e25f9e132406b6530394c0ec2e96c4955f082cf12dda2fe4db11ba645b7d7116

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe
Size 1.8MB
Sample260718-a1pgwsew4v
SHA256 e25f9e132406b6530394c0ec2e96c4955f082cf12dda2fe4db11ba645b7d7116
MD5 f8940a5c1b4aa540133c924964cee12d
SHA1 887d8f74d9f7862de11222c067797a615a3bfc66
SHA512 256c2ad2616149c61b88a8182ac5e00a46e602fa52315b0488f4e449b89cca7151d4bd5371153841f85f7a499fee4b458bb9dceb908dc59b1358d60378e74963
SSDEEP 24576:z0bdXff31XbTuKGanvmKveceTUM7oW8JsU3Aot+Ec0xMkWd0MIGkAjE:z8dXff313uKGanTeceojEd0MIGkAjE
TLSH
T12D95FA83BACB4EE6CEC667B496D343316378FD518B1A5F2F6608C2316D536C5AD4AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs

execution

Visual Basic

T1059.005

pid	Process
1380	WScript.exe
4316	WScript.exe
4244	WScript.exe
5720	WScript.exe
3476	WScript.exe
3116	WScript.exe
5948	WScript.exe
2192	WScript.exe
4748	WScript.exe
5272	WScript.exe
4488	WScript.exe
2240	WScript.exe
5884	WScript.exe
5632	WScript.exe
4932	WScript.exe
3460	WScript.exe
1768	WScript.exe
4952	WScript.exe
2188	WScript.exe
2968	WScript.exe
3760	WScript.exe
4476	WScript.exe
4124	WScript.exe
5224	WScript.exe
5256	WScript.exe
3212	WScript.exe
5952	WScript.exe
1408	WScript.exe
4880	WScript.exe
1076	WScript.exe
1368	WScript.exe
2176	WScript.exe
2416	WScript.exe
5932	WScript.exe
5984	WScript.exe
4576	WScript.exe
1044	WScript.exe
3736	WScript.exe
4224	WScript.exe
4884	WScript.exe
4860	WScript.exe
4968	WScript.exe
2124	WScript.exe
5984	WScript.exe
3724	WScript.exe
2532	WScript.exe
6048	WScript.exe
696	WScript.exe
1480	WScript.exe
3672	WScript.exe
3180	WScript.exe
2400	WScript.exe
4512	WScript.exe
5820	WScript.exe
5296	WScript.exe
3712	WScript.exe
4192	WScript.exe
1380	WScript.exe
3452	WScript.exe
4244	WScript.exe
4344	WScript.exe
764	WScript.exe
1900	WScript.exe
1704	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3532	cmd.exe
3328	cmd.exe
4756	cmd.exe
3588	cmd.exe
4148	cmd.exe
3864	cmd.exe
2052	cmd.exe
4020	cmd.exe
2276	cmd.exe
5080	cmd.exe
5644	cmd.exe
1636	cmd.exe
4144	cmd.exe
4152	cmd.exe
3564	cmd.exe
6044	cmd.exe
4840	cmd.exe
4632	cmd.exe
2436	cmd.exe
5100	cmd.exe
4468	cmd.exe
1128	cmd.exe
2960	cmd.exe
3264	cmd.exe
5976	cmd.exe
1224	cmd.exe
5652	cmd.exe
4228	cmd.exe
1896	cmd.exe
4832	cmd.exe
5428	cmd.exe
6108	cmd.exe
5880	cmd.exe
1996	cmd.exe
2876	cmd.exe
2148	cmd.exe
2540	cmd.exe
2320	cmd.exe
4964	cmd.exe
3988	cmd.exe
5108	cmd.exe
3908	cmd.exe
5508	cmd.exe
2976	cmd.exe
3860	cmd.exe
3416	cmd.exe
4592	cmd.exe
4684	cmd.exe
3712	cmd.exe
5024	cmd.exe
5628	cmd.exe
3936	cmd.exe
3224	cmd.exe
3148	cmd.exe
1272	cmd.exe
1600	cmd.exe
3144	cmd.exe
5836	cmd.exe
2852	cmd.exe
4116	cmd.exe
744	cmd.exe
2840	cmd.exe
3276	cmd.exe
4384	cmd.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
2940	taskkill.exe
3380	taskkill.exe
2708	taskkill.exe
4788	taskkill.exe
3632	taskkill.exe
3924	taskkill.exe
4768	taskkill.exe
4548	taskkill.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyCustomFile1\Shell\Open\Command	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MyCustomFile1\Shell\Open\Command\ = "C:\\Windows\\System32\\cmd.exe \"\""	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "MyCustomFile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MyCustomFile\Shell\Open\Command\ = "C:\\Windows\\System32\\cmd.exe \"\""	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyCustomFile2\Shell\Open\Command	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyCustomFile	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyCustomFile1	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dll\ = "MyCustomFile1"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyCustomFile2\Shell\Open	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyCustomFile\Shell	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MyCustomFile2\Shell	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1300	reg.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3380	taskkill.exe
Token: SeDebugPrivilege	2628	whoami.exe
Token: SeShutdownPrivilege	2232	shutdown.exe
Token: SeRemoteShutdownPrivilege	2232	shutdown.exe
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeShutdownPrivilege	2992	shutdown.exe
Token: SeRemoteShutdownPrivilege	2992	shutdown.exe
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeShutdownPrivilege	5084	shutdown.exe
Token: SeRemoteShutdownPrivilege	5084	shutdown.exe
Token: SeDebugPrivilege	3632	taskkill.exe
Token: SeShutdownPrivilege	2016	shutdown.exe
Token: SeRemoteShutdownPrivilege	2016	shutdown.exe
Token: SeDebugPrivilege	3924	taskkill.exe
Token: SeShutdownPrivilege	5324	shutdown.exe
Token: SeRemoteShutdownPrivilege	5324	shutdown.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	4548	taskkill.exe
