Analysis

  • max time kernel
    122s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:17

General

  • Target

    d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe

  • Size

    1.9MB

  • MD5

    733112fa2d9d15aaff3659ea9e2d3b4c

  • SHA1

    85a535c82f3f869fd52b0199b2ef4cbddb979c68

  • SHA256

    d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c

  • SHA512

    74b123f9717bc2a49ff9a814e441a54c4b2d9969ec30cbb692927bd10e93884237b6f8cbf87480bab76ec7835ee5661baa9d06e56887ac3ab530b366efe04c25

  • SSDEEP

    24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD

Malware Config

Signatures

  • Process spawned unexpected child process 36 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 33 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Checks whether UAC is enabled 1 TTPs 22 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 11 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 33 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe
    "C:\Users\Admin\AppData\Local\Temp\d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe"
    1⤵
    • UAC bypass
    • Drops file in Drivers directory
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4764
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3596
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System\RuntimeBroker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1904
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\csrss.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1292
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\GoogleUpdater\SppExtComObj.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3040
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4736
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\sysmon.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1924
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\swidtag\backgroundTaskHost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3088
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\SendTo\csrss.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1464
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\OfficeClickToRun.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2000
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4836
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\TextInputHost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:996
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4424
    • C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
      "C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5164
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d6ff011-e075-4179-b436-bf370ff87283.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5560
        • C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
          C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:5836
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad603efc-0941-4534-bd4d-a2aba0c2d100.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:5976
            • C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
              C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1236
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6bb8bfe-652b-41bb-ae4a-b0a9065e1840.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:5416
                • C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                  C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:624
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e1ccc58f-9334-41bc-bd71-71bdfe52af7b.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4316
                    • C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                      C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:3664
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28233ca1-9248-4027-b255-998af893ac50.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:244
                        • C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                          C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:5304
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\949b1638-7107-490d-a6e3-fbbcfb6337e4.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5900
                            • C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                              C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • System policy modification
                              PID:4704
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\435de542-e9db-488e-b40a-4072c5559d8c.vbs"
                                15⤵
                                  PID:5124
                                  • C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                                    C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                                    16⤵
                                    • UAC bypass
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • System policy modification
                                    PID:4688
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e2b2fc13-be16-4048-a9f2-10fdc621403a.vbs"
                                      17⤵
                                        PID:5360
                                        • C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                                          C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                                          18⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • System policy modification
                                          PID:552
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db74e4e3-0eb2-480c-91b6-b3752dfe6e67.vbs"
                                            19⤵
                                              PID:4788
                                              • C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                                                C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                                                20⤵
                                                • UAC bypass
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • Modifies registry class
                                                • Suspicious use of AdjustPrivilegeToken
                                                • System policy modification
                                                PID:1768
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4585f444-99ea-48f9-a0bc-7a8ff9f68e11.vbs"
                                                  21⤵
                                                    PID:3076
                                                    • C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                                                      C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe
                                                      22⤵
                                                        PID:4164
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc5af159-c714-4565-8bda-bd5f7c2a1645.vbs"
                                                          23⤵
                                                            PID:4580
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04a33bd1-2f7f-49fd-9361-a081a2888f96.vbs"
                                                            23⤵
                                                              PID:5452
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aaa8e9aa-3afe-4904-8ea3-724d88f001aa.vbs"
                                                          21⤵
                                                            PID:1344
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3074a974-ffb9-43c7-bab1-70593d5226b1.vbs"
                                                        19⤵
                                                          PID:1656
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7dffc387-2dc0-46c1-8fe6-800fd711ac22.vbs"
                                                      17⤵
                                                        PID:2316
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c84669fe-f823-49d5-ac21-767c7f58b93a.vbs"
                                                    15⤵
                                                      PID:5980
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f8a2168-ce90-4dd8-ada9-4a482f2d06f9.vbs"
                                                  13⤵
                                                    PID:5996
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31d0f224-d37c-4d2f-a1ec-423401cef187.vbs"
                                                11⤵
                                                  PID:5476
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72387453-7dd1-4eb9-a33b-963105d97cf7.vbs"
                                              9⤵
                                                PID:4616
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f6f3df8d-a811-41db-bb15-9e9226f576e6.vbs"
                                            7⤵
                                              PID:4100
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10822913-b100-47d4-bfe6-9aa9c9597635.vbs"
                                          5⤵
                                            PID:6024
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19019f6f-1380-4f1a-99b3-bde9579b5598.vbs"
                                        3⤵
                                          PID:5608
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\System\RuntimeBroker.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2212
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System\RuntimeBroker.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4092
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\System\RuntimeBroker.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4368
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\3ac54ddf2ad44faa6035cf\csrss.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4516
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\csrss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3056
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\3ac54ddf2ad44faa6035cf\csrss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1244
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\GoogleUpdater\SppExtComObj.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2052
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\GoogleUpdater\SppExtComObj.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4520
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\GoogleUpdater\SppExtComObj.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4860
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:392
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3684
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:448
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:928
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3812
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3596
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\sysmon.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:436
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\sysmon.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4836
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\sysmon.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4908
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files\dotnet\swidtag\backgroundTaskHost.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2196
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\backgroundTaskHost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3312
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files\dotnet\swidtag\backgroundTaskHost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:5076
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\SendTo\csrss.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3828
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\SendTo\csrss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4812
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Default\SendTo\csrss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:760
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\3ac54ddf2ad44faa6035cf\OfficeClickToRun.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1616
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\OfficeClickToRun.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3448
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\3ac54ddf2ad44faa6035cf\OfficeClickToRun.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1560
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:888
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1592
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\3ac54ddf2ad44faa6035cf\SppExtComObj.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2644
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\TextInputHost.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2140
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1980
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2532
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2432
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1380
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\3ac54ddf2ad44faa6035cf\dllhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3028

