1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe
Size 270KB
Sample260820-knd6hashqb
SHA256 1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0
MD5 bfeeaae9f58840e8e5073f5d2ed08006
SHA1 a4c1ac73fbf82d20d7531a6d69cc7fe3ae43fb99
SHA512 bf32cdc39f49fa3c7462eca4a2683d0a56d9bfeb02cc797361d3de58ba87f3fba76d2423a374a52bb58174bf395ef98c50b083ce30b53629932f3b004e36b58b
SSDEEP 3072:BdE25hRKNkkSdp/2htmaGGGRMoM8xV61FzH:BdE1NY0bm7GzH
TLSH
T18D4421B8A6A533E2FD0A93397A3F75A4F20F349731069A5503CB9F28AD47D584F28D11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (110) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 64 IoCs

pid	Process
5680	8qjb3m.exe
3424	3m02gn.exe
2780	bphe3y.exe
5312	8imnj5.exe
4376	13y9tg.exe
7152	y6ayn4.exe
1068	9d14gm.exe
2904	vzfg7m.exe
6784	rj5dcr.exe
6124	5a7piv.exe
7100	fd81sp.exe
3384	tnz30t.exe
1296	gracvj.exe
3044	p1tvx2.exe
7124	pcfccn.exe
1912	cj4jah.exe
5180	zo6rqo.exe
2036	qngwbi.exe
5448	bbmbl9.exe
7036	pra7ud.exe
1848	jp0i4l.exe
3524	4vx21j.exe
4544	v5er91.exe
6520	b1xxst.exe
2424	s1b6h3.exe
2120	hjlz47.exe
7072	b498c7.exe
6496	khywvx.exe
6392	l13j9t.exe
4268	6bmzpo.exe
6436	psc8je.exe
2564	23bz6b.exe
6012	4rx49o.exe
3264	lehigd.exe
524	1eqvjc.exe
592	tmkzca.exe
2320	js0nhw.exe
3124	cn0qmk.exe
3228	1gls9f.exe
544	i5ajer.exe
6668	ksbca1.exe
6572	ycgk68.exe
4200	hf371l.exe
6736	gc8ghy.exe
1584	nm8goq.exe
6536	f8iekl.exe
6828	riej7q.exe
6772	aep3e8.exe
6616	dqcwjj.exe
6308	6lk7bp.exe
5728	ztlz4g.exe
4936	kux91j.exe
3460	eaqo06.exe
1756	p7zaw9.exe
6212	xnib4b.exe
4880	dzdd9h.exe
1596	2bpeoy.exe
2992	d7pqgc.exe
4080	d018hy.exe
2692	c42ukb.exe
5380	ab4xta.exe
5080	q8wbti.exe
2848	0wxzfw.exe
4332	dxv6s1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
7124	pcfccn.exe
6028	uj4uj7.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3224	ipconfig.exe
1924	ipconfig.exe
6880	ipconfig.exe
6352	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe
4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe
5680	8qjb3m.exe
5680	8qjb3m.exe
3424	3m02gn.exe
3424	3m02gn.exe
2780	bphe3y.exe
2780	bphe3y.exe
5312	8imnj5.exe
5312	8imnj5.exe
4376	13y9tg.exe
4376	13y9tg.exe
7152	y6ayn4.exe
7152	y6ayn4.exe
1068	9d14gm.exe
1068	9d14gm.exe
2904	vzfg7m.exe
2904	vzfg7m.exe
6784	rj5dcr.exe
6784	rj5dcr.exe
6124	5a7piv.exe
6124	5a7piv.exe
7100	fd81sp.exe
7100	fd81sp.exe
3384	tnz30t.exe
3384	tnz30t.exe
1296	gracvj.exe
1296	gracvj.exe
3044	p1tvx2.exe
3044	p1tvx2.exe
7124	pcfccn.exe
7124	pcfccn.exe
1912	cj4jah.exe
1912	cj4jah.exe
5180	zo6rqo.exe
5180	zo6rqo.exe
2036	qngwbi.exe
2036	qngwbi.exe
5448	bbmbl9.exe
5448	bbmbl9.exe
7036	pra7ud.exe
7036	pra7ud.exe
1848	jp0i4l.exe
1848	jp0i4l.exe
3524	4vx21j.exe
3524	4vx21j.exe
4544	v5er91.exe
4544	v5er91.exe
6520	b1xxst.exe
6520	b1xxst.exe
2424	s1b6h3.exe
2424	s1b6h3.exe
2120	hjlz47.exe
2120	hjlz47.exe
7072	b498c7.exe
7072	b498c7.exe
6496	khywvx.exe
6496	khywvx.exe
6392	l13j9t.exe
6392	l13j9t.exe
4268	6bmzpo.exe
4268	6bmzpo.exe
6436	psc8je.exe
6436	psc8je.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 6880	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	90
PID 4160 wrote to memory of 6352	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	92
PID 4160 wrote to memory of 5680	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	94
PID 4160 wrote to memory of 3424	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	95
PID 4160 wrote to memory of 2780	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	96
PID 4160 wrote to memory of 5312	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	97
PID 4160 wrote to memory of 4376	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	99
PID 4160 wrote to memory of 7152	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	100
