Analysis

  • max time kernel
    119s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-09-2024 01:02

General

  • Target

    468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe

  • Size

    4.9MB

  • MD5

    261b88ce85c81cd9d3296c430bc897d0

  • SHA1

    0f05a6f1da522690e312c22d1ff63b46b77b5b1f

  • SHA256

    468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99

  • SHA512

    df8c85e30bb4135034eaea615578e50b47f4a94d6c4e667a143858f2cb5f6350d689aafeda89f21215970298c2dab650b94b47c38aaa07c2af2d1648bd419a7d

  • SSDEEP

    49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 39 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 39 IoCs
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 35 IoCs
  • Checks whether UAC is enabled 1 TTPs 26 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 12 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe
    "C:\Users\Admin\AppData\Local\Temp\468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1932
    • C:\Users\Admin\AppData\Local\Temp\tmp7794.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp7794.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4628
      • C:\Users\Admin\AppData\Local\Temp\tmp7794.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp7794.tmp.exe"
        3⤵
        • Executes dropped EXE
        PID:4408
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2892
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3956
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2888
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4036
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2072
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:920
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3152
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3984
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4320
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2232
    • C:\Recovery\WindowsRE\dllhost.exe
      "C:\Recovery\WindowsRE\dllhost.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4404
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd254905-36d4-4347-9678-1e275d7a062e.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3004
        • C:\Recovery\WindowsRE\dllhost.exe
          C:\Recovery\WindowsRE\dllhost.exe
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2604
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2cbb0a17-3651-44a5-9ca3-645307aec1fe.vbs"
            5⤵
              PID:4128
              • C:\Recovery\WindowsRE\dllhost.exe
                C:\Recovery\WindowsRE\dllhost.exe
                6⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • System policy modification
                PID:4012
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62bebeaf-681c-4ee4-8f48-a51a0c00318e.vbs"
                  7⤵
                    PID:4172
                    • C:\Recovery\WindowsRE\dllhost.exe
                      C:\Recovery\WindowsRE\dllhost.exe
                      8⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • System policy modification
                      PID:2632
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ceccdba8-9ac2-4029-a67f-552d35c44006.vbs"
                        9⤵
                          PID:1716
                          • C:\Recovery\WindowsRE\dllhost.exe
                            C:\Recovery\WindowsRE\dllhost.exe
                            10⤵
                            • UAC bypass
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • System policy modification
                            PID:464
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3beb848-3264-48ac-9021-ff1f90642b9a.vbs"
                              11⤵
                                PID:4212
                                • C:\Recovery\WindowsRE\dllhost.exe
                                  C:\Recovery\WindowsRE\dllhost.exe
                                  12⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • System policy modification
                                  PID:2120
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\863ef123-bcfa-4d2c-80e8-db31f92c7719.vbs"
                                    13⤵
                                      PID:1980
                                      • C:\Recovery\WindowsRE\dllhost.exe
                                        C:\Recovery\WindowsRE\dllhost.exe
                                        14⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:2216
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cda662dc-141b-42a4-894e-67216cb42ceb.vbs"
                                          15⤵
                                            PID:3496
                                            • C:\Recovery\WindowsRE\dllhost.exe
                                              C:\Recovery\WindowsRE\dllhost.exe
                                              16⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:3416
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb491469-e9c6-490e-9523-be1383e01c07.vbs"
                                                17⤵
                                                  PID:760
                                                  • C:\Recovery\WindowsRE\dllhost.exe
                                                    C:\Recovery\WindowsRE\dllhost.exe
                                                    18⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:556
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4315f711-439d-4f7f-9f6c-2dfd8997e479.vbs"
                                                      19⤵
                                                        PID:4888
                                                        • C:\Recovery\WindowsRE\dllhost.exe
                                                          C:\Recovery\WindowsRE\dllhost.exe
                                                          20⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:2360
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ecdc3cc-d734-4a73-a2c3-b0788c7603e7.vbs"
                                                            21⤵
                                                              PID:5048
                                                              • C:\Recovery\WindowsRE\dllhost.exe
                                                                C:\Recovery\WindowsRE\dllhost.exe
                                                                22⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:3960
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e220bb6-bba7-4d57-a699-e9e21e42c4dc.vbs"
                                                                  23⤵
                                                                    PID:2644
                                                                    • C:\Recovery\WindowsRE\dllhost.exe
                                                                      C:\Recovery\WindowsRE\dllhost.exe
                                                                      24⤵
                                                                      • UAC bypass
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • System policy modification
                                                                      PID:1204
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ea80cd7-9fe7-4726-893c-971e547d15dc.vbs"
                                                                        25⤵
                                                                          PID:5044
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a06796d-2d73-42dd-b26d-9a39f402c049.vbs"
                                                                          25⤵
                                                                            PID:4384
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7827acc-0283-48e1-b0a2-8c9bd8046998.vbs"
                                                                        23⤵
                                                                          PID:2456
                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp264B.tmp.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\tmp264B.tmp.exe"
                                                                          23⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetThreadContext
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4624
                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp264B.tmp.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\tmp264B.tmp.exe"
                                                                            24⤵
                                                                            • Executes dropped EXE
                                                                            PID:4396
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12fe8247-5658-47d0-b327-8c22f66aca5f.vbs"
                                                                      21⤵
                                                                        PID:212
                                                                      • C:\Users\Admin\AppData\Local\Temp\tmp99B.tmp.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\tmp99B.tmp.exe"
                                                                        21⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1552
                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp99B.tmp.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\tmp99B.tmp.exe"
                                                                          22⤵
                                                                          • Executes dropped EXE
                                                                          PID:2668
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\457deaec-7404-4db0-87fb-1fa35b4bb849.vbs"
                                                                    19⤵
                                                                      PID:4212
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5df4e92-dea4-4fac-9dfa-0aa8c053217b.vbs"
                                                                  17⤵
                                                                    PID:3900
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpBDBD.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmpBDBD.tmp.exe"