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\3ac54ddf2ad44faa6035cf\csrss.exe

                                      Filesize

                                      1.9MB

                                      MD5

                                      b7671ba040418a6d41606fe186576d5e

                                      SHA1

                                      f364635d7cde26d2a2d2e345f11f8f49d7acd8ee

                                      SHA256

                                      f2505b5c55e6bf953df04096972909a62e58692c6bd6547ba18e817342589aa2

                                      SHA512

                                      2bfc1aa3c2c1373ff328c8c37a1d28e56b300cde76740732bc0ebdd8bd9d89a4c5b3bf3b0be015f8882c3e1c4752c691e594e79af9bf8dc412838cb468c853cb

                                    • C:\Program Files (x86)\Google\GoogleUpdater\SppExtComObj.exe

                                      Filesize

                                      1.9MB

                                      MD5

                                      0cb82368cebf38e80f397ea3de2c0cf5

                                      SHA1

                                      b0f0cfab3af4723037e7e73c627635741b3e2c1d

                                      SHA256

                                      60a156167b3a3a7c32e3586895af3b4c975ab80fe31ac217410c2420eaf94a1e

                                      SHA512

                                      8f8215bdea4a8af8df18900dcee1976e3147c6f1aeb1759292dc29c6c1cbf8ab8df78008dac50cb7fc53ee691e8b647af149e1e130d64a52ed7bed0e508ca6d2

                                    • C:\Recovery\WindowsRE\SearchApp.exe

                                      Filesize

                                      1.9MB

                                      MD5

                                      733112fa2d9d15aaff3659ea9e2d3b4c

                                      SHA1

                                      85a535c82f3f869fd52b0199b2ef4cbddb979c68

                                      SHA256

                                      d6995ab53a3e1764dcb69174e80bb9d55cc93c4335efc865e937655c4f92803c

                                      SHA512

                                      74b123f9717bc2a49ff9a814e441a54c4b2d9969ec30cbb692927bd10e93884237b6f8cbf87480bab76ec7835ee5661baa9d06e56887ac3ab530b366efe04c25

