5b3ec25c7a448085a32a8e2cf57f557e85ebaad44543a414c3eef885f3a80472

Analysis

max time kernel
79s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe
Size

1004KB
MD5

0cb03ce965acfbfbc556646039546e90
SHA1

aa78e3854e1cab17ca5a81752ec57c786ede2774
SHA256

5b3ec25c7a448085a32a8e2cf57f557e85ebaad44543a414c3eef885f3a80472
SHA512

3255eb93bc670d8c1c5746d351caa945d6970376119af962e727d0dd062805116b5fee8bd2781951ce4090ed2b2d48663b3712483d7bf752ac5256d3a7fb13c3
SSDEEP

24576:eIWjf3z96HyzbJ+AUTpldXPEKKYJkwrsrIZmDliBlzHbpab/uWI/:eIsEHRYcMilT

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 25 IoCs

pid	Process
1424	482.#.exe
2468	280.#.exe
3056	253.#.exe
1604	990.#.exe
2104	254.#.exe
2612	70.#.exe
2008	147.#.exe
3012	822.#.exe
600	525.#.exe
2308	962.#.exe
1180	271.#.exe
2024	498.#.exe
2244	262.#.exe
2332	834.#.exe
2228	812.#.exe
996	748.#.exe
2916	306.#.exe
1820	356.#.exe
992	270.#.exe
2480	295.#.exe
2796	390.#.exe
2944	863.#.exe
2584	623.#.exe
2336	752.#.exe
1996	429.#.exe

Loads dropped DLL 64 IoCs

pid	Process
2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe
1424	482.#.exe
1424	482.#.exe
1424	482.#.exe
1424	482.#.exe
2468	280.#.exe
2468	280.#.exe
2468	280.#.exe
2468	280.#.exe
3056	253.#.exe
3056	253.#.exe
3056	253.#.exe
3056	253.#.exe
1604	990.#.exe
1604	990.#.exe
1604	990.#.exe
1604	990.#.exe
2104	254.#.exe
2104	254.#.exe
2104	254.#.exe
2104	254.#.exe
2612	70.#.exe
2612	70.#.exe
2612	70.#.exe
2612	70.#.exe
2008	147.#.exe
2008	147.#.exe
2008	147.#.exe
2008	147.#.exe
3012	822.#.exe
3012	822.#.exe
3012	822.#.exe
3012	822.#.exe
600	525.#.exe
600	525.#.exe
600	525.#.exe
600	525.#.exe
2308	962.#.exe
2308	962.#.exe
2308	962.#.exe
2308	962.#.exe
1180	271.#.exe
1180	271.#.exe
1180	271.#.exe
1180	271.#.exe
2024	498.#.exe
2024	498.#.exe
2024	498.#.exe
2024	498.#.exe
2244	262.#.exe
2244	262.#.exe
2244	262.#.exe
2244	262.#.exe
2332	834.#.exe
2332	834.#.exe
2332	834.#.exe
2332	834.#.exe
2228	812.#.exe
2228	812.#.exe
2228	812.#.exe
2228	812.#.exe
996	748.#.exe
996	748.#.exe
996	748.#.exe

Adds Run key to start application 2 TTPs 50 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	70.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	498.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	280.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	748.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	70.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	306.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	525.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	822.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	525.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	962.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	498.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	812.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	270.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	270.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	254.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	390.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	262.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	147.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	863.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	990.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	990.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	262.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	812.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	623.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	752.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	752.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	482.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	306.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	863.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	748.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	834.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	295.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	295.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	253.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	280.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	271.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	834.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	482.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	254.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	147.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	356.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	356.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	822.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	962.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	271.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	623.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	390.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	253.#.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\	748.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\	834.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\	812.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\	147.#.exe
File created	C:\Program Files\Windows Journal\Journal.exe	525.#.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\	525.#.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\	482.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\	498.#.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\de-DE\	812.#.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\	525.#.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\	834.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\	280.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\	498.#.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\	990.#.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\	748.#.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\	262.#.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\	812.#.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\	812.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\	498.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\	254.#.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\	254.#.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	147.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\	147.#.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\	271.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\	962.#.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\	525.#.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\	525.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\	990.#.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\	822.#.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\	482.#.exe
File opened for modification	C:\Program Files\Java\jre7\lib\fonts\	525.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\	525.#.exe
File opened for modification	C:\Program Files\Internet Explorer\it-IT\	812.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\	498.#.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	525.#.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\	253.#.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\	482.#.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\	253.#.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\es-ES\	482.#.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\	271.#.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VGX\	822.#.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\	822.#.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\	253.#.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.exe$$$$	280.#.exe
File opened for modification	C:\Program Files\Windows Media Player\setup_wm.exe	262.#.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\	482.#.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\	147.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe$	748.#.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	253.#.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\	962.#.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\	254.#.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\de-DE\	834.#.exe
File opened for modification	C:\Program Files\Windows Sidebar\fr-FR\	962.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ml\	147.#.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	280.#.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	254.#.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\ja-JP\	280.#.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\	306.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\	482.#.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\	253.#.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\	280.#.exe

