Analysis
- user interaction
yes - max time kernel
167s - max time network
167s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/06/2026, 01:00
General
- Target x29s_core.exe
- Size 1.0MB
- Sample260620-bc2b8acw8k
- SHA256 d0fb41eca75d8db888aaddc5d9d5b1717a9604e76abb53308a6f816685c0e293
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 64 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Drops file in Program Files directory 3 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exe"C:\Users\Admin\AppData\Local\Temp\x29s_core.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\StartInvoke.mhtml1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\StartInvoke.mhtml2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffcb9b9c188,0x7ffcb9b9c194,0x7ffcb9b9c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,10925840496933099454,13194486692291549330,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,10231799680652800743,1883549479435290095,262144 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,17049581103560980349,2935887561951174271,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,1411801079122959503,14639819114341386976,2097152 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,15183484022788258354,2024654075412527592,2097152 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,6236370905400220703,9665448826156567192,2097152 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,8262859493636067742,6815212596220681817,2097152 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3640,i,16636971710893146557,5452604830439217293,2097152 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,6475252306480629433,11571023087339136623,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,13204886880836471118,11660066512385011951,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,1588303251454933232,3740604846407137512,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,17642755550516322811,10071096866413637887,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,17241883453502340295,3132931379223337963,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,17241883453502340295,3132931379223337963,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6072,i,3587826219999493469,6491288436940185226,2097152 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,10206612169622101968,9308043392253042549,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,5952842561670797086,542069324974925364,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,13466186179984481897,9617956501689476249,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,7639504440262036644,14934249470019668588,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,10928805285212589254,12387558398946647097,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,2331841327494998647,1001418723298736017,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,13117133371910462069,17967912875678003808,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,360726686798610146,4328356617647143917,524288 --field-trial-handle=2344,i,2061243585092295986,788356892005909376,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:83⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
- Adds Run key to start application
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x29s_core.exeC:\Users\Admin\AppData\Local\Temp\x29s_core.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript C:\Windows\Temp\x29s.vbs2⤵
-
C:\Windows\system32\cscript.execscript C:\Windows\Temp\x29s.vbs3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
manifest.json
manifest.json
blocklist
protocols.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe595b65.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe594760.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58b541.TMP
index.txt
index.txt
the-real-index
the-real-index~RFe590ecb.TMP
sync_diagnostic.log
22eff005-fbf4-471e-aec0-9ba0ba1339a7.tmp
Local State
Local State
Local State
Local State
Local State
metadata.json
270caff0-f44a-44e4-a521-0ec2201b6c0c.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
3217415c-4147-4349-9346-85d83aa2eac6.tmp
f90f3b39-d1b4-44ce-a500-a4e45c4b906d.tmp
2370b445-c929-4433-a440-b557e446901a.tmp
content_new.js
desktop.ini
x29s.vbs
memory/216-104-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/592-62-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/704-179-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/736-176-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/752-23-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/780-44-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/976-47-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1000-83-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1036-119-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1068-17-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1072-188-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1084-41-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1184-113-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1240-167-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1324-116-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1340-185-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1436-8-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1476-158-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1480-80-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1568-32-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1652-86-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1724-140-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1732-164-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1828-122-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1848-110-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1924-149-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/1960-128-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/2000-26-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/2356-38-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/2472-95-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/2504-182-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/2636-134-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/2668-35-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/2728-125-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/2972-170-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/3200-74-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/3348-161-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/3364-89-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/3384-77-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/3388-11-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/3420-155-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/3440-131-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/3472-92-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/3532-98-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/3656-29-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/3668-146-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/3796-65-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/3964-107-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/3968-59-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/4012-2-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/4248-68-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/4328-50-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/4352-56-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/4476-53-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/4584-143-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/4596-101-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/4644-191-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/4724-71-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/4748-5-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/4760-20-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/4900-137-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/4940-152-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/5036-14-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp
memory/5108-173-0x00007FF6BD5D0000-0x00007FF6BD6D9000-memory.dmp