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SppExtComObj.exe.log

                                      Filesize

                                      1KB

                                      MD5

                                      364147c1feef3565925ea5b4ac701a01

                                      SHA1

                                      9a46393ac3ffad3bb3c8f0e074b65d68d75e21ef

                                      SHA256

                                      38cf1ab1146ad24e88763fc0508c2a99478d8428b453ba8c8b830d2883a4562b

                                      SHA512

                                      bfec1d3f22abd5668def189259deb4d919ceb4d51ac965d0baf9b6cf8bea0db680d49a2b8d0b75524cc04c7803cdfd91e484b31dc8ddc3ff47d1e5c59a9e35cf

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                      Filesize

                                      2KB

                                      MD5

                                      d85ba6ff808d9e5444a4b369f5bc2730

                                      SHA1

                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                      SHA256

                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                      SHA512

                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      cae19674c4dd6a419a8ce8bc65e65167

                                      SHA1

                                      8b3f7e010483412b803e756c850fecd29cf9fb8a

                                      SHA256

                                      f4a34d2ff32e49df841e87405dab2661bcae83c20ee781a13fbe73924fd672cd

                                      SHA512

                                      9865dd43b4494081bb625844fcedb56dfc335b5f2cadd5c4094f0848df07ab5fa40faeb3adbbb91e1355ed436dfbf44ff4ae9ad39cdbd5fbfdef4d1813f3ee74

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      a16aff60eb3c3e35753a259b050c8a27

                                      SHA1

                                      85196d5dfb23d0c8b32b186325e2d58315a11287

                                      SHA256

                                      a057f85fa5358fac25f1337c1fbabeffb1ca1908b352208038293ec575dfc206

                                      SHA512

                                      13e6514cddaafba8f4fe3b08f6d6e118823ad454aac4efcb71a82438de50f97cd9570f44d594db27e4c534912a12ed066ea098b95505a6994f854f8349f2f5b0

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      acb0e0db180c73954955309f90c91376

                                      SHA1

                                      c27f2c17cfa4fd4a92174eb548aacf6606814cf4

                                      SHA256

                                      10c4266a001dde473f229f0ad24a3ba938d703f7c80debe52f6f49d3441cc849

                                      SHA512

                                      6fffb653f2da467d9d0cec17d2a39c6bd89321c5193a093547f20af70f7f74800045273860165543779a9298c9bbace104f8710bc1557ff9a31d6cbec3a298fc

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      d2e14ffaec8328ef6b85925ed5fc2c9b

                                      SHA1

                                      f42699edcf4fea12a6f3301141f996c2b8ecaf5d

                                      SHA256

                                      a75bb133d71f078fb9d5fa46ae46b5d23bfaacd382b0dadb4da59567f6749ccd

                                      SHA512

                                      335a0c6e8a6b1620b5644962c7deb43cef5e5ecb7f4d84816671cac12bd42d2fd6311e1c6ebe9c3a9bf5bc49c170760ba42d7045a74a38ec0963badacd72beff

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      efd2dfedf7e67764ce4dc0c1475d5543

                                      SHA1

                                      be775a500ecf6c234153afad0b8ec07e56ad74fa

                                      SHA256

                                      662c4f869810ea7f43ce3ccbeccc5b80c443161c56a346fb9054fb1fa613a7ad

                                      SHA512

                                      b167fa92f6d63b18e6247445b1c532a2a229a0fc6dcd26c9d1526749f80c7ec01524b7ce497ab94a3df814f9ce4b7394d872d85555323ddcd08798d565f3211e

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      3fe089fecc1a7897c40a12707d788ca9

                                      SHA1

                                      97f8ab9020333729ec191b3dbd044c57227b84fc

                                      SHA256

                                      70d80df3a3a68fa45dd114205f58cc05df07e22940ec0f0f6172abfccf671e7c

                                      SHA512

                                      4e4feebea709ed3bbfd82ed507d04566593e9cb7bb02ca1056d8ecb6cbcd3b5118be5dee4ee80bf158565a009c05b217bd4c885fb1e01c7d61f5e3d430c940cb

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      fd95e4475b8798a58a9e9d19409c1eac