NTFS ADS 25 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	482.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	147.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	822.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	295.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	748.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	623.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	253.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	356.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	306.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	390.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	863.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	990.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	254.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	525.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	962.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	262.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	752.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	280.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	812.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	270.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	70.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	834.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	271.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	498.#.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe
1424	482.#.exe
2468	280.#.exe
3056	253.#.exe
1604	990.#.exe
2104	254.#.exe
2612	70.#.exe
2008	147.#.exe
3012	822.#.exe
600	525.#.exe
2308	962.#.exe
1180	271.#.exe
2024	498.#.exe
2244	262.#.exe
2332	834.#.exe
2228	812.#.exe
996	748.#.exe
2916	306.#.exe
1820	356.#.exe
992	270.#.exe
2480	295.#.exe
2796	390.#.exe
2944	863.#.exe
2584	623.#.exe
2336	752.#.exe
1996	429.#.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1768	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	28
PID 2276 wrote to memory of 1768	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	28
PID 2276 wrote to memory of 1768	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	28
PID 2276 wrote to memory of 1768	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	28
PID 2276 wrote to memory of 1768	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	28
PID 2276 wrote to memory of 1768	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	28
PID 2276 wrote to memory of 1768	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	28
PID 2276 wrote to memory of 2292	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	29
PID 2276 wrote to memory of 2292	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	29
PID 2276 wrote to memory of 2292	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	29
PID 2276 wrote to memory of 2292	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	29
PID 2276 wrote to memory of 2292	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	29
PID 2276 wrote to memory of 2292	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	29
PID 2276 wrote to memory of 2292	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	29
PID 2276 wrote to memory of 1424	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	30
PID 2276 wrote to memory of 1424	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	30
PID 2276 wrote to memory of 1424	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	30
PID 2276 wrote to memory of 1424	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	30
PID 2276 wrote to memory of 1424	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	30
PID 2276 wrote to memory of 1424	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	30
PID 2276 wrote to memory of 1424	2276	0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe	30
PID 1424 wrote to memory of 2132	1424	482.#.exe	31
PID 1424 wrote to memory of 2132	1424	482.#.exe	31
PID 1424 wrote to memory of 2132	1424	482.#.exe	31
PID 1424 wrote to memory of 2132	1424	482.#.exe	31
PID 1424 wrote to memory of 2132	1424	482.#.exe	31
PID 1424 wrote to memory of 2132	1424	482.#.exe	31
PID 1424 wrote to memory of 2132	1424	482.#.exe	31
PID 1424 wrote to memory of 2724	1424	482.#.exe	32
PID 1424 wrote to memory of 2724	1424	482.#.exe	32
PID 1424 wrote to memory of 2724	1424	482.#.exe	32
PID 1424 wrote to memory of 2724	1424	482.#.exe	32
PID 1424 wrote to memory of 2724	1424	482.#.exe	32
PID 1424 wrote to memory of 2724	1424	482.#.exe	32
PID 1424 wrote to memory of 2724	1424	482.#.exe	32
PID 1424 wrote to memory of 2468	1424	482.#.exe	33
PID 1424 wrote to memory of 2468	1424	482.#.exe	33
PID 1424 wrote to memory of 2468	1424	482.#.exe	33
PID 1424 wrote to memory of 2468	1424	482.#.exe	33
PID 1424 wrote to memory of 2468	1424	482.#.exe	33
PID 1424 wrote to memory of 2468	1424	482.#.exe	33
PID 1424 wrote to memory of 2468	1424	482.#.exe	33
PID 2468 wrote to memory of 2488	2468	280.#.exe	34
PID 2468 wrote to memory of 2488	2468	280.#.exe	34
PID 2468 wrote to memory of 2488	2468	280.#.exe	34
PID 2468 wrote to memory of 2488	2468	280.#.exe	34
PID 2468 wrote to memory of 2488	2468	280.#.exe	34
PID 2468 wrote to memory of 2488	2468	280.#.exe	34
PID 2468 wrote to memory of 2488	2468	280.#.exe	34
PID 2468 wrote to memory of 1796	2468	280.#.exe	35
PID 2468 wrote to memory of 1796	2468	280.#.exe	35
PID 2468 wrote to memory of 1796	2468	280.#.exe	35
PID 2468 wrote to memory of 1796	2468	280.#.exe	35
PID 2468 wrote to memory of 1796	2468	280.#.exe	35
PID 2468 wrote to memory of 1796	2468	280.#.exe	35
PID 2468 wrote to memory of 1796	2468	280.#.exe	35
PID 2468 wrote to memory of 3056	2468	280.#.exe	36
PID 2468 wrote to memory of 3056	2468	280.#.exe	36
PID 2468 wrote to memory of 3056	2468	280.#.exe	36
PID 2468 wrote to memory of 3056	2468	280.#.exe	36
PID 2468 wrote to memory of 3056	2468	280.#.exe	36
PID 2468 wrote to memory of 3056	2468	280.#.exe	36
PID 2468 wrote to memory of 3056	2468	280.#.exe	36
PID 3056 wrote to memory of 1372	3056	253.#.exe	37