                                                                    17⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4384
                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpBDBD.tmp.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\tmpBDBD.tmp.exe"
                                                                      18⤵
                                                                      • Executes dropped EXE
                                                                      PID:5084
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ee0eac5-b053-4960-a118-6698401223e3.vbs"
                                                                15⤵
                                                                  PID:4576
                                                                • C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe"
                                                                  15⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2456
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe"
                                                                    16⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:920
                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe"
                                                                      17⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4416
                                                                      • C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\tmp8D18.tmp.exe"
                                                                        18⤵
                                                                        • Executes dropped EXE
                                                                        PID:1600
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\268243a6-753c-4967-874a-ab204f63cff3.vbs"
                                                              13⤵
                                                                PID:4612
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72b19a1c-ab66-4ed7-a0a3-2a5645966dc0.vbs"
                                                            11⤵
                                                              PID:1896
                                                            • C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe"
                                                              11⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4744
                                                              • C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe"
                                                                12⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1264
                                                                • C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp.exe"
                                                                  13⤵
                                                                  • Executes dropped EXE
                                                                  PID:1476
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70c0b6af-98ca-4108-b532-7a6e2f01b6c6.vbs"
                                                          9⤵
                                                            PID:4676
                                                          • C:\Users\Admin\AppData\Local\Temp\tmp2277.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmp2277.tmp.exe"
                                                            9⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5092
                                                            • C:\Users\Admin\AppData\Local\Temp\tmp2277.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmp2277.tmp.exe"
                                                              10⤵
                                                              • Executes dropped EXE
                                                              PID:3648
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\018b5064-bbda-47fc-a0ee-a06d66139253.vbs"
                                                        7⤵
                                                          PID:1920
                                                        • C:\Users\Admin\AppData\Local\Temp\tmp599.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmp599.tmp.exe"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2072
                                                          • C:\Users\Admin\AppData\Local\Temp\tmp599.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmp599.tmp.exe"
                                                            8⤵
                                                            • Executes dropped EXE
                                                            PID:3348
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e97000c1-af3b-4cf2-bcb8-66edbf1156bd.vbs"
                                                      5⤵
                                                        PID:5052
                                                      • C:\Users\Admin\AppData\Local\Temp\tmpD4A5.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmpD4A5.tmp.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2680
                                                        • C:\Users\Admin\AppData\Local\Temp\tmpD4A5.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmpD4A5.tmp.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          PID:2716
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e59671bc-4e5c-4d55-98b5-5ca7a8e20d1b.vbs"
                                                    3⤵
                                                      PID:1100
                                                    • C:\Users\Admin\AppData\Local\Temp\tmpA103.tmp.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\tmpA103.tmp.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4496
                                                      • C:\Users\Admin\AppData\Local\Temp\tmpA103.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmpA103.tmp.exe"
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:2908
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Update\Install\{B03CCC4C-2FBB-4685-83CA-78028CCF38ED}\sysmon.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1628
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Install\{B03CCC4C-2FBB-4685-83CA-78028CCF38ED}\sysmon.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4560
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Update\Install\{B03CCC4C-2FBB-4685-83CA-78028CCF38ED}\sysmon.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4100
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2996
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4892
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4144
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Videos\System.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3680
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\Videos\System.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1128
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Videos\System.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2988
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3376
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2668
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1940
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\Registration\CRMLog\System.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4472
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\System.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4788
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\Registration\CRMLog\System.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4452
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5040
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2392
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2752
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Windows\bcastdvr\unsecapp.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5072
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\bcastdvr\unsecapp.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3960
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Windows\bcastdvr\unsecapp.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3404
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Idle.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2428
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Idle.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3884
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Idle.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3480
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\Fonts\sppsvc.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2956
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Fonts\sppsvc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1300
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\Fonts\sppsvc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2680
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\winlogon.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4748
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\winlogon.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5036
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\winlogon.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1964
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Registry.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4540
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:784
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:664
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N4" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4416
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4732
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N4" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99N.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3704
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Application Data\sppsvc.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4364
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Application Data\sppsvc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:372
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Application Data\sppsvc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5104

