ea43c3de37ff0a0cc029e8503dd174b3c4c9e0baefe60dd180a84d57d95bd9dd

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xrhwy.ps1
Size 5KB
Sample260522-vs2gpsbv3q
SHA256 ea43c3de37ff0a0cc029e8503dd174b3c4c9e0baefe60dd180a84d57d95bd9dd
MD5 7289141c5c568ff5284ae5472b02f89e
SHA1 b6a9748cc3d126e6daed12d1ef984672dacefaf1
SHA512 578548b774933a5964a4298f5a8e23f9d570523228735e5ac88aaf366437cab125479a6c6eedcf5e8a1b3407168a2f97b319579ade6fab6f2a963d031a28607f
SSDEEP 96:4yEBs5sZ58fOO9D+FwqODvhsZ5SHAI8n9731RrvHgHAcc8EQ1QadUvLnq20gc8mX:4yeefmqqcH897brElEgjqDq96RJnncWU
TLSH
T1D9C138005AF95608BAF36F05AABFA051897B7A5D9D3ADA4D0048C04E17F2E44CC6BF73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
22	940	powershell.exe
46	6120	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
940	powershell.exe
6120	powershell.exe
6820	powershell.exe

.NET Reactor proctector 64 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/6120-30-0x000002342AE30000-0x000002342AE96000-memory.dmp	net_reactor
behavioral1/memory/6120-123-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-125-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-141-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-157-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-155-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-153-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-151-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-149-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-147-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-145-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-143-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-139-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-137-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-135-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-133-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-131-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-129-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-127-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-121-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-119-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-117-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-115-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-114-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-111-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-109-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-107-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-104-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-102-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-100-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-98-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-96-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-94-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-90-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-88-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-86-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-84-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-82-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-80-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-78-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-74-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-72-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-70-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-68-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-66-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-64-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-62-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-60-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-58-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-57-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-54-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-52-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-50-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-48-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-46-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-44-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-43-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-40-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-38-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-36-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-34-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-32-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-31-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor
behavioral1/memory/6120-92-0x000002342AE30000-0x000002342AE8F000-memory.dmp	net_reactor

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6412	cmd.exe
6380	cmd.exe
5648	PING.EXE
7768	cmd.exe
6608	PING.EXE
4560	cmd.exe
7248	PING.EXE
5856	PING.EXE
5732	cmd.exe
7224	cmd.exe
8096	PING.EXE
5500	PING.EXE
5600	cmd.exe
6004	cmd.exe
4432	PING.EXE
6532	PING.EXE
6404	cmd.exe
6000	PING.EXE
6436	cmd.exe
6592	PING.EXE
6584	PING.EXE
6036	cmd.exe
6548	PING.EXE
2956	PING.EXE
1700	PING.EXE
7516	cmd.exe
7860	cmd.exe
8032	PING.EXE
3304	PING.EXE
6616	PING.EXE
5188	cmd.exe
5636	PING.EXE
2268	PING.EXE
5316	PING.EXE
3952	cmd.exe
6588	PING.EXE
7000	PING.EXE
7560	PING.EXE
8060	cmd.exe
6176	cmd.exe
5972	cmd.exe
220	PING.EXE
6212	PING.EXE
7812	PING.EXE
5920	cmd.exe
4600	PING.EXE
6428	PING.EXE
6540	PING.EXE
4276	cmd.exe
7656	cmd.exe
7692	PING.EXE
5184	PING.EXE
6420	cmd.exe
6396	cmd.exe
6388	cmd.exe
6372	cmd.exe
6568	PING.EXE
2304	PING.EXE
7868	cmd.exe
8152	cmd.exe
7664	cmd.exe
6356	cmd.exe
908	cmd.exe
5056	PING.EXE