C:\Users\Admin\AppData\Local\Temp\0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0cb03ce965acfbfbc556646039546e90_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s scrrun.dll
  2⤵
  PID:1768
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\77160.vbs"
  2⤵
  PID:2292
- C:\Users\Admin\AppData\Local\Temp\482.#.exe
  C:\Users\Admin\AppData\Local\Temp\482.#.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s scrrun.dll
    3⤵
    PID:2132
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\668972.vbs"
    3⤵
    PID:2724
- - C:\Users\Admin\AppData\Local\Temp\280.#.exe
    C:\Users\Admin\AppData\Local\Temp\280.#.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Program Files directory
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s scrrun.dll
      4⤵
      PID:2488
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\455257.vbs"
      4⤵
      PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\253.#.exe
      C:\Users\Admin\AppData\Local\Temp\253.#.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Program Files directory
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        5⤵
        
        PID:1372
    - - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\897335.vbs"
        5⤵
        
        PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\990.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\990.#.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:1604
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        6⤵
        
        PID:1828
      - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\239879.vbs"
        6⤵
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\254.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\254.#.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2104
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        7⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\836284.vbs"
        7⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\70.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\70.#.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2612
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        8⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\132824.vbs"
        8⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\147.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\147.#.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        9⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\73436.vbs"
        9⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\822.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\822.#.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:3012
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        10⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\166164.vbs"
        10⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\525.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\525.#.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:600
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        11⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\551784.vbs"
        11⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\962.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\962.#.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        12⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\707378.vbs"
        12⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\271.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\271.#.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:1180
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        13⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\383678.vbs"
        13⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\498.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\498.#.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2024
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        14⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\898845.vbs"
        14⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\262.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\262.#.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2244
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        15⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\158168.vbs"
        15⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\834.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\834.#.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2332
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        16⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\321285.vbs"
        16⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\812.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\812.#.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2228
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        17⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\642925.vbs"
        17⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\748.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\748.#.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:996
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        18⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\165615.vbs"
        18⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\306.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\306.#.exe
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        19⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\212490.vbs"
        19⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\356.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\356.#.exe
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:1820
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        20⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\905101.vbs"
        20⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\270.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\270.#.exe
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:992
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        21⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\276394.vbs"
        21⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\295.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\295.#.exe
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2480
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        22⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\500164.vbs"
        22⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\390.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\390.#.exe
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2796
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        23⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\370937.vbs"
        23⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\863.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\863.#.exe
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2944
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        24⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\976131.vbs"
        24⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\623.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\623.#.exe
        24⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2584
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        25⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\915081.vbs"
        25⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\752.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\752.#.exe
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2336
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        26⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\529979.vbs"
        26⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\429.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\429.#.exe
        26⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1996
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        27⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\197490.vbs"
        27⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\353.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\353.#.exe
        27⤵
        
        PID:384
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        28⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\700222.vbs"
        28⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\532.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\532.#.exe
        28⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        29⤵
        
        PID:776
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\992168.vbs"
        29⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\94.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\94.#.exe
        29⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        30⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\925258.vbs"
        30⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\43.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\43.#.exe
        30⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        31⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\280636.vbs"
        31⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\556.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\556.#.exe
        31⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        32⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\324978.vbs"
        32⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\804.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\804.#.exe
        32⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        33⤵
        