Token: SeShutdownPrivilege	5224	shutdown.exe
Token: SeRemoteShutdownPrivilege	5224	shutdown.exe
Token: SeDebugPrivilege	2940	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1480	PickerHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 5620	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	88
PID 5620 wrote to memory of 5680	5620	cmd.exe	90
PID 4340 wrote to memory of 1668	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	92
PID 1668 wrote to memory of 3380	1668	cmd.exe	93
PID 4340 wrote to memory of 3544	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	95
PID 3544 wrote to memory of 4144	3544	cmd.exe	96
PID 4340 wrote to memory of 424	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	98
PID 4144 wrote to memory of 3864	4144	cmd.exe	99
PID 3864 wrote to memory of 2628	3864	cmd.exe	100
PID 424 wrote to memory of 696	424	cmd.exe	101
PID 4144 wrote to memory of 3852	4144	cmd.exe	102
PID 3852 wrote to memory of 5896	3852	net.exe	103
PID 4340 wrote to memory of 2564	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	104
PID 2564 wrote to memory of 2232	2564	cmd.exe	105
PID 4340 wrote to memory of 800	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	107
PID 800 wrote to memory of 2708	800	cmd.exe	109
PID 4340 wrote to memory of 3536	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	111
PID 3536 wrote to memory of 4152	3536	cmd.exe	112
PID 4340 wrote to memory of 2052	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	114
PID 2052 wrote to memory of 4020	2052	cmd.exe	115
PID 4340 wrote to memory of 3860	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	117
PID 3860 wrote to memory of 1704	3860	cmd.exe	118
PID 4340 wrote to memory of 1996	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	120
PID 1996 wrote to memory of 4800	1996	cmd.exe	121
PID 4340 wrote to memory of 1896	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	123
PID 1896 wrote to memory of 2276	1896	cmd.exe	124
PID 4340 wrote to memory of 3824	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	125
PID 3824 wrote to memory of 2992	3824	cmd.exe	127
PID 4340 wrote to memory of 4492	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	128
PID 4492 wrote to memory of 5108	4492	cmd.exe	129
PID 4340 wrote to memory of 2408	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	131
PID 2408 wrote to memory of 3148	2408	cmd.exe	132
PID 4340 wrote to memory of 3936	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	135
PID 3936 wrote to memory of 2400	3936	cmd.exe	136
PID 4340 wrote to memory of 4148	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	137
PID 4148 wrote to memory of 4748	4148	cmd.exe	138
PID 4340 wrote to memory of 3224	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	139
PID 3224 wrote to memory of 4576	3224	cmd.exe	140
PID 4340 wrote to memory of 924	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	141
PID 924 wrote to memory of 4316	924	cmd.exe	142
PID 4340 wrote to memory of 1636	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	143
PID 1636 wrote to memory of 3712	1636	cmd.exe	144
PID 4340 wrote to memory of 744	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	145
PID 744 wrote to memory of 5272	744	cmd.exe	146
PID 4340 wrote to memory of 4832	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	147
PID 4832 wrote to memory of 4244	4832	cmd.exe	148
PID 4340 wrote to memory of 2876	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	149
PID 2876 wrote to memory of 1768	2876	cmd.exe	150
PID 4340 wrote to memory of 3816	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	151
PID 3816 wrote to memory of 3688	3816	cmd.exe	152
PID 4340 wrote to memory of 4592	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	153
PID 4592 wrote to memory of 4488	4592	cmd.exe	236
PID 4340 wrote to memory of 4836	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	155
PID 4836 wrote to memory of 2240	4836	cmd.exe	156
PID 4340 wrote to memory of 1224	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	157
PID 1224 wrote to memory of 2124	1224	cmd.exe	158
PID 4340 wrote to memory of 3004	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	159
PID 4340 wrote to memory of 5428	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	160
PID 5428 wrote to memory of 5984	5428	cmd.exe	336
PID 4340 wrote to memory of 6108	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	162
PID 6108 wrote to memory of 3724	6108	cmd.exe	284
PID 4340 wrote to memory of 3588	4340	2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe	164
PID 3588 wrote to memory of 5644	3588	cmd.exe	165
PID 5644 wrote to memory of 1300	5644	cmd.exe	167