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  4a667f150a4d1d02f53a9f24d89d53d1

                                                  SHA1

                                                  306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

                                                  SHA256

                                                  414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

                                                  SHA512

                                                  4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  d85ba6ff808d9e5444a4b369f5bc2730

                                                  SHA1

                                                  31aa9d96590fff6981b315e0b391b575e4c0804a

                                                  SHA256

                                                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                  SHA512

                                                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  a8e8360d573a4ff072dcc6f09d992c88

                                                  SHA1

                                                  3446774433ceaf0b400073914facab11b98b6807

                                                  SHA256

                                                  bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

                                                  SHA512

                                                  4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  3a6bad9528f8e23fb5c77fbd81fa28e8

                                                  SHA1

                                                  f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                  SHA256

                                                  986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                  SHA512

                                                  846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  2e907f77659a6601fcc408274894da2e

                                                  SHA1

                                                  9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                  SHA256

                                                  385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                  SHA512

                                                  34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                • C:\Users\Admin\AppData\Local\Temp\2cbb0a17-3651-44a5-9ca3-645307aec1fe.vbs

                                                  Filesize

                                                  709B

                                                  MD5

                                                  323484c42d14e914518bd33a50a50b16

                                                  SHA1

                                                  facaecb49fd9e5d7069386c8f123b5ad448d7cd8

                                                  SHA256

                                                  752d756954eb97a6abc9ba2cce9bb2dbc7e1263cad956abe24f70a2fda87635e

                                                  SHA512

                                                  1a641887c949edbf3d458280c01f6e5146ade85d3b73604417fb395c64984f169866774c089ef0060565aa4d2235c84de45ee7fb89d608586f95119e2969d6ee

                                                • C:\Users\Admin\AppData\Local\Temp\62bebeaf-681c-4ee4-8f48-a51a0c00318e.vbs

                                                  Filesize

                                                  709B

                                                  MD5

                                                  49a0859ec9c537b8742e4c215fcdba68

                                                  SHA1

                                                  d6cee7ac48f6646270bdfc4d26629ca471183d99

                                                  SHA256

                                                  0f24a08b0fa5ac143b871ef0583d48ccf3e481a9a7d7c05086a931aaff83b101

                                                  SHA512

                                                  29e518d9e108c2afc1dc4128577fea9599ad9123d796449ec2ed8ea867a84e20db7fd4eb2bdb06497df44dd49887f7205617c0505052390a1dd6ac438cf2d3a4

                                                • C:\Users\Admin\AppData\Local\Temp\863ef123-bcfa-4d2c-80e8-db31f92c7719.vbs

                                                  Filesize

                                                  709B

                                                  MD5

                                                  ad5da9a1a891fb99df34818c79b672e9

                                                  SHA1

                                                  c19c01d0bb2a2a47dc3b9968d3b42fe97292bf6c

                                                  SHA256

                                                  b9bee720422874529c17a1ee6704a61081a14945946272435f7fbf2f2a2a4232

                                                  SHA512

                                                  d9cd268fe49d15358f563d0515c7d7fb47556fcf70c62de803b389f855804d68c515ed3100ecf79b232035e5786b41b113dceb70ac5e5d99985d56bd182d16a8

                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fx0y1l24.b5n.ps1

                                                  Filesize

                                                  60B

                                                  MD5

                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                  SHA1

                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                  SHA256

                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                  SHA512

                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                • C:\Users\Admin\AppData\Local\Temp\cda662dc-141b-42a4-894e-67216cb42ceb.vbs

                                                  Filesize

                                                  709B

                                                  MD5

                                                  d87f40ed2096bd23b023cf3232b00262

                                                  SHA1

                                                  55bb3cd6510d3784a81cf4bf7bed684477182cb5

                                                  SHA256

                                                  05f35f2121fec1e058c7efdff938d58d63f9fd24f413137b98134493d65c069b

                                                  SHA512

                                                  4d99cbc6081039ba5f18c86d9c195fc80b90d758cd79c833f279ae13ace32b4fd9765cbc2e44c6a346128c425e4aab271c427194176ea434ad99ca41535ff72a

                                                • C:\Users\Admin\AppData\Local\Temp\ceccdba8-9ac2-4029-a67f-552d35c44006.vbs

                                                  Filesize

                                                  709B

                                                  MD5

                                                  75de85d8df8ae095910df0f947747c6b

                                                  SHA1

                                                  baac9330af856c54c41f4fd8d31121b9974ac12e

                                                  SHA256

                                                  2438c49624470e24b56801f852e9ea066aa477ef3172e682683cf4fe6ee400da

                                                  SHA512

                                                  f73dca991b7f1077b083d2bd774d8f195632b2e736d398e34c6d15fdff8b7d2f603d3604d684e0150afea3c56a511760e1f0e5d138e6226ea85b914879361caf

                                                • C:\Users\Admin\AppData\Local\Temp\d3beb848-3264-48ac-9021-ff1f90642b9a.vbs

                                                  Filesize

                                                  708B

                                                  MD5

                                                  8ae6900d199884116d0923348efcf3c8

                                                  SHA1

                                                  73185190a9bb9816753e6772bce60367757e372a

                                                  SHA256

                                                  1ec2c9de7c26cbdbea653d5ad54e4273ddaa8667d39cfe18bca490683babb4ad

                                                  SHA512

                                                  3a1fe8e6fe86f0dbf1e4df957aa4999b3370fa5782650fc648310a56a3f58f6a3218e45bb90c776dcb4990786649b854eb7ed3189e9d412092f26e5a52059d4e

                                                • C:\Users\Admin\AppData\Local\Temp\dd254905-36d4-4347-9678-1e275d7a062e.vbs

                                                  Filesize

                                                  709B

                                                  MD5

                                                  4aa9728b74cd7a273b885e864c34c8b2

                                                  SHA1

                                                  09e448f952c6dc422b1e440d5ce568796ca6743a

                                                  SHA256

                                                  2cd65203f2207d2b4944d7a062ee83f95d14a1fc307da700ad3b88942608a29c

                                                  SHA512

                                                  dee02829482c91332db10141a282efcb66a30808327d4514668a815d7c68395a31f82c8e15f12b5199e0cfa80c359551233b607a7933942fff25e7e3d9dd6706

                                                • C:\Users\Admin\AppData\Local\Temp\e59671bc-4e5c-4d55-98b5-5ca7a8e20d1b.vbs

                                                  Filesize

                                                  485B

                                                  MD5

                                                  7ea4877dbd489af9f7593f454c2f0dc1

                                                  SHA1

                                                  7414647c3c309a0799c8e3708a895d4078214c13

                                                  SHA256

                                                  7c89852fc020a7b196dac2334a9453e854ae9e622a022c1ced7094c9911c43dd

                                                  SHA512

                                                  205ef34b20e3bb960000397471204cfe3eb08f11424d0edca4b2b1dad4510592ad6a98e88dc759762c7ffc51e2b132169de35992d42f53497cecd87b4a4bcc6f

                                                • C:\Users\Admin\AppData\Local\Temp\tmp7794.tmp.exe

                                                  Filesize

                                                  75KB

                                                  MD5

                                                  e0a68b98992c1699876f818a22b5b907

                                                  SHA1

                                                  d41e8ad8ba51217eb0340f8f69629ccb474484d0

                                                  SHA256

                                                  2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

                                                  SHA512

                                                  856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

                                                • C:\Windows\Registration\CRMLog\System.exe

                                                  Filesize

                                                  4.9MB

                                                  MD5

                                                  261b88ce85c81cd9d3296c430bc897d0

                                                  SHA1

                                                  0f05a6f1da522690e312c22d1ff63b46b77b5b1f

                                                  SHA256

                                                  468bf7713166e6febbdef2ddc6f9004ebd1f385474a87c0b5674f936dfe09e99

                                                  SHA512

                                                  df8c85e30bb4135034eaea615578e50b47f4a94d6c4e667a143858f2cb5f6350d689aafeda89f21215970298c2dab650b94b47c38aaa07c2af2d1648bd419a7d

                                                • memory/1932-6-0x0000000003180000-0x0000000003188000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/1932-1-0x0000000000B20000-0x0000000001014000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1932-12-0x000000001CB00000-0x000000001D028000-memory.dmp

                                                  Filesize

                                                  5.2MB

                                                • memory/1932-18-0x000000001BE70000-0x000000001BE7C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/1932-11-0x000000001BE10000-0x000000001BE22000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/1932-0-0x00007FFF286D3000-0x00007FFF286D5000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1932-147-0x00007FFF286D3000-0x00007FFF286D5000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1932-10-0x00000000031D0000-0x00000000031DA000-memory.dmp

                                                  Filesize

                                                  40KB

                                                • memory/1932-2-0x00007FFF286D0000-0x00007FFF29191000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/1932-273-0x00007FFF286D0000-0x00007FFF29191000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/1932-285-0x00007FFF286D0000-0x00007FFF29191000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/1932-13-0x000000001BE20000-0x000000001BE2A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                • memory/1932-16-0x000000001BE50000-0x000000001BE58000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/1932-17-0x000000001BE60000-0x000000001BE68000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/1932-15-0x000000001BE40000-0x000000001BE4E000-memory.dmp

                                                  Filesize

                                                  56KB

                                                • memory/1932-9-0x00000000031C0000-0x00000000031D0000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/1932-8-0x00000000031A0000-0x00000000031B6000-memory.dmp

                                                  Filesize

                                                  88KB

                                                • memory/1932-14-0x000000001BE30000-0x000000001BE3E000-memory.dmp

                                                  Filesize

                                                  56KB

                                                • memory/1932-3-0x000000001BEA0000-0x000000001BFCE000-memory.dmp

                                                  Filesize

                                                  1.2MB

                                                • memory/1932-7-0x0000000003190000-0x00000000031A0000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/1932-5-0x000000001BDC0000-0x000000001BE10000-memory.dmp

                                                  Filesize

                                                  320KB

                                                • memory/1932-4-0x0000000003010000-0x000000000302C000-memory.dmp

                                                  Filesize

                                                  112KB

                                                • memory/2604-333-0x000000001C120000-0x000000001C132000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/2888-191-0x0000024E9DB40000-0x0000024E9DB62000-memory.dmp

                                                  Filesize

                                                  136KB

                                                • memory/4408-78-0x0000000000400000-0x0000000000407000-memory.dmp

                                                  Filesize

                                                  28KB