        PID:336
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\447948.vbs"
        33⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\368.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\368.#.exe
        33⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        34⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\210399.vbs"
        34⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\255.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\255.#.exe
        34⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        35⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\354274.vbs"
        35⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\57.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\57.#.exe
        35⤵
        
        PID:336
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        36⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\837764.vbs"
        36⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\633.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\633.#.exe
        36⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        37⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\505275.vbs"
        37⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\293.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\293.#.exe
        37⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        38⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\126781.vbs"
        38⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\453.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\453.#.exe
        38⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        39⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\346355.vbs"
        39⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\811.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\811.#.exe
        39⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        40⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\986553.vbs"
        40⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\234.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\234.#.exe
        40⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        41⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\661586.vbs"
        41⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\999.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\999.#.exe
        41⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        42⤵
        
        PID:792
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\830562.vbs"
        42⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\981.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\981.#.exe
        42⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        43⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\717647.vbs"
        43⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\935.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\935.#.exe
        43⤵
        
        PID:240
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        44⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\769512.vbs"
        44⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\888.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\888.#.exe
        44⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        45⤵
        
        PID:772
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\784160.vbs"
        45⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\140.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\140.#.exe
        45⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        46⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\505199.vbs"
        46⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\220.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\220.#.exe
        46⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        47⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\457531.vbs"
        47⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\393.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\393.#.exe
        47⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        48⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\289821.vbs"
        48⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\25.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\25.#.exe
        48⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        49⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\794216.vbs"
        49⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\381.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\381.#.exe
        49⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        50⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\215389.vbs"
        50⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\462.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\462.#.exe
        50⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        51⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\702922.vbs"
        51⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\415.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\415.#.exe
        51⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        52⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\58849.vbs"
        52⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\11.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\11.#.exe
        52⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        53⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\782818.vbs"
        53⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\324.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\324.#.exe
        53⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        54⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\830089.vbs"
        54⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\392.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\392.#.exe
        54⤵
        
        PID:936
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        55⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\629757.vbs"
        55⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\51.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\51.#.exe
        55⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        56⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\362514.vbs"
        56⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\344.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\344.#.exe
        56⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        57⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\116176.vbs"
        57⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\438.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\438.#.exe
        57⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        58⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\675365.vbs"
        58⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\129.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\129.#.exe
        58⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        59⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\429027.vbs"
        59⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\737.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\737.#.exe
        59⤵
        
        PID:676
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        60⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\598003.vbs"
        60⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\139.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\139.#.exe
        60⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        61⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\379146.vbs"
        61⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\800.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\800.#.exe
        61⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        62⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\100185.vbs"
        62⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\438.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\438.#.exe
        62⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        63⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\800319.vbs"
        63⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\736.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\736.#.exe
        63⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        64⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\516765.vbs"
        64⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\436.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\436.#.exe
        64⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        65⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\863903.vbs"
        65⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\77.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\77.#.exe
        65⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        66⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\314769.vbs"
        66⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\354.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\354.#.exe
        66⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s scrrun.dll
        67⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\185543.vbs"
        67⤵
        
        PID:2508

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\126781.vbs

Filesize
374B

MD5
1fce4fd3bfef795e105a96e277ce8459

SHA1
e1c75a03d3f9851c9ff8777ad17db56529d3bcc8

SHA256
66f423acc633a9a1eb35820060032c060b0c290d4fc7cfc822da02cba4346327

SHA512
49241de0caa1060a8a24de87326c9844b0fc36ad4ebb0d698103e17a55ed5e3826cbcc8f3bceb82b82cebced7aff1b4ef9ab128273f4624311b0abf038af541d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\126781.vbs

Filesize
1KB

MD5
b9502561927f4f51a8766d47009f0f01

SHA1
1e29913942240f86d804e09fbb9e52b324e704dd

SHA256
55dec1a397db720ee4f1b4660e19534cbf15ac94e99aab14c52084cec4727476

SHA512
42c4b4a8e8af7bc7bb2c0dbff09e720a95042044d65f22e87d0e11ba87e168e751b480df13a35b9c66192ef0926117e0eef1343c600c0035e7d3bc4327f80f8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\126781.vbs

Filesize
1KB

MD5
e60707fb21fe15afc35b946f69fd166f

SHA1
827ea42f05f270d576be0ba0602845a8c2ab5d38

SHA256
40b0abb54f240baf8c28ecc8e7da84478c1f7bbff8c408eec62a1aaff5988048

SHA512
baadbd488f5a6377c5811ab242fb43af31ce2a06cb15c63ccf3dd553d4d4657c520aa93a2b315ae7a9613e94e3843199a4ea29e39e5ab5a0d6315f8e60dc4dad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\132824.vbs