C:\Users\Admin\AppData\Local\Temp\2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_f8940a5c1b4aa540133c924964cee12d_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe /t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start include.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K include.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c whoami
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3864
    - - C:\Windows\system32\whoami.exe
        
        whoami
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
  - - C:\Windows\system32\net.exe
      net user dlawbtbf\admin 201211207gyf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3852
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user dlawbtbf\admin 201211207gyf
        5⤵
        
        PID:5896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start password.vbs
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:424
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\password.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown -s -t 40 -c "Äã±»ºË·ÏË®ÈëÇÖÁË£¡"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\system32\shutdown.exe
    shutdown -s -t 40 -c "Äã±»ºË·ÏË®ÈëÇÖÁË£¡"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im wscript.exe /t
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K temp.bat
    3⤵
    - Executes a command shell one-liner
    PID:4152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K temp.bat
    3⤵
    - Executes a command shell one-liner
    PID:4020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K temp.bat
    3⤵
    PID:1704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K temp.bat
    3⤵
    PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K temp.bat
    3⤵
    - Executes a command shell one-liner
    PID:2276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown -a
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\system32\shutdown.exe
    shutdown -a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K temp.bat
    3⤵
    - Executes a command shell one-liner
    PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K temp.bat
    3⤵
    - Executes a command shell one-liner
    PID:3148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.vbs
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp1.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp1.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp1.vbs
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp1.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.vbs
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp1.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp1.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp1.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp1.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp.vbs"
    3⤵
    PID:3688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp1.vbs
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp1.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp1.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp1.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del include.bat
  2⤵
  PID:3004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp1.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp1.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start include2.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K include2.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5644
  - - C:\Windows\system32\reg.exe
      REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im wscript.exe /t
  2⤵
  PID:4532
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start HFS-GYF.bat
  2⤵
  PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K HFS-GYF.bat
    3⤵
    - Executes a command shell one-liner
    PID:3988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start HFS-GYF.bat
  2⤵
  PID:1720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K HFS-GYF.bat
    3⤵
    PID:5560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start HFS-GYF.bat
  2⤵
  - Executes a command shell one-liner
  PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K HFS-GYF.bat
    3⤵
    PID:5952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown -s -t 1000 -c "Äã±»ºË·ÏË®ÈëÇÖÁË£¡"
  2⤵
  PID:784
- - C:\Windows\system32\shutdown.exe
    shutdown -s -t 1000 -c "Äã±»ºË·ÏË®ÈëÇÖÁË£¡"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start HFS-GYF.bat
  2⤵
  - Executes a command shell one-liner
  PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K HFS-GYF.bat
    3⤵
    PID:4400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start HFS-GYF.bat
  2⤵
  PID:2996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K HFS-GYF.bat
    3⤵
    - Executes a command shell one-liner
    PID:4684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe /t
  2⤵
  PID:4044
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp1.vbs
  2⤵
  PID:2788
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp1.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown -a
  2⤵
  PID:2460
- - C:\Windows\system32\shutdown.exe
    shutdown -a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:5836
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Modifies registry class
  PID:1820
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:3908
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  PID:2148
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:5652
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Modifies registry class
  PID:2404
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  PID:3128
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:4228
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  PID:2352
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:2540
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  PID:4632
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:3532
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Modifies registry class
  PID:4372
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Modifies registry class
  PID:2012
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  PID:5772
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Modifies registry class