PID 4160 wrote to memory of 1068	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	101
PID 4160 wrote to memory of 2904	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	102
PID 4160 wrote to memory of 6784	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	103
PID 4160 wrote to memory of 6124	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	104
PID 4160 wrote to memory of 7100	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	105
PID 4160 wrote to memory of 3384	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	106
PID 4160 wrote to memory of 1296	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	107
PID 4160 wrote to memory of 3044	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	108
PID 4160 wrote to memory of 7124	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	109
PID 4160 wrote to memory of 1912	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	110
PID 4160 wrote to memory of 5180	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	111
PID 4160 wrote to memory of 2036	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	112
PID 4160 wrote to memory of 5448	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	113
PID 4160 wrote to memory of 7036	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	114
PID 4160 wrote to memory of 1848	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	115
PID 4160 wrote to memory of 3524	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	116
PID 4160 wrote to memory of 4544	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	117
PID 4160 wrote to memory of 6520	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	118
PID 4160 wrote to memory of 2424	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	119
PID 4160 wrote to memory of 2120	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	120
PID 4160 wrote to memory of 7072	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	121
PID 4160 wrote to memory of 6496	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	122
PID 4160 wrote to memory of 6392	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	123
PID 4160 wrote to memory of 4268	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	124
PID 4160 wrote to memory of 6436	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	125
PID 4160 wrote to memory of 2564	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	126
PID 4160 wrote to memory of 6012	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	127
PID 4160 wrote to memory of 3264	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	128
PID 4160 wrote to memory of 524	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	129
PID 4160 wrote to memory of 592	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	130
PID 4160 wrote to memory of 2320	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	131
PID 4160 wrote to memory of 3124	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	132
PID 4160 wrote to memory of 3228	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	133
PID 4160 wrote to memory of 544	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	134
PID 4160 wrote to memory of 6668	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	135
PID 4160 wrote to memory of 6572	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	136
PID 4160 wrote to memory of 4200	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	137
PID 4160 wrote to memory of 6736	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	138
PID 4160 wrote to memory of 1584	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	139
PID 4160 wrote to memory of 6536	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	140
PID 4160 wrote to memory of 6828	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	141