Runs ping.exe 1 TTPs 60 IoCs

Remote System Discovery

T1018

pid	Process
3940	PING.EXE
8024	PING.EXE
6588	PING.EXE
6616	PING.EXE
524	PING.EXE
5316	PING.EXE
6608	PING.EXE
5636	PING.EXE
3652	PING.EXE
8032	PING.EXE
5056	PING.EXE
7804	PING.EXE
4432	PING.EXE
6568	PING.EXE
7692	PING.EXE
2956	PING.EXE
5856	PING.EXE
6636	PING.EXE
6584	PING.EXE
6992	PING.EXE
220	PING.EXE
6592	PING.EXE
1700	PING.EXE
5812	PING.EXE
6432	PING.EXE
7904	PING.EXE
8104	PING.EXE
5576	PING.EXE
3304	PING.EXE
4600	PING.EXE
5648	PING.EXE
3736	PING.EXE
6532	PING.EXE
7560	PING.EXE
5500	PING.EXE
6220	PING.EXE
3416	PING.EXE
3924	PING.EXE
7240	PING.EXE
7248	PING.EXE
7896	PING.EXE
5940	PING.EXE
6596	PING.EXE
7000	PING.EXE
2268	PING.EXE
8096	PING.EXE
6000	PING.EXE
5184	PING.EXE
6212	PING.EXE
6428	PING.EXE
6548	PING.EXE
7552	PING.EXE
7700	PING.EXE
7812	PING.EXE
8188	PING.EXE
3392	PING.EXE
4344	PING.EXE
2304	PING.EXE
6532	PING.EXE
6540	PING.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
940	powershell.exe
940	powershell.exe
6120	powershell.exe
6120	powershell.exe
6120	powershell.exe
6120	powershell.exe
6820	powershell.exe
6820	powershell.exe
6820	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	powershell.exe
Token: SeIncreaseQuotaPrivilege	940	powershell.exe
Token: SeSecurityPrivilege	940	powershell.exe
Token: SeTakeOwnershipPrivilege	940	powershell.exe
Token: SeLoadDriverPrivilege	940	powershell.exe
Token: SeSystemProfilePrivilege	940	powershell.exe
Token: SeSystemtimePrivilege	940	powershell.exe
Token: SeProfSingleProcessPrivilege	940	powershell.exe
Token: SeIncBasePriorityPrivilege	940	powershell.exe
Token: SeCreatePagefilePrivilege	940	powershell.exe
Token: SeBackupPrivilege	940	powershell.exe
Token: SeRestorePrivilege	940	powershell.exe
Token: SeShutdownPrivilege	940	powershell.exe
Token: SeDebugPrivilege	940	powershell.exe
Token: SeSystemEnvironmentPrivilege	940	powershell.exe
Token: SeRemoteShutdownPrivilege	940	powershell.exe
Token: SeUndockPrivilege	940	powershell.exe
Token: SeManageVolumePrivilege	940	powershell.exe
Token: 33	940	powershell.exe
Token: 34	940	powershell.exe
Token: 35	940	powershell.exe
Token: 36	940	powershell.exe
Token: SeIncreaseQuotaPrivilege	940	powershell.exe
Token: SeSecurityPrivilege	940	powershell.exe
Token: SeTakeOwnershipPrivilege	940	powershell.exe
Token: SeLoadDriverPrivilege	940	powershell.exe
Token: SeSystemProfilePrivilege	940	powershell.exe
Token: SeSystemtimePrivilege	940	powershell.exe
Token: SeProfSingleProcessPrivilege	940	powershell.exe
Token: SeIncBasePriorityPrivilege	940	powershell.exe
Token: SeCreatePagefilePrivilege	940	powershell.exe
Token: SeBackupPrivilege	940	powershell.exe
Token: SeRestorePrivilege	940	powershell.exe
Token: SeShutdownPrivilege	940	powershell.exe
Token: SeDebugPrivilege	940	powershell.exe
Token: SeSystemEnvironmentPrivilege	940	powershell.exe
Token: SeRemoteShutdownPrivilege	940	powershell.exe
Token: SeUndockPrivilege	940	powershell.exe
Token: SeManageVolumePrivilege	940	powershell.exe
Token: 33	940	powershell.exe
Token: 34	940	powershell.exe
Token: 35	940	powershell.exe
Token: 36	940	powershell.exe
Token: SeDebugPrivilege	6120	powershell.exe
Token: SeDebugPrivilege	6820	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 6120	940	powershell.exe	96
PID 6120 wrote to memory of 6348	6120	powershell.exe	99
PID 6120 wrote to memory of 6356	6120	powershell.exe	100
PID 6120 wrote to memory of 6364	6120	powershell.exe	101
PID 6120 wrote to memory of 6372	6120	powershell.exe	102
PID 6120 wrote to memory of 6380	6120	powershell.exe	103
PID 6120 wrote to memory of 6388	6120	powershell.exe	104
PID 6120 wrote to memory of 6396	6120	powershell.exe	105
PID 6120 wrote to memory of 6404	6120	powershell.exe	106
PID 6120 wrote to memory of 6412	6120	powershell.exe	107
PID 6120 wrote to memory of 6420	6120	powershell.exe	108
PID 6380 wrote to memory of 6432	6380	cmd.exe	109
PID 6364 wrote to memory of 6532	6364	cmd.exe	110
PID 6420 wrote to memory of 6540	6420	cmd.exe	111
PID 6388 wrote to memory of 6548	6388	cmd.exe	112
PID 6348 wrote to memory of 6568	6348	cmd.exe	113
PID 6372 wrote to memory of 6584	6372	cmd.exe	114
PID 6356 wrote to memory of 6592	6356	cmd.exe	115
PID 6396 wrote to memory of 6608	6396	cmd.exe	116
PID 6404 wrote to memory of 6616	6404	cmd.exe	117
PID 6412 wrote to memory of 6636	6412	cmd.exe	118
PID 6120 wrote to memory of 6820	6120	powershell.exe	120
PID 6120 wrote to memory of 6956	6120	powershell.exe	121
PID 6120 wrote to memory of 6964	6120	powershell.exe	122
PID 6964 wrote to memory of 6992	6964	cmd.exe	123
PID 6956 wrote to memory of 7000	6956	cmd.exe	124
PID 6120 wrote to memory of 5772	6120	powershell.exe	129
PID 6120 wrote to memory of 6036	6120	powershell.exe	130
PID 6120 wrote to memory of 5188	6120	powershell.exe	131
PID 6036 wrote to memory of 1700	6036	cmd.exe	132
PID 5188 wrote to memory of 3416	5188	cmd.exe	133
PID 6120 wrote to memory of 1972	6120	powershell.exe	135
PID 6120 wrote to memory of 4424	6120	powershell.exe	136
PID 6120 wrote to memory of 5852	6120	powershell.exe	137
PID 4424 wrote to memory of 5636	4424	cmd.exe	138
PID 5852 wrote to memory of 3940	5852	cmd.exe	139
PID 6120 wrote to memory of 4184	6120	powershell.exe	140
PID 6120 wrote to memory of 4180	6120	powershell.exe	141
PID 6120 wrote to memory of 5732	6120	powershell.exe	142
PID 4180 wrote to memory of 3924	4180	cmd.exe	143
PID 5732 wrote to memory of 2304	5732	cmd.exe	144
PID 6120 wrote to memory of 3764	6120	powershell.exe	145
PID 6120 wrote to memory of 2264	6120	powershell.exe	146
PID 6120 wrote to memory of 540	6120	powershell.exe	147
PID 2264 wrote to memory of 2268	2264	cmd.exe	148
PID 540 wrote to memory of 5940	540	cmd.exe	149
PID 6120 wrote to memory of 2252	6120	powershell.exe	150
PID 6120 wrote to memory of 3952	6120	powershell.exe	151
PID 6120 wrote to memory of 4276	6120	powershell.exe	152
PID 3952 wrote to memory of 5648	3952	cmd.exe	153
PID 4276 wrote to memory of 3652	4276	cmd.exe	154
PID 6120 wrote to memory of 7188	6120	powershell.exe	155
PID 6120 wrote to memory of 7224	6120	powershell.exe	156
PID 6120 wrote to memory of 7216	6120	powershell.exe	157
PID 7224 wrote to memory of 7240	7224	cmd.exe	158
PID 7216 wrote to memory of 7248	7216	cmd.exe	159
PID 6120 wrote to memory of 7500	6120	powershell.exe	161
PID 6120 wrote to memory of 7516	6120	powershell.exe	162
PID 6120 wrote to memory of 7524	6120	powershell.exe	163
PID 7524 wrote to memory of 7552	7524	cmd.exe	164
PID 7516 wrote to memory of 7560	7516	cmd.exe	165
PID 6120 wrote to memory of 7640	6120	powershell.exe	166
PID 6120 wrote to memory of 7656	6120	powershell.exe	167
PID 6120 wrote to memory of 7664	6120	powershell.exe	168

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\xrhwy.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\ffrct_01.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1778719957.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6348
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6568
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6356
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6592
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi6f9d.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6364
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:6532
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi6fc1.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6372
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6584
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui6f9d.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6380
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:6432
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui6fc1.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6388
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6548
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\xrhwy.ps1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6396
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6608
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\ffrct_01.ps1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6404
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6616
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\jfvhl.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6412
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:6636
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\vhsvg.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6420
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6820
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6956
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:7000
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6964
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:6992
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:5772
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6036
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1700
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5188
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:3416
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:1972
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5636
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:3940
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:4184
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:3924
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5732
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2304
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:3764
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2268
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:540
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:5940
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:2252
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5648
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:3652
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:7188
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:7224
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:7240
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:7216
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:7248
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:7500
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:7516
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:7560
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:7524
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:7552
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:7640
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7656
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:7700
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7664
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:7692
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:7752
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7768
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:7804
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:7776
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:7812
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:7844
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7860
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:7904
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:7868
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:7896
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:7972
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    PID:7988
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:8024
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:7996
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:8032
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:2360
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:8060
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:8096
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:8068
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:8104
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:8136
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:8152
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:8188
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:8160
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:524
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:5480
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    PID:5832
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:3736
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:64
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:3392
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:2688
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    PID:2984
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6000
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:4196
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2956
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:6012
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5972
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5500
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:1888
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5316
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:4328
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5600
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:220
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:3092
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:5576
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:4624
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    PID:2700
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5184
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5920
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:4344
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:3868
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4560
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5856
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:3216
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3304
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:6160
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6176
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:6220
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:6184
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6212
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:1032
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    PID:4348
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4600
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6004
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4432
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:3560
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:908
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5056
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:5040
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:5812
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:3584
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    PID:1340
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6588
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6436
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6428
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:6644
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    PID:6712
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6532
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:6556
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:6596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

server.txt

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\server.txt
Size 463B
SHA256 195a932730368ed1468830ccd7f76d5b121dcc622c10b4d6a53e8f247bd1b2c3
MD5 4863e5989a2111d76f5b7a5091c95cf0
SHA1 11f45cbd085eba03cfc51de880ca99fef4b2c377
SHA512 98576f532682233ad5a80f6924280ca733277a85f50df03111e5c20da0da8408de3f0e089b497b7c6292024abe3bf8277512140babab203b816b2a2749aac98d
TLSH
T1C5F05C7A700B9A4F042604E1515BCD48D2A4C65073BA7CF2A0EACE05F763044DAF0751
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jiozrd4i.nmt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jiozrd4i.nmt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ffrct_01.ps1

Path C:\Users\Public\ffrct_01.ps1
Size 1KB
SHA256 07fec91f97b1ad84dced3798f572887242657b9900f81e12adfd0a13404b0ef3
MD5 ced8b0d0228b6084c4c842c3989d22b3
SHA1 3b0f1a9d78c0f3cca5d9d9c80c0f75cd3f468cda
SHA512 72cae8f145a8f8223060239be08a74db86a8c94e3689d2846cfbbe622f55dd9b0daeecf057778346761949785a4f3e815bd082132bc65bc64c2e6774a0c804cb
TLSH
T11B3178506AF95608B6B36E04BAFFA592887B7A7D9D39CB4D0000C04E17B1A44CC6BF33
MD5 SHA1 SHA512 TLSH

Submit Download

jfvhl.txt

Path C:\Users\Public\jfvhl.txt
Size 2.1MB
SHA256 184e1a7e02f6cbd26cde371e45816ed0ed85c74dd062cdfb3b2588f8dda74301
MD5 71494b2eaa581e5628eb4a8b00b7ebae
SHA1 7c2a6659913231cec2fa33551d82068fc30332c0
SHA512 fd02e3b1b4fee54bc8b57a3c58a58855036cf7d323f438d673738b71a5680a319adb6078f8f2f7fefdbd930a560b1508994612587b4619bb4b61ff6cd4fddbb1
SSDEEP 3072:L+xnh/MD87BLXGR32YAMvpqGW+AgtvYXaWd2gIyfTdCOB7rdwNTwNoiqaxdf0+ny:Z
TLSH
T1BFA5FF3EDFEC462FC277CD2EC9CA4A03F8590927320DE94664D763A75526183BCA216D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vhsvg.txt

Path \??\c:\users\public\vhsvg.txt
Size 123B
SHA256 8862bfb6ad204f8507959343e7dc828e6cb4a6495e96ef5feeb67784ffd375bf
MD5 6fddde581790abfe7448594bf0473ede
SHA1 0f76dbf907ef097c05bc1582c857d642febe2352
SHA512 4f5b4d155a0d8d862a9882c166f0258ef27cae3a532af3615217f4513251de262b68b9d282e3f0828db344ec1850532a2e0f081c26fe15603ce9abf74a1000a0
TLSH
T1B8B022C22308B0B82B0A28A0A2C8E02880CA00C222F0C0C02B00C3AFBC00A80030038E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/940-1-0x000001ECB4540000-0x000001ECB4550000-memory.dmp

Download

memory/940-0-0x000001ECB4540000-0x000001ECB4550000-memory.dmp

Download

memory/940-9-0x000001ECB4650000-0x000001ECB4672000-memory.dmp

Download

memory/940-12-0x000001ECB4540000-0x000001ECB4550000-memory.dmp

Download

memory/940-11-0x000001ECB4540000-0x000001ECB4550000-memory.dmp

Download

memory/940-10-0x000001ECB4540000-0x000001ECB4550000-memory.dmp

Download

memory/940-28-0x000001ECB4540000-0x000001ECB4550000-memory.dmp

Download

memory/940-29-0x000001ECB4540000-0x000001ECB4550000-memory.dmp

Download

memory/6120-104-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-90-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-30-0x000002342AE30000-0x000002342AE96000-memory.dmp

Download

memory/6120-123-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-125-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-141-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-157-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-155-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-153-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-151-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-149-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-147-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-145-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-143-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-139-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-137-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-135-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-133-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-131-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-129-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-127-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-121-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-119-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-117-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-115-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-114-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-111-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-109-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-107-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-17-0x0000023428970000-0x0000023428980000-memory.dmp

Download

memory/6120-102-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-100-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-98-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-96-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-94-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-18-0x0000023428970000-0x0000023428980000-memory.dmp

Download

memory/6120-88-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-86-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-84-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-82-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-80-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-78-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-74-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-72-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-70-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-68-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-66-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-64-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-62-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-60-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-58-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-57-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-54-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-52-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-50-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-48-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-46-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-44-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-43-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-40-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-38-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-36-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-34-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-32-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-31-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-105-0x0000023428970000-0x0000023428980000-memory.dmp

Download

memory/6120-92-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-76-0x000002342AE30000-0x000002342AE8F000-memory.dmp

Download

memory/6120-1597-0x0000023428970000-0x0000023428980000-memory.dmp

Download

memory/6120-1598-0x0000023428970000-0x0000023428980000-memory.dmp

Download

memory/6120-1600-0x0000023428970000-0x0000023428980000-memory.dmp

Download