Filesize
2KB

MD5
0552f7eded227ae9d602b1ba1392b237

SHA1
0da8f73b673c096436b829b3abaec3686c267b20

SHA256
06131236690eedec88ff3908dca1ef24bdb2d6419f0250d1fa18cf761f3e2970

SHA512
cb10a7ebe67c8a45335d97d0da1772ec9c25a99a191ede88aa1b81f579bf20042f76f406a043108b21e5b7a13610d117b157b276053f1f88e1db948127bb4f2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\158168.vbs

Filesize
6KB

MD5
64097bbf7cea7082e4f079cff0f8278f

SHA1
7afd2f23e638cb52bce7b80dbb1f90d51124741b

SHA256
bde85b01aeb524c661535982fa0a0502aa1986e9e23306328fc33b2beee19495

SHA512
2ef21ded353a31a3d2bcaa6e89e135774697977e4c247e74a09e4c97228f5feea29bab9c70e4f07432c812bc66988a62387c1293ce7acb9d3ffa0929bd9f893f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\197490.vbs

Filesize
656B

MD5
453dcc12f09292be0c018964b5d5e1a3

SHA1
7a75918bf58423277a03610b403fbc989f6cd1f5

SHA256
b156469be3ba2a829372d720074b58acc40a9742bc7195c4a46ecfa3cee46696

SHA512
85a771d9a75c1fb8daad7df995b344052d4ec1e1c2e61e7d36d965da9922392abd8c843016f9347b40d94486795990e3a2ca7787e71ac82b3ccb014d73c592b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\324978.vbs

Filesize
753B

MD5
e42cb93276aa399ead89c12fe4101285

SHA1
8c7d159591af95e06101ac0405a0f70321f48bd5

SHA256
5207c55e16e442c4d0b32e88ad5632bc9f6ac3fc4966927dedb8a3ba9a60f8f1

SHA512
45a3ac0ae83449a2f53d19fe5cad592e757a043757c789f2832a54078b0663811001e00c0c08450f85b312e4c93ee768ea800e54bd7960e5940449ac4b3d8c9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\362514.vbs

Filesize
2KB

MD5
e296857828473043570dccd798a2df11

SHA1
e5ab1378a3033a3d2d2946241a69fc2bb0e819dc

SHA256
d78929baef21ad3a9a17d603b05c7f342f233370fd7baca594b42471b22addaf

SHA512
cd380479e18f38268de91496269c7622524cda83384b989a7f213086ea2f45c0f53439b3b3850bef69599a843fcef39fe5cc88477627d38e65045abf3bcddee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\370937.vbs

Filesize
1KB

MD5
4c0328917a4d6aa4c8e58ee60773cb6f

SHA1
5bd7de9d039dcc2fb6ef7335f7f188f22f0d8365

SHA256
51cdf0fa0ab0766ce9ac2d8390b86860625266d651eafd71772063f349724f32

SHA512
6e8d32690e3a1a3bc381f86b91143567bf6bfae8864f01a21488b5c64775063af8953d5a91d089f99f9f51dc190dde4da81ecd84b114c77e3a85706b4af106df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\370937.vbs

Filesize
3KB

MD5
7c43fab32ba971d810908a8c0bc99746

SHA1
437e595e59443146406c37be9d08fe861bde512e

SHA256
c563ea209147b74a6d8a436dfa34ff1757a5b815d6a059e0fa546f819c3adbdd

SHA512
2077b5899aef5cd4238cb9360834fe1ac439dabc426813197742653b074b7364e125519716c9921b8be042de7a5a9266cafd2672078a9bc4c504e50aba764195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\370937.vbs

Filesize
3KB

MD5
145caf759ba1a9dbf42338c333069b22

SHA1
8bccf70c899b361967e1fc2d06462d55bb9fc859

SHA256
bb276661c163f3fba1db181215db1c3c178a8adceb82dd20f215269ef72f65d7

SHA512
9355ed29dd6e87d1ea92f3858205d4a5e9268bf5834e979830a4c79af54e6035d2727e64e44de20fa059197fbe9a7c687ee9bce7f8f1f7c481d3eb425e38e31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\370937.vbs

Filesize
3KB

MD5
c255556442d2ca2ceae9ce56d356ece8

SHA1
1fad833f6cab40150ee2a52316dda9f7d2206f2c

SHA256
da6259dabab9a4cfda4ec3c87539d502320fc0b04b93596d4df555bc0a99deee

SHA512
addd76a1d892ef2ad960e6e095e0151e5d507a4b5199d0d8f94ff1aa7aac621cf8b97964951458ff4348443984c13dfb77c56583ba7250a372fbeb8f4ff75b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\505275.vbs