PID 4160 wrote to memory of 6772	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	142
PID 4160 wrote to memory of 6616	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	143
PID 4160 wrote to memory of 6308	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	144
PID 4160 wrote to memory of 5728	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	145
PID 4160 wrote to memory of 4936	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	146
PID 4160 wrote to memory of 3460	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	147
PID 4160 wrote to memory of 1756	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	148
PID 4160 wrote to memory of 6212	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	149
PID 4160 wrote to memory of 4880	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	150
PID 4160 wrote to memory of 1596	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	151
PID 4160 wrote to memory of 2992	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	152
PID 4160 wrote to memory of 4080	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	153
PID 4160 wrote to memory of 2692	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	154
PID 4160 wrote to memory of 5380	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	155
PID 4160 wrote to memory of 5080	4160	1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe	156

C:\Users\Admin\AppData\Local\Temp\1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe
"C:\Users\Admin\AppData\Local\Temp\1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig.exe /release
  2⤵
  - Gathers network information
  PID:6880
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig.exe /release6
  2⤵
  - Gathers network information
  PID:6352
- C:\Users\Admin\AppData\Local\Temp\8qjb3m.exe
  "C:\Users\Admin\AppData\Local\Temp\8qjb3m.exe" "C:\Users\Admin\Desktop\ApproveAdd.scf" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5680
- C:\Users\Admin\AppData\Local\Temp\3m02gn.exe
  "C:\Users\Admin\AppData\Local\Temp\3m02gn.exe" "C:\Users\Admin\Desktop\ApproveDebug.jfif" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- C:\Users\Admin\AppData\Local\Temp\bphe3y.exe
  "C:\Users\Admin\AppData\Local\Temp\bphe3y.exe" "C:\Users\Admin\Desktop\ClearDebug.M2TS" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2780
- C:\Users\Admin\AppData\Local\Temp\8imnj5.exe
  "C:\Users\Admin\AppData\Local\Temp\8imnj5.exe" "C:\Users\Admin\Desktop\CompressGet.docx" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5312
- C:\Users\Admin\AppData\Local\Temp\13y9tg.exe
  "C:\Users\Admin\AppData\Local\Temp\13y9tg.exe" "C:\Users\Admin\Desktop\ConfirmInitialize.js" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Users\Admin\AppData\Local\Temp\y6ayn4.exe
  "C:\Users\Admin\AppData\Local\Temp\y6ayn4.exe" "C:\Users\Admin\Desktop\ConnectSwitch.001" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:7152
- C:\Users\Admin\AppData\Local\Temp\9d14gm.exe
  "C:\Users\Admin\AppData\Local\Temp\9d14gm.exe" "C:\Users\Admin\Desktop\ConvertJoin.avi" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1068
- C:\Users\Admin\AppData\Local\Temp\vzfg7m.exe
  "C:\Users\Admin\AppData\Local\Temp\vzfg7m.exe" "C:\Users\Admin\Desktop\CopySend.pot" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- C:\Users\Admin\AppData\Local\Temp\rj5dcr.exe
  "C:\Users\Admin\AppData\Local\Temp\rj5dcr.exe" "C:\Users\Admin\Desktop\ExpandConvertFrom.docx" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6784
- C:\Users\Admin\AppData\Local\Temp\5a7piv.exe
  "C:\Users\Admin\AppData\Local\Temp\5a7piv.exe" "C:\Users\Admin\Desktop\LockEnter.TS" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6124
- C:\Users\Admin\AppData\Local\Temp\fd81sp.exe