                                      SHA1

                                      571d070dd6315847c4ba334670beffd245a35c45

                                      SHA256

                                      d33812e9c83075812c904e8ea736f744d614cb597e4c7aa4420021e492390729

                                      SHA512

                                      1ad95b0411ffbdeff090c3c71000377027095ecbc8ad27d9b4c8b7b469e669f7d76cd13f7ab2012779b6ac12c5ff2671f4e44fa8d1f2aefae3824ed74a9fa7fe

                                    • C:\Users\Admin\AppData\Local\Temp\19019f6f-1380-4f1a-99b3-bde9579b5598.vbs

                                      Filesize

                                      494B

                                      MD5

                                      c5254709b44942f657b44ff3dc64dfa6

                                      SHA1

                                      4fef6820a0e0843e11cb32dacc88ca3679d14f69

                                      SHA256

                                      88632635b864a5ffc3efde4b3915b0fd37eb090685ba90666245358c28399b3d

                                      SHA512

                                      4632e78b1595b42c6fc05adb3c6b0442d4f04497ea0ad02a8f6d03d2bdb3f7d950a3f7a33d1bf7e3c9b219937ccb08d79bdbcbf5fb1d436cb5a0e29b058d9102

                                    • C:\Users\Admin\AppData\Local\Temp\28233ca1-9248-4027-b255-998af893ac50.vbs

                                      Filesize

                                      718B

                                      MD5

                                      e00c235924685adddf858eb05812c47a

                                      SHA1

                                      4fbd79a022c848b869c3930b00a75fceba397138

                                      SHA256

                                      2224ec678b9e94abcacec9f4bb3c3634a4f2a1f6c908bbb9155e2fb8fd2ca359

                                      SHA512

                                      13e97914f1917284aa579c9657c92b97bdad7b5e58c43a869d4ac62f58edf7341403de9bd57235818a2ee0038552b3129ae4ba9de23d83e113b8d805e188cbfa

                                    • C:\Users\Admin\AppData\Local\Temp\435de542-e9db-488e-b40a-4072c5559d8c.vbs

                                      Filesize

                                      718B

                                      MD5

                                      294f8b3affc22487f43ce31418c86e26

                                      SHA1

                                      e2a2414412bf9b4ba3f3a0437228fc4372b33a65

                                      SHA256

                                      4c4b21f9087d4c544a712a5a63d46e12260974b01f003f222bc6398671a28699

                                      SHA512

                                      ce2c15cef2008bdbca030499f1350507a9aafa949855d411a0a3059fc96352533bfa863fbe19e98ec1dc18250271545a011cc3ef207e01911120fc33f8442afc

                                    • C:\Users\Admin\AppData\Local\Temp\4585f444-99ea-48f9-a0bc-7a8ff9f68e11.vbs

                                      Filesize

                                      718B

                                      MD5

                                      ebd89f3050c8ea255a78c1160f425c77

                                      SHA1

                                      8b9355c40acc899296ccdb36d9d04da02f9f4ba8

                                      SHA256

                                      0c3e24c9bb85a3a0b1d602a1874221784b180eeb09abb7d31a2634948a0d4cbf

                                      SHA512

                                      1e1fbbb27c6bf2a2d5a1224668b8701d740f7c2b1bb3e981bfc2aaf49f32c1c341617bb310eedd6a3838bfd5be4fc8a5928e5c6a175c537562572e3e403aa94b

                                    • C:\Users\Admin\AppData\Local\Temp\949b1638-7107-490d-a6e3-fbbcfb6337e4.vbs

                                      Filesize

                                      718B

                                      MD5

                                      fb51c719006253502344f98d932834de

                                      SHA1

                                      c8dda6ebe7ac3154cde4fa29e79c09f632aae62c

                                      SHA256

                                      47254968d0b0c6e6503b0e1612d6d74d69a31a8bf7f22280faae6e2f50e7127a

                                      SHA512

                                      cae9aa24e260231df458670fb9c69ba68f44d04785f17740ddfa3ba3da7a0bc25cb57f0fc180977e3986888454bce15b79fb27124793c4d1272a8cad8745ac8d