Filesize
1KB

MD5
a8c4f12ac9a7609026188563840b030d

SHA1
953f6dd70e2d21d3564b695210045cc9d984b23d

SHA256
126f28755e1613cb36dcc69c938e8ed3113795c78b5da05a1b69594510fa314b

SHA512
4c5cff57df695cfe0402e4ec18dc8cc84153705465d3b7825cb7d1645d27c016f2a61c260bbde0187c8a2ff7b7963880ec059396cfb93d3e5c75131f02ec3443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\529979.vbs

Filesize
1KB

MD5
64ff63be04046788c0b4ddabe6f43b54

SHA1
0552f0d7684e4ad69ea711e4ee92c4801fadb3cd

SHA256
7bc697955114e6b3b92f8ac4460b2cc3da4b3ced172b61f8ef25b76bb77507ac

SHA512
3496a0b01233a1df29d1738c6b0f9abda4b8f64b91d9f7b0a1cda8f53c6be8a5692b6375b8dbc8e865c2de406a4e09cd82bf00d4cb5b44a1b77ab6cdbfb00ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\529979.vbs

Filesize
2KB

MD5
886617d78b65b1aefa02a61bb9bca482

SHA1
c18a02e083438038e6dbf30418a0749b96e013ff

SHA256
b0c62d4c02f45de11206723838e7f744efcf8436b159f00e7dae0462ba07a70a

SHA512
fe1b229c64234a684359b5b2b117ebedb27643db3a701997542ca4f95b056667e2daab4d2ec66a516380a9e3f310b8342742af9b928308b07bb576933b4171f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\529979.vbs

Filesize
2KB

MD5
a8673b32fad969742688f7c47ef5cfbf

SHA1
8c5054e984f42f3c06325d62966faaf96d750ff8

SHA256
c07d277fbf63141bacd928fb701a3973a0beab6da8bc3e10f16280e4d3b43448

SHA512
0112bc9c08852e3da8acec2dbb41164d7139b1705585330490038be7a057095608a9096bfe3d4c6caf0d49d832207230291f1533631a9c6c8d0169c2ff96d802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\529979.vbs

Filesize
3KB

MD5
4eba7b7ff663198abfa1319fa58492e8

SHA1
4458fcf08e5cc819b0df416289da438716d2c260

SHA256
e8f0b80bebb024b4158878dc9b52883ace5dabc5e091e777f24e6f423bc19309

SHA512
403bc56f255f3a6e796a875aa81c51a49ba2db21c5fc0e6c9d1b52322d164383fe93055533f2d4adf2a18531bbe2b0d076b0be867941b95b6b8c2456c04a98d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\529979.vbs

Filesize
3KB

MD5
8cfbb0476c7db1903ed67a7b0b8c15ad

SHA1
0fce8d80f96583f39f72e7025d5818ce88a30985

SHA256
2a3778aaf48a20cb25dbb3f22fee19c7b1ae104e697bc4ffbfe5e524e9b087e5

SHA512
00ddf7aaf219f5d0aabd92fd8c3a88bfdd2d931b31fa376c629bbac8da7f2efdb9136bf46448bb72a22d49b1465f92cf75a916335b2c01ba9d6f0567abfe7e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\529979.vbs

Filesize
3KB

MD5
3ea27a694304e5d5328f6e1993d49912

SHA1
553cbb1795f5125385b2f94ae46ed825d858f90e

SHA256
1121d9e3645b2c8c4e6b8f23227e070680c4e7a617e57a8ec37ba1bbbb051cbc

SHA512
aeabbcf99c5364b93e8d4a9ce7f58670a44ab35dcb01e8515bdf56768c8215fe81ec8e824c40db6aa30cb32299b81d7250a8c9b5a048438e259e6d460699a1e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\642925.vbs

Filesize
2KB

MD5
28ca672a38eee3c19fdab83c46ba7278

SHA1
ace77b9f3b560c0fbf3ee79be2e35c89890e6472

SHA256
b0445184d5ee36442bd6b2421b84245a6686d6708f92ac2c4ce95e6011e322b3

SHA512
a863517b2c11bfbe21a806da5f90853aae2dbac680bca5d04e982f9c41de18525b60984edfd05831d61e6d5f27e0d6db0e520aa3a87baa669983ca6639d52544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\642925.vbs

