Analysis
-
max time kernel
66s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
26/07/2024, 19:39
General
-
Target
NursultanAlphaCrack.exe
-
Size
3.4MB
-
MD5
833fa3b83aa9acbef18b37d69f775b30
-
SHA1
0d8bd9fef095137b5e879fb6a93b1b0bf17e5cb6
-
SHA256
61863e7d60ce62d9f81bd9a138e1fcd3f0a4344340c2f9922908719a737dbb5d
-
SHA512
4e4beba0fa0b32a3d9c386c53471b9f6634715543a639926c5a1b7e7137f70ac27cda146dca120b5ebba40ac592f4b0f2dcfb85964d2c9151c4b641bee044c87
-
SSDEEP
49152:vMpBCM5f3l+R7eTma4aSE3U3WoalKVnZK0FImmOhJe8DbRhf1+ljL3BPhbIscphW:vMp8MBV+R7QKBralse+Lf8bIxwHw1DI
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 45 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload 6 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Drops file in Program Files directory 11 IoCs
-
Drops file in Windows directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 56 IoCs
-
Modifies registry key 1 TTPs 60 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 53 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"5⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"7⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"8⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"9⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"11⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"12⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"13⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"14⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"16⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"20⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"22⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"26⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"C:\Users\Admin\AppData\Local\Temp\NursultanAlphaCrack.exe"67⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"66⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"67⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"66⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"67⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"65⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"66⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "67⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"68⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"65⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"66⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"64⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "66⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"67⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"64⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"65⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"63⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"64⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "65⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"66⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"63⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"64⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "65⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"66⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"62⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "64⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"65⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"62⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "64⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"65⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"61⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"62⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "63⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"64⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f64⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"61⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"62⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "63⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"64⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"60⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "62⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"63⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f63⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"60⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "62⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"63⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"59⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"60⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "61⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"62⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f62⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"59⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"60⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "61⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"62⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"58⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"61⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f61⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"58⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "60⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵
-
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"61⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"57⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"58⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "59⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"60⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f60⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"57⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"58⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "59⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"60⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"56⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "58⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"59⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f59⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"56⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "58⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"59⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"55⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"56⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "57⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"58⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f58⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"55⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"56⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "57⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"58⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"54⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "56⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"57⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f57⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"54⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "56⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"57⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"53⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"54⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "55⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"56⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f56⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"53⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"54⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "55⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"56⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"52⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "54⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"55⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f55⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"52⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "54⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"55⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"51⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"52⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "53⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"54⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f54⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"51⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"52⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "53⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"54⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"50⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "52⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"53⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f53⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"50⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "52⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"53⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"49⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"50⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "51⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"52⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f52⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"49⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"50⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "51⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV152⤵
-
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"52⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"48⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "50⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"51⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f51⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"48⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "50⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"51⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"47⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"48⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "49⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"50⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f50⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"47⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"48⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "49⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"50⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"46⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "48⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"49⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f49⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"46⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "48⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"49⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"45⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"46⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "47⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV148⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"48⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f48⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"45⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"46⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "47⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV148⤵
-
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"48⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"44⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"47⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f47⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"44⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"47⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"43⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"44⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "45⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"46⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f46⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"43⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"44⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "45⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"46⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"42⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "44⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"45⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f45⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"42⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "44⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"45⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"41⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"42⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "43⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"44⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f44⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"41⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"42⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "43⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"44⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"40⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "42⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"43⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f43⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"40⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "42⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"43⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"39⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"40⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "41⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"42⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f42⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"39⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"40⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "41⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"42⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"38⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "40⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"41⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f41⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"38⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "40⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"41⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"37⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"38⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "39⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"40⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f40⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"37⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"38⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "39⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV140⤵
-
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"40⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"36⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "38⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"39⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f39⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"36⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "38⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"39⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"35⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"36⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "37⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"38⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f38⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"35⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"36⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "37⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"38⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"34⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "36⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"37⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f37⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"34⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "36⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"37⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"33⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"34⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "35⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV136⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"36⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f36⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"33⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"34⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "35⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV136⤵
-
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"36⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"32⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "34⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"35⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f35⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"32⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "34⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"35⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"31⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"32⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "33⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV134⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"34⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f34⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"31⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"32⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "33⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"34⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"30⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"31⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "32⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"33⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f33⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"30⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"31⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "32⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"33⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"29⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"30⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "31⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"32⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f32⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"29⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"30⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "31⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"32⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"28⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"29⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "30⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"31⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f31⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"28⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"29⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "30⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"31⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"27⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"28⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "29⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"30⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f30⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"27⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"28⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "29⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"30⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"26⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"27⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "28⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"29⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f29⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"26⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"27⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "28⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"29⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"25⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"26⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "27⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"28⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f28⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"25⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"26⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "27⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"28⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"24⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"25⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "26⤵
- System Location Discovery: System Language Discovery
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"27⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f27⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"24⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "26⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"27⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"23⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"24⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "25⤵
- System Location Discovery: System Language Discovery
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"26⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f26⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"23⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"24⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "25⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"26⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"22⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "24⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"25⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f25⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"22⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"23⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "24⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"25⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"21⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "23⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV124⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"24⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f24⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"21⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"22⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "23⤵
- System Location Discovery: System Language Discovery