  PID:5708
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  PID:3328
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Modifies registry class
  PID:6008
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:3712
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:2852
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    PID:2060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  PID:4488
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Modifies registry class
  PID:4052
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Modifies registry class
  PID:4348
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  PID:3564
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:5508
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    PID:5312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:5024
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:5080
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:6044
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Modifies registry class
  PID:2796
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:5628
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:4840
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:2960
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  PID:2004
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Modifies registry class
  PID:4616
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:2840
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  PID:3276
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Modifies registry class
  PID:2828
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  PID:2436
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    PID:1424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:4116
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:2320
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Modifies registry class
  PID:1756
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  PID:5328
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  PID:3060
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  PID:4964
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    PID:3724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Modifies registry class
  PID:4056
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:6048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  PID:4284
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  PID:1456
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:4756
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  PID:5880
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Modifies registry class
  PID:5476
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Error.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:4384
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Error.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im wscript.exe /t
  2⤵
  PID:4216
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown -s -t 1000 -c "Äã±»ºË·ÏË®ÈëÇÖÁË£¡"
  2⤵
  PID:4388
- - C:\Windows\system32\shutdown.exe
    shutdown -s -t 1000 -c "Äã±»ºË·ÏË®ÈëÇÖÁË£¡"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.bat
  2⤵
  - Executes a command shell one-liner
  PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K temp.bat
    3⤵
    - Executes a command shell one-liner
    PID:4468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.bat
  2⤵
  PID:1768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K temp.bat
    3⤵
    - Executes a command shell one-liner
    PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start delete.bat
  2⤵
  PID:5396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K delete.bat
    3⤵
    PID:4160
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im msedge.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4768
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im WeChat.exe /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.bat
  2⤵
  PID:696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K temp.bat
    3⤵
    PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp1.vbs
  2⤵
  PID:5432
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp1.vbs"
    3⤵
    PID:5840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.vbs
  2⤵
  - Modifies registry class
  PID:4192
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp1.vbs
  2⤵
  - Modifies registry class
  PID:4472
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp1.vbs"
    3⤵
    PID:3196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.vbs
  2⤵
  PID:1144
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp1.vbs
  2⤵
  PID:5936
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp1.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.vbs
  2⤵
  - Modifies registry class
  PID:4064
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.vbs
  2⤵
  - Modifies registry class
  PID:5720
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp1.vbs
  2⤵
  - Modifies registry class
  PID:464
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp1.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start temp.vbs
  2⤵
  - Modifies registry class
  PID:616
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\temp.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown -a
  2⤵
  - Executes a command shell one-liner
  PID:2976
- - C:\Windows\system32\shutdown.exe
    shutdown -a
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im wscript.exe /t
  2⤵
  - Executes a command shell one-liner
  PID:1600
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im wscript.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start Shutdown.vbs
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:5976
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Shutdown.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start bad.bat
  2⤵
  - Executes a command shell one-liner
  PID:3144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K bad.bat
    3⤵
    - Executes a command shell one-liner
    - Modifies registry class
    PID:3416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown -s -t 5
  2⤵
  PID:4556
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" ""
    3⤵
    PID:556