                                    • C:\Users\Admin\AppData\Local\Temp\9d6ff011-e075-4179-b436-bf370ff87283.vbs

                                      Filesize

                                      718B

                                      MD5

                                      e515b12cfa37a2c0e81976e2d7957fe8

                                      SHA1

                                      11d8391209bdc0036cc32ac00b4303ffd105f82e

                                      SHA256

                                      8c2f0522f6ec8ef4bfa2867724a57395726b71bae464f30f491f1918494af8f0

                                      SHA512

                                      24b639c5833ee8936291b5e7df1a17eed22e45e0c6499e5b1fc1ff677b8ba72b02ef76107e2ee7d4cba57916fc6fffe232bc36a3c9cc5d9e158b562b06745219

                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eey0pgdc.zuv.ps1

                                      Filesize

                                      60B

                                      MD5

                                      d17fe0a3f47be24a6453e9ef58c94641

                                      SHA1

                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                      SHA256

                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                      SHA512

                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                    • C:\Users\Admin\AppData\Local\Temp\a6bb8bfe-652b-41bb-ae4a-b0a9065e1840.vbs

                                      Filesize

                                      718B

                                      MD5

                                      65583dc5e30e2e3eb43b02f273bcc837

                                      SHA1

                                      f39abc246bb847e343494211f309c8cdc105ba85

                                      SHA256

                                      89334d6823b3e66aa7f6fc7478149ca07fd43ea69f511ea344a438a5e20228a5

                                      SHA512

                                      2fdea079ec36cddb5bebab5d7d8604bbadd24a88d01051fa36bbe11ed0abf387db4fc5e381ae3b9e26bd32835ad7af06e403383e7acdd7336bc7241258a9106f

                                    • C:\Users\Admin\AppData\Local\Temp\ad603efc-0941-4534-bd4d-a2aba0c2d100.vbs

                                      Filesize

                                      718B

                                      MD5

                                      c0aee1b177c1e1e4d1d83eda706606de

                                      SHA1

                                      0c6cab4a992400ce700596d697292a5e83ef066a

                                      SHA256

                                      37f53707050afdfb87629f45c16da1fc48996e41d81436ddd6ccd96704b9362a

                                      SHA512

                                      3695247b45cc9792aaa4db12c02361caeb853f0515188f9993ded6db0799941f6a7eaebbda59e6a96c7b8740af21aaf689ae0a1cfc536c99f846c1b6f0cc75f9

                                    • C:\Users\Admin\AppData\Local\Temp\db74e4e3-0eb2-480c-91b6-b3752dfe6e67.vbs

                                      Filesize

                                      717B

                                      MD5

                                      86ecb49736bdf85e326560d22a4f089f

                                      SHA1

                                      b3b369e5f620e0894b36471f2a93192e36136f9d

                                      SHA256

                                      6f1d96450b0df461fd6086341f73e8018f945813738a2b3f564083122e44c416

                                      SHA512

                                      e010030aa5380526523c9424a4249a778c590c282c2421aaf02be6a42c1b735b5d1caf90fb0f3c77f04bdfc414821d363d22ab3f404cbc342cccc39960ca5843

                                    • C:\Users\Admin\AppData\Local\Temp\dc5af159-c714-4565-8bda-bd5f7c2a1645.vbs

                                      Filesize

                                      718B

                                      MD5

                                      a8f3856478c2f8e50da3747730ec108a

                                      SHA1

                                      68a76ccc4a35bd89f928ebb2126cd38c7e03302c

                                      SHA256

                                      ad0bc37056bedd8ee303a6234898c86d943528c0efe6a6e99d15a36375415573

                                      SHA512

                                      20839993c7eeeacf91b6fa7170ce2893a26bdbae3373572cf1975bbc6841c5369a09a13445bc85062eee638ff0b07e2ec5fe96db3368d3a65a6629f29bca3423

                                    • C:\Users\Admin\AppData\Local\Temp\e1ccc58f-9334-41bc-bd71-71bdfe52af7b.vbs

                                      Filesize

                                      717B

                                      MD5

                                      4b111d3a01bdcc94f44202d2f775ba52

                                      SHA1

                                      11a65f7becd3013cbbd29250220a033866821a86

                                      SHA256

                                      6d38632f071a3f53ead31fd996a01d81dc74f128e44cd6ccd1b8b2e1e87c0e33

                                      SHA512

                                      edfcd6898a834b158d4135b016583e48b49ca83beb41ca7c43622ac62affe5d25051c038eac571c2629f98ec1d139bf242a279c29ac76572266f0590b5520878