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"24⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"20⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"21⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "22⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"23⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f23⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"20⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "22⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"23⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"19⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"20⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "21⤵
- System Location Discovery: System Language Discovery
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f22⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"19⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"20⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "21⤵
- System Location Discovery: System Language Discovery
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"19⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "20⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"21⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f21⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"18⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"19⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "20⤵
- System Location Discovery: System Language Discovery
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"21⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "19⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"20⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f20⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"17⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"18⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "19⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV120⤵
-
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"20⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"17⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "18⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f19⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"16⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"17⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "18⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵
-
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"19⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"16⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "17⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV118⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f18⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"16⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "17⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"15⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "16⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f17⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "16⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"13⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"14⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "15⤵
- System Location Discovery: System Language Discovery
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f16⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"13⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"14⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "15⤵
- System Location Discovery: System Language Discovery
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "14⤵
- System Location Discovery: System Language Discovery
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f15⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"12⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "14⤵
- System Location Discovery: System Language Discovery
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "13⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f14⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"12⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "13⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"10⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "12⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f13⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"11⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "12⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV113⤵
-
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"10⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "11⤵
- System Location Discovery: System Language Discovery
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f12⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"9⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"10⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "11⤵
- System Location Discovery: System Language Discovery
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"9⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "10⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f11⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"8⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "10⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "9⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
-
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f10⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"7⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "9⤵
- System Location Discovery: System Language Discovery
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"7⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "8⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f9⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"7⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"5⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "7⤵
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f8⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "7⤵
- System Location Discovery: System Language Discovery
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "6⤵
- System Location Discovery: System Language Discovery
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f7⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "6⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f6⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "5⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\2e8nYkLZtNZRWLze8a3w.vbe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\EmfL9gR1UoUqTmpNgZjd7sI.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\SurrogatewinDrivernetsvc\portproviderperf.exe"C:\SurrogatewinDrivernetsvc\portproviderperf.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f5⤵
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Containernet\r3KdEjt.vbe"3⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Containernet\RF2hvkHZrszbP0k.bat" "4⤵
-
C:\Containernet\bridgecontainerRef.exe"C:\Containernet\bridgecontainerRef.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\SurrogatewinDrivernetsvc\fontdrvhost.exe"C:\SurrogatewinDrivernetsvc\fontdrvhost.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Application Data\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Application Data\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Windows\security\database\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\security\database\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Windows\security\database\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Containernet\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Containernet\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Containernet\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\SurrogatewinDrivernetsvc\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\SurrogatewinDrivernetsvc\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\SurrogatewinDrivernetsvc\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Windows\Globalization\Sorting\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Globalization\Sorting\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Windows\Globalization\Sorting\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\GameBarPresenceWriter\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Windows\GameBarPresenceWriter\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\Provisioning\Autopilot\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Provisioning\Autopilot\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Provisioning\Autopilot\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\ja-JP\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\ja-JP\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\ja-JP\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\browser\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\browser\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Containernet\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Containernet\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Containernet\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD5a85467e4f1d1f99e96e9590c355d42f2
SHA1398ac3ea16a11a8a2957a5ef4143d472e5cfc294
SHA256046e64c151f66ef0f72682fa16c83309790478eeaa0d7621ea324b4221e85903
SHA5121a718a6040863d596326d1a7e0f81307d69d1287c4b03767f1a83ebf31f860b3e2a545b44f358a47cac4500b4ecdf9e9c15f8ec46de7335606eaa72b7eaf672a
-
Filesize
828KB
MD56afa3e281b7634f49b96825bb400bc5a
SHA1fee8aa25a2db0a2eec530345a3955ab5c16050bf
SHA25629e76ed158c096cd29f1b2d5fcfc838e1034ca2ea35ed66c51490f9bf409a7b1
SHA512913cecf27e7b99c2b0326c1647a25ce71dd31af8f4e1854b6dc4acd4f87125455b7288b7f9e59d44512bc713a0e2941ddcf6395922af011a3aa71fb48ae2e605
-
Filesize
204B
MD58952fed62096fc946fc4ff2231ae0277
SHA1437591c439dc3da24fbb7ca97cc57e2b37027183
SHA25654c44a2c1291a654f1fe103fb47ba51e164a7d36221b28282ec01eba06ec5aa4
SHA5125fd0750db4a66187736760347987108ba81caa3771d8c20dee3fec57b133c1b5b892a65c3e78b6e88958c308d7e98011ac4cb6af63c345b29882f72f75de3d12
-
Filesize
224B
MD55c864fca419a9f0dec15d73ec242077d
SHA1e57ebd5f534ca0535960d156eb7c4c3b44c503b5
SHA25622c51d8cef10cf4075e704eb50e774b4bba1ff8913746487650c9d242789fe10
SHA512d0cc0b8feb2a99e88d09cfc224d99215ebcae5902c971c9bd4ab0987a1d9e682e4bac8d8d6f7c64fd2c930463bb8201e5353c577643aff9b58cd982eeeb5fe5f
-
Filesize
162B
MD5e01ef91219b266b14d1ae415d30256d5
SHA1cad006a2efee48fcad1166e7ce3bc118ff139808
SHA256db58b3dde8508ecbe59d938545246355b52d9cdec29f76657b66638c4d7aeeb2
SHA5127826ca4bda02431bff87c7c72bd1ea53bc769b8574302a37445318360326e5a89e309c35dbc8f9981ec35c5067b4a459195b78d0289f5d93f6ec54be4c3f1e7b
-
Filesize
2.7MB
MD513a959a83b29024a74822f39005c6bf5
SHA15d5e1b1392f1bea34e44a08114ee2fd22cb7cdc9
SHA25651ae7d669eb7c34c9390685b0fd2db522d9ba244ead6021523e608009821601e
SHA5122492bb129ab89b5fcd33bb9c19b1765fc7e10cb9de3e00419e1aa4d3807c14f9eaa842115670529604d62cd5b5ca274d93d5288c88cf6eda7ce4c378e71cbf72
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
Filesize
1KB
MD55cb90c90e96a3b36461ed44d339d02e5
SHA15508281a22cca7757bc4fbdb0a8e885c9f596a04
SHA25634c15d8e79fef4bddec7e34f3426df3b68f8fc6deac29ea12d110f6c529fe3bb
SHA51263735938c841c28824e3482559df18839930acc5ea8600b1074439b70a2f600a92f41593568e49991f25f079e7f7361b4f1678feadbf004f6e9e4d51d36598d4
-
Filesize
3.0MB
MD5101ba015a44ffb0f1a61dcafa9ca152c
SHA1c29e1af8daa1dee8bf04b221e9e5551889229236
SHA256a5cd4b6a4ea887e69a01856df8b1e58887860dfb0041e60e768c988cc1e5ec8b
SHA512f3ddf2005433e9f248dd7a6ea4fd10446f9e3c3c8b1eede306e253c86d6155e7448a6e10f87336996e87ef52f3dd21bb988733234a8788516edd7da0fd192b20
-
Filesize
1.1MB
MD5ee4839dcc8cf148ce959f4d238f5d696
SHA1ea27026af975bf81febf24f872b722c19544c0be
SHA256e0663c567d2eb0a820e22f4f2cf2a728c911e14dbb5aa054e6d24904b4e3ca4e
SHA51265cbba7b3c2f89a95a38e9e21386084d6fb57162ed34010feae03cb00051537663cfc78475810b123427db6e063a53a9b08170f5aed869d34fd4295c84021093
-
Filesize
2.7MB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
3.4MB
-
Filesize
856KB