  "C:\Users\Admin\AppData\Local\Temp\fd81sp.exe" "C:\Users\Admin\Desktop\LockExpand.avi" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:7100
- C:\Users\Admin\AppData\Local\Temp\tnz30t.exe
  "C:\Users\Admin\AppData\Local\Temp\tnz30t.exe" "C:\Users\Admin\Desktop\MoveRestart.potx" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- C:\Users\Admin\AppData\Local\Temp\gracvj.exe
  "C:\Users\Admin\AppData\Local\Temp\gracvj.exe" "C:\Users\Admin\Desktop\OptimizeSuspend.ppt" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1296
- C:\Users\Admin\AppData\Local\Temp\p1tvx2.exe
  "C:\Users\Admin\AppData\Local\Temp\p1tvx2.exe" "C:\Users\Admin\Desktop\OutStop.mp3" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3044
- C:\Users\Admin\AppData\Local\Temp\pcfccn.exe
  "C:\Users\Admin\AppData\Local\Temp\pcfccn.exe" "C:\Users\Admin\Desktop\PingCompare.docm" -child
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:7124
- C:\Users\Admin\AppData\Local\Temp\cj4jah.exe
  "C:\Users\Admin\AppData\Local\Temp\cj4jah.exe" "C:\Users\Admin\Desktop\PopClose.jpe" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\zo6rqo.exe
  "C:\Users\Admin\AppData\Local\Temp\zo6rqo.exe" "C:\Users\Admin\Desktop\PushCompress.ocx" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5180
- C:\Users\Admin\AppData\Local\Temp\qngwbi.exe
  "C:\Users\Admin\AppData\Local\Temp\qngwbi.exe" "C:\Users\Admin\Desktop\ReadCheckpoint.rle" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2036
- C:\Users\Admin\AppData\Local\Temp\bbmbl9.exe
  "C:\Users\Admin\AppData\Local\Temp\bbmbl9.exe" "C:\Users\Admin\Desktop\ReceiveBlock.jfif" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5448
- C:\Users\Admin\AppData\Local\Temp\pra7ud.exe
  "C:\Users\Admin\AppData\Local\Temp\pra7ud.exe" "C:\Users\Admin\Desktop\ReceiveInvoke.xlsx" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:7036
- C:\Users\Admin\AppData\Local\Temp\jp0i4l.exe
  "C:\Users\Admin\AppData\Local\Temp\jp0i4l.exe" "C:\Users\Admin\Desktop\ReceiveMeasure.xls" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Users\Admin\AppData\Local\Temp\4vx21j.exe
  "C:\Users\Admin\AppData\Local\Temp\4vx21j.exe" "C:\Users\Admin\Desktop\RemoveWait.mpeg3" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3524
- C:\Users\Admin\AppData\Local\Temp\v5er91.exe
  "C:\Users\Admin\AppData\Local\Temp\v5er91.exe" "C:\Users\Admin\Desktop\RequestResize.emz" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Users\Admin\AppData\Local\Temp\b1xxst.exe
  "C:\Users\Admin\AppData\Local\Temp\b1xxst.exe" "C:\Users\Admin\Desktop\RequestWrite.pot" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6520
- C:\Users\Admin\AppData\Local\Temp\s1b6h3.exe
  "C:\Users\Admin\AppData\Local\Temp\s1b6h3.exe" "C:\Users\Admin\Desktop\RestoreClose.TTS" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- C:\Users\Admin\AppData\Local\Temp\hjlz47.exe
  "C:\Users\Admin\AppData\Local\Temp\hjlz47.exe" "C:\Users\Admin\Desktop\RevokeExit.wmf" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2120
- C:\Users\Admin\AppData\Local\Temp\b498c7.exe
  "C:\Users\Admin\AppData\Local\Temp\b498c7.exe" "C:\Users\Admin\Desktop\SuspendDismount.html" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:7072
- C:\Users\Admin\AppData\Local\Temp\khywvx.exe
  "C:\Users\Admin\AppData\Local\Temp\khywvx.exe" "C:\Users\Admin\Desktop\UndoInstall.mpeg2" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6496
- C:\Users\Admin\AppData\Local\Temp\l13j9t.exe
  "C:\Users\Admin\AppData\Local\Temp\l13j9t.exe" "C:\Users\Admin\Desktop\UndoRepair.xlsx" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6392
- C:\Users\Admin\AppData\Local\Temp\6bmzpo.exe
  "C:\Users\Admin\AppData\Local\Temp\6bmzpo.exe" "C:\Users\Admin\Desktop\UnpublishEdit.jpeg" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4268
- C:\Users\Admin\AppData\Local\Temp\psc8je.exe
  "C:\Users\Admin\AppData\Local\Temp\psc8je.exe" "C:\Users\Admin\Desktop\UpdateRestart.ps1" -child
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6436
- C:\Users\Admin\AppData\Local\Temp\23bz6b.exe
  "C:\Users\Admin\AppData\Local\Temp\23bz6b.exe" "C:\Users\Admin\Desktop\WatchHide.vsdm" -child
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\4rx49o.exe
  "C:\Users\Admin\AppData\Local\Temp\4rx49o.exe" "C:\Users\Admin\Desktop\WatchMount.mp2" -child
  2⤵
  - Executes dropped EXE
  PID:6012
- C:\Users\Admin\AppData\Local\Temp\lehigd.exe
  "C:\Users\Admin\AppData\Local\Temp\lehigd.exe" "C:\Users\Admin\Documents\ClearSend.xlsx" -child
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Users\Admin\AppData\Local\Temp\1eqvjc.exe
  "C:\Users\Admin\AppData\Local\Temp\1eqvjc.exe" "C:\Users\Admin\Documents\ClosePop.pptx" -child
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Users\Admin\AppData\Local\Temp\tmkzca.exe
  "C:\Users\Admin\AppData\Local\Temp\tmkzca.exe" "C:\Users\Admin\Documents\CompleteTrace.xlsx" -child
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Users\Admin\AppData\Local\Temp\js0nhw.exe
  "C:\Users\Admin\AppData\Local\Temp\js0nhw.exe" "C:\Users\Admin\Documents\ConvertFromUninstall.potm" -child
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Users\Admin\AppData\Local\Temp\cn0qmk.exe
  "C:\Users\Admin\AppData\Local\Temp\cn0qmk.exe" "C:\Users\Admin\Documents\ConvertToGrant.wps" -child
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Users\Admin\AppData\Local\Temp\1gls9f.exe
  "C:\Users\Admin\AppData\Local\Temp\1gls9f.exe" "C:\Users\Admin\Documents\ConvertToMeasure.xps" -child
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Users\Admin\AppData\Local\Temp\i5ajer.exe
  "C:\Users\Admin\AppData\Local\Temp\i5ajer.exe" "C:\Users\Admin\Documents\ConvertToUnregister.vstx" -child
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Users\Admin\AppData\Local\Temp\ksbca1.exe
  "C:\Users\Admin\AppData\Local\Temp\ksbca1.exe" "C:\Users\Admin\Documents\DisconnectStart.dot" -child
  2⤵
  - Executes dropped EXE
  PID:6668
- C:\Users\Admin\AppData\Local\Temp\ycgk68.exe
  "C:\Users\Admin\AppData\Local\Temp\ycgk68.exe" "C:\Users\Admin\Documents\ExportAssert.dotx" -child
  2⤵
  - Executes dropped EXE
  PID:6572
- C:\Users\Admin\AppData\Local\Temp\hf371l.exe
  "C:\Users\Admin\AppData\Local\Temp\hf371l.exe" "C:\Users\Admin\Documents\GrantFormat.ppsx" -child
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Users\Admin\AppData\Local\Temp\gc8ghy.exe
  "C:\Users\Admin\AppData\Local\Temp\gc8ghy.exe" "C:\Users\Admin\Documents\LimitBlock.dotm" -child
  2⤵
  - Executes dropped EXE
  PID:6736
- C:\Users\Admin\AppData\Local\Temp\nm8goq.exe
  "C:\Users\Admin\AppData\Local\Temp\nm8goq.exe" "C:\Users\Admin\Documents\LimitWait.pub" -child
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Users\Admin\AppData\Local\Temp\f8iekl.exe
  "C:\Users\Admin\AppData\Local\Temp\f8iekl.exe" "C:\Users\Admin\Documents\LockMerge.mhtml" -child
  2⤵
  - Executes dropped EXE
  PID:6536
- C:\Users\Admin\AppData\Local\Temp\riej7q.exe
  "C:\Users\Admin\AppData\Local\Temp\riej7q.exe" "C:\Users\Admin\Documents\LockPush.potm" -child
  2⤵
  - Executes dropped EXE
  PID:6828
- C:\Users\Admin\AppData\Local\Temp\aep3e8.exe
  "C:\Users\Admin\AppData\Local\Temp\aep3e8.exe" "C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2" -child
  2⤵
  - Executes dropped EXE
  PID:6772
- C:\Users\Admin\AppData\Local\Temp\dqcwjj.exe
  "C:\Users\Admin\AppData\Local\Temp\dqcwjj.exe" "C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Quick Notes.one" -child
  2⤵
  - Executes dropped EXE
  PID:6616
- C:\Users\Admin\AppData\Local\Temp\6lk7bp.exe
  "C:\Users\Admin\AppData\Local\Temp\6lk7bp.exe" "C:\Users\Admin\Documents\OneNote Notebooks\Quick Notes.one" -child
  2⤵
  - Executes dropped EXE
  PID:6308
- C:\Users\Admin\AppData\Local\Temp\ztlz4g.exe
  "C:\Users\Admin\AppData\Local\Temp\ztlz4g.exe" "C:\Users\Admin\Documents\OptimizeFormat.vdw" -child
  2⤵
  - Executes dropped EXE
  PID:5728
- C:\Users\Admin\AppData\Local\Temp\kux91j.exe
  "C:\Users\Admin\AppData\Local\Temp\kux91j.exe" "C:\Users\Admin\Documents\Outlook Files\Outlook Data File - yxlzksmurw.pst" -child
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Users\Admin\AppData\Local\Temp\eaqo06.exe
  "C:\Users\Admin\AppData\Local\Temp\eaqo06.exe" "C:\Users\Admin\Documents\RegisterOpen.mpp" -child
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Users\Admin\AppData\Local\Temp\p7zaw9.exe
  "C:\Users\Admin\AppData\Local\Temp\p7zaw9.exe" "C:\Users\Admin\Documents\RequestSave.xlsx" -child
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Users\Admin\AppData\Local\Temp\xnib4b.exe
  "C:\Users\Admin\AppData\Local\Temp\xnib4b.exe" "C:\Users\Admin\Documents\ResolveCopy.csv" -child
  2⤵
  - Executes dropped EXE
  PID:6212
- C:\Users\Admin\AppData\Local\Temp\dzdd9h.exe
  "C:\Users\Admin\AppData\Local\Temp\dzdd9h.exe" "C:\Users\Admin\Documents\RevokeConvertFrom.vsx" -child
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Users\Admin\AppData\Local\Temp\2bpeoy.exe
  "C:\Users\Admin\AppData\Local\Temp\2bpeoy.exe" "C:\Users\Admin\Documents\SendCompress.xps" -child
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Users\Admin\AppData\Local\Temp\d7pqgc.exe
  "C:\Users\Admin\AppData\Local\Temp\d7pqgc.exe" "C:\Users\Admin\Documents\ShowGrant.docx" -child
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Users\Admin\AppData\Local\Temp\d018hy.exe
  "C:\Users\Admin\AppData\Local\Temp\d018hy.exe" "C:\Users\Admin\Documents\SwitchSync.docx" -child
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Users\Admin\AppData\Local\Temp\c42ukb.exe
  "C:\Users\Admin\AppData\Local\Temp\c42ukb.exe" "C:\Users\Admin\Documents\SyncSwitch.xlsx" -child
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\ab4xta.exe
  "C:\Users\Admin\AppData\Local\Temp\ab4xta.exe" "C:\Users\Admin\Documents\TestUnprotect.mhtml" -child
  2⤵
  - Executes dropped EXE
  PID:5380
- C:\Users\Admin\AppData\Local\Temp\q8wbti.exe
  "C:\Users\Admin\AppData\Local\Temp\q8wbti.exe" "C:\Users\Admin\Documents\UninstallPublish.ppt" -child
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Users\Admin\AppData\Local\Temp\0wxzfw.exe
  "C:\Users\Admin\AppData\Local\Temp\0wxzfw.exe" "C:\Users\Admin\Pictures\BackupWrite.dxf" -child
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Users\Admin\AppData\Local\Temp\dxv6s1.exe
  "C:\Users\Admin\AppData\Local\Temp\dxv6s1.exe" "C:\Users\Admin\Pictures\EnterSplit.dib" -child
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Users\Admin\AppData\Local\Temp\kijwq0.exe
  "C:\Users\Admin\AppData\Local\Temp\kijwq0.exe" "C:\Users\Admin\Pictures\ifmL.jpg" -child
  2⤵
  PID:3896
- C:\Users\Admin\AppData\Local\Temp\rfkfn3.exe
  "C:\Users\Admin\AppData\Local\Temp\rfkfn3.exe" "C:\Users\Admin\Pictures\LimitReset.dib" -child
  2⤵
  PID:5504
- C:\Users\Admin\AppData\Local\Temp\l0s4hw.exe
  "C:\Users\Admin\AppData\Local\Temp\l0s4hw.exe" "C:\Users\Admin\Pictures\NewUninstall.pcx" -child
  2⤵
  PID:4840
- C:\Users\Admin\AppData\Local\Temp\15w30h.exe
  "C:\Users\Admin\AppData\Local\Temp\15w30h.exe" "C:\Users\Admin\Pictures\ProtectRepair.dwg" -child
  2⤵
  PID:3928
- C:\Users\Admin\AppData\Local\Temp\1frkdn.exe
  "C:\Users\Admin\AppData\Local\Temp\1frkdn.exe" "C:\Users\Admin\Pictures\PublishEnter.svgz" -child
  2⤵
  PID:4824
- C:\Users\Admin\AppData\Local\Temp\es6xjb.exe
  "C:\Users\Admin\AppData\Local\Temp\es6xjb.exe" "C:\Users\Admin\Pictures\PublishNew.dxf" -child
  2⤵
  PID:4052
- C:\Users\Admin\AppData\Local\Temp\jiu31t.exe
  "C:\Users\Admin\AppData\Local\Temp\jiu31t.exe" "C:\Users\Admin\Pictures\ReadGroup.raw" -child
  2⤵
  PID:2388
- C:\Users\Admin\AppData\Local\Temp\oe6xbf.exe
  "C:\Users\Admin\AppData\Local\Temp\oe6xbf.exe" "C:\Users\Admin\Pictures\UninstallEdit.tif" -child
  2⤵
  PID:5756
- C:\Users\Admin\AppData\Local\Temp\12cj8t.exe
  "C:\Users\Admin\AppData\Local\Temp\12cj8t.exe" "C:\Users\Admin\Pictures\UnpublishResolve.bmp" -child
  2⤵
  PID:3120
- C:\Users\Admin\AppData\Local\Temp\faeh6r.exe
  "C:\Users\Admin\AppData\Local\Temp\faeh6r.exe" "C:\Users\Admin\Downloads\AddFind.ps1xml" -child
  2⤵
  PID:2288
- C:\Users\Admin\AppData\Local\Temp\jrmfos.exe
  "C:\Users\Admin\AppData\Local\Temp\jrmfos.exe" "C:\Users\Admin\Downloads\BackupCheckpoint.wav" -child
  2⤵
  PID:5884
- C:\Users\Admin\AppData\Local\Temp\c2nhjg.exe
  "C:\Users\Admin\AppData\Local\Temp\c2nhjg.exe" "C:\Users\Admin\Downloads\DenySet.tiff" -child
  2⤵
  PID:4564
- C:\Users\Admin\AppData\Local\Temp\q4d4ny.exe
  "C:\Users\Admin\AppData\Local\Temp\q4d4ny.exe" "C:\Users\Admin\Downloads\DisconnectTest.crw" -child
  2⤵
  PID:5104
- C:\Users\Admin\AppData\Local\Temp\vcwvrr.exe
  "C:\Users\Admin\AppData\Local\Temp\vcwvrr.exe" "C:\Users\Admin\Downloads\EnableGrant.ini" -child
  2⤵
  PID:6936
- C:\Users\Admin\AppData\Local\Temp\ojv0ch.exe
  "C:\Users\Admin\AppData\Local\Temp\ojv0ch.exe" "C:\Users\Admin\Downloads\ExitAssert.css" -child
  2⤵
  PID:3668
- C:\Users\Admin\AppData\Local\Temp\hnr4xz.exe
  "C:\Users\Admin\AppData\Local\Temp\hnr4xz.exe" "C:\Users\Admin\Downloads\GroupMount.xps" -child
  2⤵
  PID:6940
- C:\Users\Admin\AppData\Local\Temp\bbht5v.exe
  "C:\Users\Admin\AppData\Local\Temp\bbht5v.exe" "C:\Users\Admin\Downloads\ImportUnlock.cab" -child
  2⤵
  PID:6108
- C:\Users\Admin\AppData\Local\Temp\uj4uj7.exe
  "C:\Users\Admin\AppData\Local\Temp\uj4uj7.exe" "C:\Users\Admin\Downloads\InvokePing.cab" -child
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6028
- C:\Users\Admin\AppData\Local\Temp\u8v7qf.exe
  "C:\Users\Admin\AppData\Local\Temp\u8v7qf.exe" "C:\Users\Admin\Downloads\InvokeSkip.txt" -child
  2⤵
  PID:5780
- C:\Users\Admin\AppData\Local\Temp\j9dhc5.exe
  "C:\Users\Admin\AppData\Local\Temp\j9dhc5.exe" "C:\Users\Admin\Downloads\MeasureConvertFrom.docx" -child
  2⤵
  PID:1440
- C:\Users\Admin\AppData\Local\Temp\vvqcsd.exe
  "C:\Users\Admin\AppData\Local\Temp\vvqcsd.exe" "C:\Users\Admin\Downloads\MeasureRedo.wdp" -child
  2⤵
  PID:7136
- C:\Users\Admin\AppData\Local\Temp\uvphao.exe
  "C:\Users\Admin\AppData\Local\Temp\uvphao.exe" "C:\Users\Admin\Downloads\MountReceive.odp" -child
  2⤵
  PID:5920
- C:\Users\Admin\AppData\Local\Temp\kp1jum.exe
  "C:\Users\Admin\AppData\Local\Temp\kp1jum.exe" "C:\Users\Admin\Downloads\MoveProtect.vsx" -child
  2⤵
  PID:3232
- C:\Users\Admin\AppData\Local\Temp\98xmsc.exe
  "C:\Users\Admin\AppData\Local\Temp\98xmsc.exe" "C:\Users\Admin\Downloads\OptimizeInitialize.rm" -child
  2⤵
  PID:5964
- C:\Users\Admin\AppData\Local\Temp\f66afa.exe
  "C:\Users\Admin\AppData\Local\Temp\f66afa.exe" "C:\Users\Admin\Downloads\OutStep.pub" -child
  2⤵
  PID:2512
- C:\Users\Admin\AppData\Local\Temp\9k8et0.exe
  "C:\Users\Admin\AppData\Local\Temp\9k8et0.exe" "C:\Users\Admin\Downloads\PopCopy.3g2" -child
  2⤵
  PID:1224
- C:\Users\Admin\AppData\Local\Temp\uez7we.exe
  "C:\Users\Admin\AppData\Local\Temp\uez7we.exe" "C:\Users\Admin\Downloads\ProtectOptimize.crw" -child
  2⤵
  PID:2820
- C:\Users\Admin\AppData\Local\Temp\9dpf83.exe
  "C:\Users\Admin\AppData\Local\Temp\9dpf83.exe" "C:\Users\Admin\Downloads\ReceivePublish.reg" -child
  2⤵
  PID:4284
- C:\Users\Admin\AppData\Local\Temp\q3em7x.exe
  "C:\Users\Admin\AppData\Local\Temp\q3em7x.exe" "C:\Users\Admin\Downloads\RemoveSelect.wmv" -child
  2⤵
  PID:4048
- C:\Users\Admin\AppData\Local\Temp\fp7m9a.exe
  "C:\Users\Admin\AppData\Local\Temp\fp7m9a.exe" "C:\Users\Admin\Downloads\RepairClose.jtx" -child
  2⤵
  PID:2212
- C:\Users\Admin\AppData\Local\Temp\2lpxm5.exe
  "C:\Users\Admin\AppData\Local\Temp\2lpxm5.exe" "C:\Users\Admin\Downloads\ResizeConfirm.dib" -child
  2⤵
  PID:6120
- C:\Users\Admin\AppData\Local\Temp\ukzo89.exe
  "C:\Users\Admin\AppData\Local\Temp\ukzo89.exe" "C:\Users\Admin\Downloads\ResizeUnblock.jfif" -child
  2⤵
  PID:5736
- C:\Users\Admin\AppData\Local\Temp\1gytm8.exe
  "C:\Users\Admin\AppData\Local\Temp\1gytm8.exe" "C:\Users\Admin\Downloads\RestartClear.css" -child
  2⤵
  PID:200
- C:\Users\Admin\AppData\Local\Temp\542d3p.exe
  "C:\Users\Admin\AppData\Local\Temp\542d3p.exe" "C:\Users\Admin\Downloads\RestoreRestart.xlsx" -child
  2⤵
  PID:3488
- C:\Users\Admin\AppData\Local\Temp\xzqk41.exe
  "C:\Users\Admin\AppData\Local\Temp\xzqk41.exe" "C:\Users\Admin\Downloads\RestoreSend.avi" -child
  2⤵
  PID:4828
- C:\Users\Admin\AppData\Local\Temp\eulo38.exe
  "C:\Users\Admin\AppData\Local\Temp\eulo38.exe" "C:\Users\Admin\Downloads\SaveRestore.vsdx" -child
  2⤵
  PID:4484
- C:\Users\Admin\AppData\Local\Temp\lplcha.exe
  "C:\Users\Admin\AppData\Local\Temp\lplcha.exe" "C:\Users\Admin\Downloads\SearchDisconnect.eprtx" -child
  2⤵
  PID:1108
- C:\Users\Admin\AppData\Local\Temp\lbf3gh.exe
  "C:\Users\Admin\AppData\Local\Temp\lbf3gh.exe" "C:\Users\Admin\Downloads\SetFormat.wax" -child
  2⤵
  PID:3192
- C:\Users\Admin\AppData\Local\Temp\bpm2p9.exe
  "C:\Users\Admin\AppData\Local\Temp\bpm2p9.exe" "C:\Users\Admin\Downloads\SkipAdd.xlsm" -child
  2⤵
  PID:5616
- C:\Users\Admin\AppData\Local\Temp\zlve4g.exe
  "C:\Users\Admin\AppData\Local\Temp\zlve4g.exe" "C:\Users\Admin\Downloads\SplitSearch.nfo" -child
  2⤵
  PID:5620
- C:\Users\Admin\AppData\Local\Temp\1sagpq.exe
  "C:\Users\Admin\AppData\Local\Temp\1sagpq.exe" "C:\Users\Admin\Downloads\SplitUnlock.jfif" -child
  2⤵
  PID:1232
- C:\Users\Admin\AppData\Local\Temp\ivttwx.exe
  "C:\Users\Admin\AppData\Local\Temp\ivttwx.exe" "C:\Users\Admin\Downloads\StepSuspend.001" -child
  2⤵
  PID:4548
- C:\Users\Admin\AppData\Local\Temp\ckugcw.exe
  "C:\Users\Admin\AppData\Local\Temp\ckugcw.exe" "C:\Users\Admin\Downloads\StopUpdate.au" -child
  2⤵
  PID:5364
- C:\Users\Admin\AppData\Local\Temp\6tbfoa.exe
  "C:\Users\Admin\AppData\Local\Temp\6tbfoa.exe" "C:\Users\Admin\Downloads\SuspendGet.htm" -child
  2⤵
  PID:4060
- C:\Users\Admin\AppData\Local\Temp\7vlde9.exe
  "C:\Users\Admin\AppData\Local\Temp\7vlde9.exe" "C:\Users\Admin\Downloads\UnprotectAdd.ps1" -child
  2⤵
  PID:2632
- C:\Users\Admin\AppData\Local\Temp\053ije.exe
  "C:\Users\Admin\AppData\Local\Temp\053ije.exe" "C:\Users\Admin\Downloads\UpdateLimit.zip" -child
  2⤵
  PID:4296
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig.exe /renew
  2⤵
  - Gathers network information
  PID:3224
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig.exe /renew6
  2⤵
  - Gathers network information
  PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8qjb3m.exe

Path C:\Users\Admin\AppData\Local\Temp\8qjb3m.exe
Size 270KB
SHA256 1d5dd6efc6b06ba7403e8dd2f039373883dc6d2677ab5fdf2063a94ed18724d0
MD5 bfeeaae9f58840e8e5073f5d2ed08006
SHA1 a4c1ac73fbf82d20d7531a6d69cc7fe3ae43fb99
SHA512 bf32cdc39f49fa3c7462eca4a2683d0a56d9bfeb02cc797361d3de58ba87f3fba76d2423a374a52bb58174bf395ef98c50b083ce30b53629932f3b004e36b58b
SSDEEP 3072:BdE25hRKNkkSdp/2htmaGGGRMoM8xV61FzH:BdE1NY0bm7GzH
TLSH
T18D4421B8A6A533E2FD0A93397A3F75A4F20F349731069A5503CB9F28AD47D584F28D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download