                                    • C:\Users\Admin\AppData\Local\Temp\e2b2fc13-be16-4048-a9f2-10fdc621403a.vbs

                                      Filesize

                                      718B

                                      MD5

                                      24874012ba1015d7afcf1916aebea071

                                      SHA1

                                      e6af8f99a031e287ebfb1009c0e1910d1ac9b2e5

                                      SHA256

                                      42e4f267a439888a762749379f99d36391582e9efaf4524eb82231b5e679c32e

                                      SHA512

                                      866e6e44052f820ef1dfa91d3e598505d653c2670a8d119eb1eda18d7af155231b3e10e33f9ebb776f8b3d4c40190935e31a95843b7c0830a8b4f76eace8f33f

                                    • memory/1236-416-0x000000001BB00000-0x000000001BB56000-memory.dmp

                                      Filesize

                                      344KB

                                    • memory/4424-231-0x000001BF02DA0000-0x000001BF02DC2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/4704-461-0x000000001B9E0000-0x000000001B9F2000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/4764-14-0x000000001C180000-0x000000001C6A8000-memory.dmp

                                      Filesize

                                      5.2MB

                                    • memory/4764-9-0x000000001B640000-0x000000001B696000-memory.dmp

                                      Filesize

                                      344KB

                                    • memory/4764-1-0x0000000000260000-0x000000000044A000-memory.dmp

                                      Filesize

                                      1.9MB

                                    • memory/4764-361-0x00007FF9A3AA0000-0x00007FF9A4561000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/4764-357-0x00007FF9A3AA0000-0x00007FF9A4561000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/4764-181-0x00007FF9A3AA3000-0x00007FF9A3AA5000-memory.dmp

                                      Filesize

                                      8KB

                                    • memory/4764-19-0x000000001B8A0000-0x000000001B8AC000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/4764-20-0x000000001B8B0000-0x000000001B8BC000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/4764-16-0x000000001B870000-0x000000001B87A000-memory.dmp

                                      Filesize

                                      40KB

                                    • memory/4764-17-0x000000001B880000-0x000000001B88E000-memory.dmp

                                      Filesize

                                      56KB

                                    • memory/4764-18-0x000000001B890000-0x000000001B898000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/4764-15-0x000000001B6B0000-0x000000001B6BC000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/4764-0-0x00007FF9A3AA3000-0x00007FF9A3AA5000-memory.dmp

                                      Filesize

                                      8KB

                                    • memory/4764-2-0x00007FF9A3AA0000-0x00007FF9A4561000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/4764-3-0x0000000002660000-0x000000000267C000-memory.dmp

                                      Filesize

                                      112KB

                                    • memory/4764-13-0x00000000026E0000-0x00000000026F2000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/4764-11-0x00000000026D0000-0x00000000026D8000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/4764-10-0x00000000026C0000-0x00000000026CC000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/4764-5-0x0000000002500000-0x0000000002508000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/4764-4-0x000000001B0E0000-0x000000001B130000-memory.dmp

                                      Filesize

                                      320KB

                                    • memory/4764-6-0x0000000002680000-0x0000000002690000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/4764-7-0x0000000002690000-0x00000000026A6000-memory.dmp

                                      Filesize

                                      88KB

                                    • memory/4764-8-0x00000000026B0000-0x00000000026BA000-memory.dmp

                                      Filesize

                                      40KB

                                    • memory/5164-363-0x00000000033B0000-0x00000000033C2000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/5164-362-0x000000001BCE0000-0x000000001BD36000-memory.dmp

                                      Filesize

                                      344KB

                                    • memory/5836-404-0x000000001BEF0000-0x000000001BF02000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/5836-403-0x000000001B970000-0x000000001B9C6000-memory.dmp

                                      Filesize

                                      344KB