colibri | 91169afa1085d0402983787772694f1e19f08f62c636683cf73e30cc9299bee8

Analysis

max time kernel
27s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2023 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5779722125.exe
Size

5.7MB
MD5

44e4646b76a889c2115bdacc6e63ba2a
SHA1

efe7c1dae715922ff19121ff4f0e97ca904ee536
SHA256

91169afa1085d0402983787772694f1e19f08f62c636683cf73e30cc9299bee8
SHA512

b4fc6250eb1b250e78571ecab8b301adcbb5f25a4faf42842f95bf8f73c8a3ba5ac2f64190e7f450a738aff4d495816ab9c7b4c894ff04db5754b5561c60717d
SSDEEP

1536:gpyA0Sdf7CwS+1iSpyOVvBkHA/BGGG/DoFVuZB3ZnMALr/pQZw3MIeqVz1iU80hy:gQcYyOx2TsuVxt11oPvZBhYU2

Score

10^/10

colibri build1 evasion loader trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	244	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3236	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3972	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4276	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	3476	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	3476	schtasks.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

5779722125.exefontdrvhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	5779722125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5779722125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	5779722125.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5779722125.exefontdrvhost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	5779722125.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 11 IoCs

Processes:

tmp94C3.tmp.exetmp94C3.tmp.exetmp94C3.tmp.exetmp94C3.tmp.exetmp94C3.tmp.exetmp94C3.tmp.exetmp94C3.tmp.exetmp94C3.tmp.exefontdrvhost.exetmpC1FD.tmp.exetmpC1FD.tmp.exe

pid	process
5108	tmp94C3.tmp.exe
4784	tmp94C3.tmp.exe
3780	tmp94C3.tmp.exe
660	tmp94C3.tmp.exe
3316	tmp94C3.tmp.exe
3572	tmp94C3.tmp.exe
2168	tmp94C3.tmp.exe
1800	tmp94C3.tmp.exe
2192	fontdrvhost.exe
4668	tmpC1FD.tmp.exe
2624	tmpC1FD.tmp.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

fontdrvhost.exe5779722125.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5779722125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5779722125.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

tmp94C3.tmp.exetmpC1FD.tmp.exe

description	pid	process	target process
PID 2168 set thread context of 1800	2168	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 4668 set thread context of 2624	4668	tmpC1FD.tmp.exe	tmpC1FD.tmp.exe

Drops file in Program Files directory 21 IoCs

Processes:

5779722125.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Multimedia Platform\6cb0b6c459d5d3	5779722125.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe	5779722125.exe
File created	C:\Program Files\VideoLAN\VLC\c5b4cb5e9653cc	5779722125.exe
File created	C:\Program Files\Google\5940a34987c991	5779722125.exe
File created	C:\Program Files\Microsoft Office\Office16\StartMenuExperienceHost.exe	5779722125.exe
File created	C:\Program Files\VideoLAN\121e5b5079f7c0	5779722125.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\System.exe	5779722125.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\System.exe	5779722125.exe
File created	C:\Program Files\VideoLAN\VLC\services.exe	5779722125.exe
File created	C:\Program Files\Microsoft Office\Office16\55b276f4edf653	5779722125.exe
File created	C:\Program Files\VideoLAN\sysmon.exe	5779722125.exe
File created	C:\Program Files\Reference Assemblies\fontdrvhost.exe	5779722125.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\services.exe	5779722125.exe
File created	C:\Program Files\Google\dllhost.exe	5779722125.exe
File opened for modification	C:\Program Files\Google\dllhost.exe	5779722125.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\StartMenuExperienceHost.exe	5779722125.exe
File opened for modification	C:\Program Files\Reference Assemblies\fontdrvhost.exe	5779722125.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\27d1bcfc3c54e0	5779722125.exe
File created	C:\Program Files\Reference Assemblies\5b884080fd4f94	5779722125.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe	5779722125.exe
File opened for modification	C:\Program Files\VideoLAN\sysmon.exe	5779722125.exe

Drops file in Windows directory 10 IoCs

Processes:

5779722125.exe

description	ioc	process
File created	C:\Windows\Migration\WTR\services.exe	5779722125.exe
File created	C:\Windows\Boot\explorer.exe	5779722125.exe
File created	C:\Windows\bcastdvr\dwm.exe	5779722125.exe
File created	C:\Windows\bcastdvr\6cb0b6c459d5d3	5779722125.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\Idle.exe	5779722125.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\Idle.exe	5779722125.exe
File opened for modification	C:\Windows\Migration\WTR\services.exe	5779722125.exe
File opened for modification	C:\Windows\bcastdvr\dwm.exe	5779722125.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\6ccacd8608530f	5779722125.exe
File created	C:\Windows\Migration\WTR\c5b4cb5e9653cc	5779722125.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
4188	schtasks.exe
1764	schtasks.exe
4276	schtasks.exe
3496	schtasks.exe
2124	schtasks.exe
3136	schtasks.exe
4480	schtasks.exe
3236	schtasks.exe
2656	schtasks.exe
1392	schtasks.exe
4200	schtasks.exe
4672	schtasks.exe
2220	schtasks.exe
4972	schtasks.exe
3972	schtasks.exe
3464	schtasks.exe
1272	schtasks.exe
4568	schtasks.exe
244	schtasks.exe
4092	schtasks.exe
2696	schtasks.exe
4648	schtasks.exe
3384	schtasks.exe
4780	schtasks.exe
2252	schtasks.exe
4420	schtasks.exe
1504	schtasks.exe
2864	schtasks.exe
3124	schtasks.exe
5008	schtasks.exe
4968	schtasks.exe
4868	schtasks.exe
920	schtasks.exe
3920	schtasks.exe
5004	schtasks.exe
4512	schtasks.exe
2216	schtasks.exe
2816	schtasks.exe
1308	schtasks.exe

Modifies registry class 1 IoCs

Processes:

fontdrvhost.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings fontdrvhost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	fontdrvhost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5779722125.exe

pid	process
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe
4016	5779722125.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

5779722125.exefontdrvhost.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4016	5779722125.exe
Token: SeDebugPrivilege	2192	fontdrvhost.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5779722125.exetmp94C3.tmp.exetmp94C3.tmp.exetmp94C3.tmp.exetmp94C3.tmp.exetmp94C3.tmp.exetmp94C3.tmp.exetmp94C3.tmp.exefontdrvhost.exetmpC1FD.tmp.exe

description	pid	process	target process
PID 4016 wrote to memory of 5108	4016	5779722125.exe	tmp94C3.tmp.exe
PID 4016 wrote to memory of 5108	4016	5779722125.exe	tmp94C3.tmp.exe
PID 4016 wrote to memory of 5108	4016	5779722125.exe	tmp94C3.tmp.exe
PID 5108 wrote to memory of 4784	5108	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 5108 wrote to memory of 4784	5108	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 5108 wrote to memory of 4784	5108	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 4784 wrote to memory of 3780	4784	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 4784 wrote to memory of 3780	4784	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 4784 wrote to memory of 3780	4784	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 3780 wrote to memory of 660	3780	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 3780 wrote to memory of 660	3780	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 3780 wrote to memory of 660	3780	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 660 wrote to memory of 3316	660	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 660 wrote to memory of 3316	660	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 660 wrote to memory of 3316	660	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 3316 wrote to memory of 3572	3316	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 3316 wrote to memory of 3572	3316	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 3316 wrote to memory of 3572	3316	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 3572 wrote to memory of 2168	3572	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 3572 wrote to memory of 2168	3572	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 3572 wrote to memory of 2168	3572	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 2168 wrote to memory of 1800	2168	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 2168 wrote to memory of 1800	2168	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 2168 wrote to memory of 1800	2168	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 2168 wrote to memory of 1800	2168	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 2168 wrote to memory of 1800	2168	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 2168 wrote to memory of 1800	2168	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 2168 wrote to memory of 1800	2168	tmp94C3.tmp.exe	tmp94C3.tmp.exe
PID 4016 wrote to memory of 4192	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 4192	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 2804	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 2804	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 4708	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 4708	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 3276	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 3276	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 4068	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 4068	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 4508	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 4508	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 2472	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 2472	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 1848	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 1848	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 2016	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 2016	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 2728	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 2728	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 3172	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 3172	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 4940	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 4940	4016	5779722125.exe	powershell.exe
PID 4016 wrote to memory of 2192	4016	5779722125.exe	fontdrvhost.exe
PID 4016 wrote to memory of 2192	4016	5779722125.exe	fontdrvhost.exe
PID 2192 wrote to memory of 4668	2192	fontdrvhost.exe	tmpC1FD.tmp.exe
PID 2192 wrote to memory of 4668	2192	fontdrvhost.exe	tmpC1FD.tmp.exe
PID 2192 wrote to memory of 4668	2192	fontdrvhost.exe	tmpC1FD.tmp.exe
PID 4668 wrote to memory of 2624	4668	tmpC1FD.tmp.exe	tmpC1FD.tmp.exe
PID 4668 wrote to memory of 2624	4668	tmpC1FD.tmp.exe	tmpC1FD.tmp.exe
PID 4668 wrote to memory of 2624	4668	tmpC1FD.tmp.exe	tmpC1FD.tmp.exe
PID 4668 wrote to memory of 2624	4668	tmpC1FD.tmp.exe	tmpC1FD.tmp.exe
PID 4668 wrote to memory of 2624	4668	tmpC1FD.tmp.exe	tmpC1FD.tmp.exe
PID 4668 wrote to memory of 2624	4668	tmpC1FD.tmp.exe	tmpC1FD.tmp.exe
PID 4668 wrote to memory of 2624	4668	tmpC1FD.tmp.exe	tmpC1FD.tmp.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

5779722125.exefontdrvhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5779722125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	5779722125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	5779722125.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5779722125.exe
"C:\Users\Admin\AppData\Local\Temp\5779722125.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4016

C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108

C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784

C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780

C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe"
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660

C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe"
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316

C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe"
7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572

C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2168

C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe"
9⤵
- Executes dropped EXE
PID:1800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Program Files\Reference Assemblies\fontdrvhost.exe
"C:\Program Files\Reference Assemblies\fontdrvhost.exe"
2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2192

C:\Users\Admin\AppData\Local\Temp\tmpC1FD.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpC1FD.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4668

C:\Users\Admin\AppData\Local\Temp\tmpC1FD.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpC1FD.tmp.exe"
4⤵
- Executes dropped EXE
PID:2624

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78248941-7d10-4e2a-b9c8-9deb7b1665e2.vbs"
3⤵
PID:4184

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42cbffab-127f-4639-b3aa-fd4497b91eab.vbs"
3⤵
PID:2864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows\Microsoft.NET\assembly\GAC_32\napcrypt\v4.0_10.0.0.0__31bf3856ad364e35\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\VLC\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Google\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Windows\Migration\WTR\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\Migration\WTR\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\Office16\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\Office16\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Windows\bcastdvr\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\bcastdvr\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Windows\bcastdvr\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1308

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Reference Assemblies\fontdrvhost.exe
Filesize
5.7MB

MD5
44e4646b76a889c2115bdacc6e63ba2a

SHA1
efe7c1dae715922ff19121ff4f0e97ca904ee536

SHA256
91169afa1085d0402983787772694f1e19f08f62c636683cf73e30cc9299bee8

SHA512
b4fc6250eb1b250e78571ecab8b301adcbb5f25a4faf42842f95bf8f73c8a3ba5ac2f64190e7f450a738aff4d495816ab9c7b4c894ff04db5754b5561c60717d

Download Submit
C:\Program Files\Reference Assemblies\fontdrvhost.exe
Filesize
5.7MB

MD5
44e4646b76a889c2115bdacc6e63ba2a

SHA1
efe7c1dae715922ff19121ff4f0e97ca904ee536

SHA256
91169afa1085d0402983787772694f1e19f08f62c636683cf73e30cc9299bee8

SHA512
b4fc6250eb1b250e78571ecab8b301adcbb5f25a4faf42842f95bf8f73c8a3ba5ac2f64190e7f450a738aff4d495816ab9c7b4c894ff04db5754b5561c60717d

Download Submit
C:\ProgramData\sppsvc.exe
Filesize
5.7MB

MD5
44e4646b76a889c2115bdacc6e63ba2a

SHA1
efe7c1dae715922ff19121ff4f0e97ca904ee536

SHA256
91169afa1085d0402983787772694f1e19f08f62c636683cf73e30cc9299bee8

SHA512
b4fc6250eb1b250e78571ecab8b301adcbb5f25a4faf42842f95bf8f73c8a3ba5ac2f64190e7f450a738aff4d495816ab9c7b4c894ff04db5754b5561c60717d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\42cbffab-127f-4639-b3aa-fd4497b91eab.vbs
Filesize
505B

MD5
7625fcc84dd1148fb739b2cab6e4d7e5

SHA1
f2fa624445131948e7ca861e82a3ac3f1f90b0f3

SHA256
0485502895497f9df5921c84ca81eb1e15db99ebefb5f6052769190882c73222

SHA512
c9c9cfbed6f22c389cb24f4c40e2d43061422a88a48badffdf55abf33e539f7341407eda4fb8c0ab7f615ec4cdde65d7deecdcd42286caa9e08a5dde3ec3cc7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\78248941-7d10-4e2a-b9c8-9deb7b1665e2.vbs
Filesize
729B

MD5
e68fd5cc6b0a2ae42ea0381dc3d758ec

SHA1
ef3e6b0530c7dd5be4ce9ddf8cabab5f0fb339b5

SHA256
9c672081272a807b88cfc8aa3ed4f4dfa408b329069a1aaa78562b5a9061f7ce

SHA512
c8bf1b031890a1498194f392b620b7e55ddbbfe7089efaf92d097859a46b450e2bbc3ad2c63e0c855dd72aa931b9c405297344c6f5250e550e13e480301b3356

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jqlbblnu.gnq.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp94C3.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC1FD.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC1FD.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC1FD.tmp.exe
Filesize
74KB

MD5
cdd3d44d9e64a113618961f0a4e691b9

SHA1
a762037bc50ddb7507d5ef1a20ce813ad990bb54

SHA256
dbeb4b5ef3a49b4df0bc816a52f875e5aa6ad674aa8e2b458e9736da0b366ec0

SHA512
55146e6464bf74266520341fae0b097ddfea1d6ed7fadf7e0dcf0eba7ac1c29384ad76f245994ea69f68dc85cdcdcb9fc4a2a1eede5db95001dbcd870505a3d8

Download Submit
memory/1800-196-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1800-192-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1848-247-0x0000028C12040000-0x0000028C12050000-memory.dmp

Filesize
64KB

Download
memory/1848-295-0x0000028C12040000-0x0000028C12050000-memory.dmp

Filesize
64KB

Download
memory/2016-325-0x000001F601D10000-0x000001F601D20000-memory.dmp

Filesize
64KB

Download
memory/2016-305-0x000001F601D10000-0x000001F601D20000-memory.dmp

Filesize
64KB

Download
memory/2016-363-0x000001F601D10000-0x000001F601D20000-memory.dmp

Filesize
64KB

Download
memory/2192-416-0x000000001D470000-0x000000001D570000-memory.dmp

Filesize
1024KB

Download
memory/2192-353-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Filesize
64KB

Download
memory/2192-407-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Filesize
64KB

Download
memory/2192-410-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Filesize
64KB

Download
memory/2192-411-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Filesize
64KB

Download
memory/2192-412-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Filesize
64KB

Download
memory/2192-409-0x000000001D470000-0x000000001D570000-memory.dmp

Filesize
1024KB

Download
memory/2192-413-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Filesize
64KB

Download
memory/2192-354-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Filesize
64KB

Download
memory/2192-408-0x000000001D470000-0x000000001D570000-memory.dmp

Filesize
1024KB

Download
memory/2192-365-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Filesize
64KB

Download
memory/2192-414-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Filesize
64KB

Download
memory/2192-415-0x000000001D470000-0x000000001D570000-memory.dmp

Filesize
1024KB

Download
memory/2472-331-0x0000012C9B4B0000-0x0000012C9B4C0000-memory.dmp

Filesize
64KB

Download
memory/2728-364-0x0000028B741D0000-0x0000028B741E0000-memory.dmp

Filesize
64KB

Download
memory/2728-349-0x0000028B741D0000-0x0000028B741E0000-memory.dmp

Filesize
64KB

Download
memory/2804-276-0x000001F1DD9E0000-0x000001F1DD9F0000-memory.dmp

Filesize
64KB

Download
memory/2804-355-0x000001F1DD9E0000-0x000001F1DD9F0000-memory.dmp

Filesize
64KB

Download
memory/3172-350-0x0000020E64EA0000-0x0000020E64EB0000-memory.dmp

Filesize
64KB

Download
memory/3276-257-0x000001C8E51C0000-0x000001C8E51D0000-memory.dmp

Filesize
64KB

Download
memory/4016-199-0x000000001E300000-0x000000001E400000-memory.dmp

Filesize
1024KB

Download
memory/4016-211-0x00000000029D0000-0x00000000029E0000-memory.dmp

Filesize
64KB

Download
memory/4016-134-0x00000000029D0000-0x00000000029E0000-memory.dmp

Filesize
64KB

Download
memory/4016-135-0x000000001D150000-0x000000001D1A0000-memory.dmp

Filesize
320KB

Download
memory/4016-138-0x00000000029D0000-0x00000000029E0000-memory.dmp

Filesize
64KB

Download
memory/4016-139-0x00000000029D0000-0x00000000029E0000-memory.dmp

Filesize
64KB

Download
memory/4016-155-0x00000000029D0000-0x00000000029E0000-memory.dmp

Filesize
64KB

Download
memory/4016-189-0x00000000029D0000-0x00000000029E0000-memory.dmp

Filesize
64KB

Download
memory/4016-133-0x0000000000400000-0x00000000009C2000-memory.dmp

Filesize
5.8MB

Download
memory/4016-200-0x000000001E300000-0x000000001E400000-memory.dmp

Filesize
1024KB

Download
memory/4068-348-0x000001A33E6B0000-0x000001A33E6C0000-memory.dmp

Filesize
64KB

Download
memory/4068-346-0x000001A33E6B0000-0x000001A33E6C0000-memory.dmp

Filesize
64KB

Download
memory/4068-352-0x000001A33E6B0000-0x000001A33E6C0000-memory.dmp

Filesize
64KB

Download
memory/4192-224-0x00000126EEDD0000-0x00000126EEDE0000-memory.dmp

Filesize
64KB

Download
memory/4192-225-0x00000126EEDD0000-0x00000126EEDE0000-memory.dmp

Filesize
64KB

Download
memory/4192-359-0x00000126EEDD0000-0x00000126EEDE0000-memory.dmp

Filesize
64KB

Download
memory/4508-336-0x00000212624C0000-0x00000212624D0000-memory.dmp

Filesize
64KB

Download
memory/4508-347-0x00000212624C0000-0x00000212624D0000-memory.dmp

Filesize
64KB

Download
memory/4508-356-0x00000212624C0000-0x00000212624D0000-memory.dmp

Filesize
64KB

Download
memory/4708-245-0x000001E4C6370000-0x000001E4C6380000-memory.dmp

Filesize
64KB

Download
memory/4708-231-0x000001E4C6370000-0x000001E4C6380000-memory.dmp

Filesize
64KB

Download
memory/4708-357-0x000001E4C6370000-0x000001E4C6380000-memory.dmp

Filesize
64KB

Download
memory/4940-315-0x0000022C20840000-0x0000022C20850000-memory.dmp

Filesize
64KB

Download
memory/4940-241-0x0000022C207C0000-0x0000022C207E2000-memory.dmp

Filesize
136KB

Download