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1480

C:\Windows\system32\wlrmdr.exe
-s 120000 -f 2 -t You're about to be signed out -m Äã±»ºË·ÏË®ÈëÇÖÁË£¡ -a 3
1⤵
PID:1044

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Error.vbs

Path C:\Users\Admin\AppData\Local\Temp\Error.vbs
Size 120B
SHA256 85d45c870f38ef01a061ceb7afd0f30a8c36775507e0fc8e4470c5192170ff25
MD5 1a63695aa37dfe03246f4f3f4847abbc
SHA1 b8bbb5a9758d01609a3c5d7d88216895c757f392
SHA512 2a2adbbcc1e9608a46897da412c14790791cc0129442c72e0316083f22363024497b8d45e5824daab37b0aa8817dceff7d8221c2ae8bc96b823bf5a1251d9e60
TLSH
T1CAB0126FF18A5C262755F000109206213084F7A78FB675C2C02E6473A1B1323DB7387F
MD5 SHA1 SHA512 TLSH

Submit Download

HFS-GYF.bat

Path C:\Users\Admin\AppData\Local\Temp\HFS-GYF.bat
Size 266B
SHA256 85f5ddd1f09116baef6aefeebed6eff909843aa5148b751b69e4cc1ec7e20f9d
MD5 231490bf5a44a9822d1faa06b2992a52
SHA1 e8b55a307f3b7848b9257767f4e8241054bc016e
SHA512 f4fecf7d2b9aa8e9834cc8fb879ec6b3a73164c617c4bcece0f3b603d5b519fd6145d9425fe3c605561591339d609c72759bf12dd0e689402cf0a3010c6dd7b6
TLSH
T19DD09221BE98A44019857777EDBF800DB004C3B3AE056C13363F8932FB003C4316C049
MD5 SHA1 SHA512 TLSH

Submit Download

Shutdown.vbs

Path C:\Users\Admin\AppData\Local\Temp\Shutdown.vbs
Size 30B
SHA256 3075bfa61366e06420990e90b539076885c2774af413e978a9ce77f531ca1895
MD5 3d7b456663b47b1891f148276195780b
SHA1 f9979edde6642243c1a88f793eb6034f6101babf
SHA512 72836a031dc6a8dbe0fa60e9c33de16a1be33b2732fe88d870f0d87266326dc1c89eeec338af220b04a5651b9bb0fd45c48df7ae0767ac31368f9dacaf185e30
MD5 SHA1 SHA512

Submit Download

bad.bat

Path C:\Users\Admin\AppData\Local\Temp\bad.bat
Size 238B
SHA256 483066c5ec34389c5cc6322b57e18941ca9a236beacf31578f4cd52ad1f2d2d2
MD5 20314c7ea2865a587a45248c4118e9ef
SHA1 5e7cc9279bee39b12a3e585de89d6d093d4ae636
SHA512 65ca8978555261fbf7091978a13cacc9e91a1b0563d1b435fe00a08cb93a4fc42869e9df67ec5e84eb5607934ffec00549a3abfca121d6bfd215dcce8143e872
TLSH
T1C5D06CDA963D92E68CE81A64919D4132921BE247AA09F22D41422058D9A8B060D226FE
MD5 SHA1 SHA512 TLSH

Submit Download

delete.bat

Path C:\Users\Admin\AppData\Local\Temp\delete.bat
Size 180B
SHA256 d020f75311258b9595e22fd7293a8d524640ec56c1ea375cf2229a70bf7265ab
MD5 575eca2451e2dde83f743ab25ba77133
SHA1 d0b627cc1df08a9235072b46483752b10e27292f
SHA512 192cd6d8228f89f44952df976a461e19b9a96b5cbaebabb15eabf81b5c0b272a4a2ce33927e31a4b9653de8b857fedf2df63f98f1affc1d0f47b75d469732540
TLSH
T106C012318E06C1D2A7A671D25348AC03D43AD8AEA4A40623B209796270C0A1C911B6D9
MD5 SHA1 SHA512 TLSH

Submit Download

include.bat

Path C:\Users\Admin\AppData\Local\Temp\include.bat
Size 120B
SHA256 f94fdcb2f04465c18a827dfa02cd00a520b3d0e29bf52f582e823775749f062c
MD5 ebf07169e2d84183e5c757a3ee87b733
SHA1 69de63d575aa474a19c5a2ced56d65e80b82916b
SHA512 ce80ed15a372d75a012a7c6ca4d86c596c3bac893a36a0ddd1719e1208e771c000a5a09a54bcf57c2d68d8e2343ea93785919dd1e0d6fe3a76a2756c69dbfb21
TLSH
T17DB092AA84EE328B67E78DE2AAA08E443B4E6184084197D4121582A1ECC832A6B55963
MD5 SHA1 SHA512 TLSH

Submit Download

include2.bat

Path C:\Users\Admin\AppData\Local\Temp\include2.bat
Size 115B
SHA256 15fa3b6ec3ca133f86e5fd429eced825ff6d85c3dbf0535378316c436c8924af
MD5 2f998dd98b5c61e6640533a72c66535a
SHA1 593362dcf0e47dfc69bdbe257a4f37a493a29933
SHA512 b4b16ef70cd50e4726c1585b2a14a3c9c6f748e25a770fb48a59210ab0c1364f6833665ede1bef3054c46fa34a59ca164ded23081e1838adda37bf93838f1162
TLSH
T1DAB09260200996A6E2A2BA24104FA5128BBA238F6012A696199A202E441B589C2B8AD6
MD5 SHA1 SHA512 TLSH

Submit Download

password.vbs

Path C:\Users\Admin\AppData\Local\Temp\password.vbs
Size 68B
SHA256 852dfd6577fa4609157ccc470306cf9262fbc5c235845bd7865f0a6fd159edab
MD5 eaea66c21e0bc026a15053637cc6ec72
SHA1 a2d2d771fcd9872d78ed4b707bc79d9c412f4a9a
SHA512 6e1195dcc83bb4ad7741b5ae12128ea366357a31f7844417dc3ddceac20081b4254f6a6c5ebdb788f2d77b2c325ab7b260d9496607ce410faaf0798f6b31fe82
TLSH
T1B2A00298FA394BC2A158C5E52281E01820A5693983D9962BF7C623149D7106018B92BB
MD5 SHA1 SHA512 TLSH

Submit Download

temp.bat

Path C:\Users\Admin\AppData\Local\Temp\temp.bat
Size 116B
SHA256 a81559acc9b88fbbc23afdd0574a7a69fa69f3aea77b3693841d5e60f7ee9e8c
MD5 3b2d981212fd0b1c5e9832ea2e35a963
SHA1 305ad002409d428e2fb5d85932f81f4d29738f1a
SHA512 a1c08ba80eb156ae6863c95dfff10a7a1d8d82b1e8f54f944bf488b7047330364eebc568a561a43ed40789456868151460c381b2dd8aa13c2cc71640b7e080f8
TLSH
T10DB01281D7440044CF5F08028E761F21720574CF4015BC3F3F432320C4881B0A70C49E
MD5 SHA1 SHA512 TLSH

Submit Download

temp.vbs

Path C:\Users\Admin\AppData\Local\Temp\temp.vbs
Size 48B
SHA256 49a703a4f7899ef47087b10136e5a642cdc78266fa6e3ae2270d4d7f830141c8
MD5 adf3e089d7ea58f94780b1b097708c5a
SHA1 e5637de35269519a0257c5e2246e1ba02fc2d3dc
SHA512 4ed88704471ea5471fbf977286bd54aa241b345c867c1b6fac51ae1148b2f82fa03d9885b86b2046522328eb03122a392861d6c00b114749e84f411cb3d0241e
MD5 SHA1 SHA512

Submit Download

memory/4340-13-0x0000000000400000-0x0000000000500000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads