51⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"50⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"51⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f52⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe52⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"51⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"52⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f53⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe53⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"52⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"53⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f54⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe54⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"53⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"54⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f55⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe55⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"54⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"55⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f56⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe56⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"55⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"56⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f57⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe57⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"56⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"57⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f58⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe58⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"57⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"58⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f59⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe59⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"58⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"59⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f60⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe60⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"59⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"60⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f61⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe61⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"60⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"61⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f62⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe62⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"61⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"62⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f63⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe63⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"62⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"63⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f64⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe64⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"63⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"64⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f65⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe65⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"64⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"65⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f66⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe66⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"65⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"66⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f67⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe67⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"66⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"67⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f68⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe68⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"67⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"68⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f69⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe69⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"68⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"69⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f70⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe70⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"69⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"70⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f71⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe71⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"70⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"71⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f72⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe72⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"71⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"72⤵
- Adds Run key to start application
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f73⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe73⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"72⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"73⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f74⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe74⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"73⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"74⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f75⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe75⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"74⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"75⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f76⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe76⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"75⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"76⤵
- Adds Run key to start application
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f77⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe77⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"76⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"77⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f78⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe78⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"77⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"78⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f79⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe79⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"78⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"79⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f80⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe80⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"79⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"80⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f81⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe81⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"80⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"81⤵
- Adds Run key to start application
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f82⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe82⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"81⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"82⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f83⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV184⤵
-
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe83⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"82⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"83⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f84⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe84⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"83⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"84⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f85⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe85⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"84⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"85⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f86⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe86⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"85⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"86⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f87⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe87⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"86⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"87⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f88⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe88⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"87⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"88⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f89⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe89⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"88⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"89⤵
- Adds Run key to start application
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f90⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe90⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"89⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"90⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f91⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe91⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"90⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"91⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f92⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe92⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"91⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"92⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f93⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe93⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"92⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"93⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f94⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe94⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"93⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"94⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f95⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe95⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"94⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"95⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f96⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe96⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"95⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"96⤵
- Adds Run key to start application
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f97⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe97⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"96⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"97⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f98⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe98⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"97⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"98⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f99⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe99⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"98⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"99⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f100⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe100⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"99⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"100⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f101⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe101⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"100⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"101⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f102⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe102⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"101⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"102⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f103⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe103⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"102⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"103⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f104⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe104⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"103⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"104⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f105⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe105⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"104⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"105⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f106⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe106⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"105⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"106⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f107⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe107⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"106⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"107⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f108⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe108⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"107⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"108⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f109⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe109⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"108⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"109⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f110⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe110⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"109⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"110⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f111⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe111⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"110⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"111⤵
- Adds Run key to start application
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f112⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe112⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"111⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"112⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f113⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe113⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"112⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"113⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f114⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe114⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"113⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"114⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f115⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe115⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"114⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"115⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f116⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe116⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"115⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"116⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f117⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe117⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"116⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"117⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f118⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe118⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"117⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"118⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f119⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe119⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"118⤵
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"119⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f120⤵
-
-
C:\Windows\system32\relog.exeC:\Windows\system32\relog.exe120⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoFactory.exe"CryptoFactory.exe"119⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\svchostwit.exe"C:\Users\Admin\AppData\Roaming\svchostwit.exe"120⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "SystemServicesTools" /tr "C:\Users\Admin\AppData\Roaming\{0BE445E7C5632545466276}\{0BE445E7C5632545466276}.exe" /sc onstart /f121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-