Filesize
4KB

MD5
fd2c5d45734615b6a7cb17c88daedf64

SHA1
632adf43380b2a89046531f932c15a03aa9455e0

SHA256
f125d6f23c2243b61e20029d7fe8fa900e638aeb9aaba5af44b5bb7f77a473b9

SHA512
d4e5f63455369e0c7d5c14aa8e407136b5c564f0d9bcac01c324ed4e92041c38566538504f9bd308835fdeb92d03787a319d6e44c188b6ed49814fa99279fa5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\668972.vbs

Filesize
2KB

MD5
32b0f53188f02543fa3537e0d99b7eb1

SHA1
896a17c5904dc693b5ee3b3b7af70cc133415a9d

SHA256
ef5a527f7a9218e6f900837d8b12057f4f409158421400190f780e77f62537f8

SHA512
4ae6d690a814640373ba8e393b160308db59bd777b024106586a31f056b0037dd2e6e940e6c1e5a031ff9cb8f3a846f5d2ad13aef71799b4f5f8e1b53edb3b14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\73436.vbs

Filesize
1KB

MD5
1107f9e364b9991502a28a40c79938ee

SHA1
24688f9eca144dd835f123d545979342c5e558a3

SHA256
6644660315712c83f006634be3dea46a14ceb9a466b89e2cf35e9843514b14f3

SHA512
a7ee81b0634e76c168893775bee514e0d7ebad10288f196f935bd3359050a2e584ee374d93540e9cc8a164b08f39637405e0f3ccee7cd644ee114063a1b0649e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\73436.vbs

Filesize
4KB

MD5
eab4efbc34f750c131cf844bf2a4b1f7

SHA1
3ecfacd23d25b54c421ae28e87b89508339c8604

SHA256
8870ad9c9b435e55b4bec0170e122322b541bfefdcaf1ee8ec02e221c4efdd69

SHA512
74be41f88bc040432da84ddd516c2e1ea011a868abbdc8b778f4807685a0c185e7e0171e3c566158f7f41663e4f1b07f76fa44be4c355090665c9b23323ca8c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\769512.vbs

Filesize
1KB

MD5
f21ce4df0c73d56e121025e9a452ae70

SHA1
95062f77f52e3f23689f127f4df24a8a009d699c

SHA256
d334f814191c87d40c8a2a23980a6f3c10b45f613300111f378bf90855c53e7d

SHA512
2009c0dba73543e992a9aa406f09efc030eee9d82eeec79c5f76f4385bd8db4ad77746758e901f3b2f77a76f0e97f70426a2712717f923b9bcf195e8ae4ac3ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\77160.vbs

Filesize
4KB

MD5
e6ab74731b4e73fc0e8a3aa89228256e

SHA1
c7d6ce19c3512a71ca7e9b916ecf35cd0151f468

SHA256
cd8517372cf99fd3e34ac0fdcb371bdbccf5839f8188769247bf0400d810753a

SHA512
df0ae60a5fd1a2db2c151d9c36bde4ec80e31955986049d5de104b1bf73ec15232792f449586bfca1772d1e641d7ab17037d653c30bb80f5263f10b03bdbdd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\77160.vbs

Filesize
2KB

MD5
e83ec29a1bb5b6853b0b3118f175b310

SHA1
65760a8c33e1547c431920e93ed39321b9156abb

SHA256
01c9c577bef64ade8995c89b7aafa1a991270e75a2e1d3ab117fa841f567cba9

SHA512
64af745208216a51726d63f07e567da4bdab1b98660265c264a3de713f2c1515daefa844a1aee8d747f767368b7efd5466648a57458db69722afc03f24515e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\830562.vbs

Filesize
2KB

MD5
845b895fe651d5a7f794af52c8648ea6

SHA1
f9dce282cbc4802c958139a65cbfe9cd6a48368b

SHA256
35fe56a63aea3157e7f54435cc430bf5990f749e6f909172019aafacd349314b

SHA512
b5a36da2d1a5df6a36963d69be79d9a7f04d65f640c1d5e489b3dd0a190e2536d7d7a09ca0d862345851c8a019a996e740ed1fbe64160899244c4d1336d05231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\836284.vbs

Filesize
5KB

MD5
ef2b64e4a354c35ead8aa63b2e503ced

SHA1
869c14a496324e92369ffad21333b1c5ea4c35e3

SHA256
3af780a1d36334475fcca52043d1b996304f8d0f89c671ee641ea8b95b62acb7

SHA512
f92291e6cd5c8bc9effbd2019390cc8388a3c7f18ccf26736b59660198097533e7d0ad9b5aaaed2869c73348f3ed0c303399ea98fcf989b0f90c9c6f0ac8b466

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\915081.vbs

Filesize
1KB

MD5
ad2a2954c222325d845c76ad814c993f

SHA1
872049b377784e5fbdcc8c56c8b3d0c25c81a7dd

SHA256
103b8c2aede6fb25b4d8897d3af48c80811c4f26727dbcf1a860f1cf803ca836

SHA512
e27fafc02d2dbd55dd3e9f48f3d780b651f83ca406d5976e5c5a2d93fda242535dbe743e2ef0e4ed2fadd04105c185d2570c03179f92d6ad839448fefa41907c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\925258.vbs

Filesize
468B

MD5
e3746c3eaca091d66f25f980d1682b72

SHA1
5f3f7acd81550ec60b0e1cca3806c5df4a4909e4

SHA256
848c798fe1662837fe00c098bd6f8ffe3afaca963adfa06aab2fb4988c01cf50

SHA512
97b9ed0b8b9f61e56c40cc314e099b1cd09288056997bb32aa79a2e3da52a2f47a30b97cc5e7f4fa82ad3d1af1706aabf53bc2e271977d5e20793ebe5a1a41be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\925258.vbs

Filesize
563B

MD5
671f480d089fd9b7d5a04d891f63b3ce

SHA1
d7baaa72ecb8f0d5a4f60346b99399d4aa9641bc

SHA256
764a87590e06e40ccceace7fc3db3dd113e34b479cab91b4baedb83d4235c44b

SHA512
1218ff7c1c27369ef7513d370af8f29b96b85ac45b281da9bc4d6161b31750e6dbcb1f595c8ff8cc08ce520a1fd7d9ea676fdee4b6da23266cdc53c870aa1581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\986553.vbs

Filesize
277B

MD5
e8dab6926dc57b787852dd3293e9be4e

SHA1
1e595444051c934b3aa075309a1e06ccaebfe05b

SHA256
49050ff12c6807875472b74e69a0bdd00c762bae0be2e69e7d617149343a3f70

SHA512
0982e04ea7f920aa3eb679be46db9a3eb597756e50b7a95858ce643c8c2f38faf6461f8e575bdc1e2c6b11cd0564bb6bfdab3951e4750ec196b578bb7ea6d07b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\992168.vbs

Filesize
180B

MD5
65d2a4211db5b12673d7bd69a3de8712

SHA1
90fa1ba7fbfd34c11cfb18821d7297ba94ce04b4

SHA256
8f489bde1b497f3e9dc14588e46a61d533c4962351b42765504ed6fa4bbc1d1f

SHA512
946d89e591928ed6164e35dbff4dc7912f2c066602f044cb005d8b9e4d9aeed4ea54ba7d2170e1ccca0c490b81a7a63bda8407154be812b294131e700cd9e869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\992168.vbs

Filesize
848B

MD5
91bfcafc9a6475f911e64b4cb250c13c

SHA1
0f3063d8924a333c8c184c4d9d7df9ae6c8d089c

SHA256
5282571138908acbd64a5c76443bd5875a1a697c04c0bd8e9932df53c992434a

SHA512
c034f0427b3be6c042a013ab5c88a6d2ef1e7b2efbb09ce52908180ec9212287286fc4811499912a4a9f1efea7f9598ca51ba1fec3e8548ea639bc17ce049d77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2C10A89\992168.vbs

Filesize
2KB

MD5
f42603ebf410bf45def883ce35e83ab7

SHA1
18703e7e8844912b555b6d20f127a5999a97c2dc

SHA256
92066c26db6a672499031925b00b221da40f4b9776af71dd21f29ff9987f1233

SHA512
294058cd645bae9271ce0eb61c401fe829e3201a6d0441da547a98543904477b0ece58c681eccb92d2c99f7b97c0bc0f20752b5ce7f14da0ef374da328f0a908

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\77160.vbs

Filesize
19KB

MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
\Users\Admin\AppData\Local\Temp\482.#.exe

Filesize
1004KB

MD5
0cb03ce965acfbfbc556646039546e90

SHA1
aa78e3854e1cab17ca5a81752ec57c786ede2774

SHA256
5b3ec25c7a448085a32a8e2cf57f557e85ebaad44543a414c3eef885f3a80472

SHA512
3255eb93bc670d8c1c5746d351caa945d6970376119af962e727d0dd062805116b5fee8bd2781951ce4090ed2b2d48663b3712483d7bf752ac5256d3a7fb13c3

Download Submit
memory/2276-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads