Overview

overview

10

Static

static

3

e9f29aa8cb...0N.exe

windows7-x64

10

e9f29aa8cb...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-10-2024 15:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e9f29aa8cb2cd0a51f1efa943e5d0fc1c49d39dec5e7dfd9c0d38612bc504cc0N.exe

  • Size

    4.9MB

  • MD5

    c19d6e26d2bb9da6cfe5d93f0c7123c0

  • SHA1

    4c7b1e4dd55956143de9bbdda2fb4b72792a2993

  • SHA256

    e9f29aa8cb2cd0a51f1efa943e5d0fc1c49d39dec5e7dfd9c0d38612bc504cc0

  • SHA512

    c4da5528b43be763d6ce388f5774bf2a131a75277dbab1623695652737c1d967690d569dd529da670e4fa3eb4651c423ec4e017d2bb34a2de27418c7b6adb50f

  • SSDEEP

    49152:Ll5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score
10/10
colibridcratbuild1discoveryevasionexecutioninfostealerloaderrattrojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain

Signatures

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri
  • Colibri family
    colibri
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 33 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 36 IoCs
    evasiontrojan
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 36 IoCs
  • Checks whether UAC is enabled 1 TTPs 24 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 10 IoCs
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 12 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 36 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9f29aa8cb2cd0a51f1efa943e5d0fc1c49d39dec5e7dfd9c0d38612bc504cc0N.exe
    "C:\Users\Admin\AppData\Local\Temp\e9f29aa8cb2cd0a51f1efa943e5d0fc1c49d39dec5e7dfd9c0d38612bc504cc0N.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2628
    • C:\Users\Admin\AppData\Local\Temp\tmpC575.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpC575.tmp.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2172
      • C:\Users\Admin\AppData\Local\Temp\tmpC575.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmpC575.tmp.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3848
        • C:\Users\Admin\AppData\Local\Temp\tmpC575.tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\tmpC575.tmp.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2996
          • C:\Users\Admin\AppData\Local\Temp\tmpC575.tmp.exe
            "C:\Users\Admin\AppData\Local\Temp\tmpC575.tmp.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1684
            • C:\Users\Admin\AppData\Local\Temp\tmpC575.tmp.exe
              "C:\Users\Admin\AppData\Local\Temp\tmpC575.tmp.exe"
              6⤵
              • Executes dropped EXE
              PID:3252
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3388
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1700
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2008
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4528
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1752
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1364
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3176
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4576
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:924
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:980
    • C:\Program Files\dotnet\dwm.exe
      "C:\Program Files\dotnet\dwm.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5040
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da5590f2-7106-457f-8d55-34be09481b89.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3396
        • C:\Program Files\dotnet\dwm.exe
          "C:\Program Files\dotnet\dwm.exe"
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4824
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da515f39-805f-4a65-b74e-e63b1b0f7894.vbs"
            5⤵
              PID:2536
              • C:\Program Files\dotnet\dwm.exe
                "C:\Program Files\dotnet\dwm.exe"
                6⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • System policy modification
                PID:4716
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c7c51ae5-3e8c-47db-ae01-dc88a482477b.vbs"
                  7⤵
                    PID:212
                    • C:\Program Files\dotnet\dwm.exe
                      "C:\Program Files\dotnet\dwm.exe"
                      8⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • System policy modification
                      PID:2948
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f7183eba-160d-4b8c-8340-b0a68b97fb24.vbs"
                        9⤵
                          PID:2456
                          • C:\Program Files\dotnet\dwm.exe
                            "C:\Program Files\dotnet\dwm.exe"
                            10⤵
                            • UAC bypass
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • System policy modification
                            PID:3960
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\abee33db-4285-4f44-b4c0-1104eeef7d1a.vbs"
                              11⤵
                                PID:3136
                                • C:\Program Files\dotnet\dwm.exe
                                  "C:\Program Files\dotnet\dwm.exe"
                                  12⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • System policy modification
                                  PID:4004
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0cb86906-89f9-4a22-9875-6b2e343f2c0b.vbs"
                                    13⤵
                                      PID:2164
                                      • C:\Program Files\dotnet\dwm.exe
                                        "C:\Program Files\dotnet\dwm.exe"
                                        14⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:4632
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a139461-fe12-47c0-896e-eaae94aa5541.vbs"
                                          15⤵
                                            PID:4108
                                            • C:\Program Files\dotnet\dwm.exe
                                              "C:\Program Files\dotnet\dwm.exe"
                                              16⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:3912
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e04fe9f4-2738-4359-828d-88a629532bb1.vbs"
                                                17⤵
                                                  PID:1900
                                                  • C:\Program Files\dotnet\dwm.exe
                                                    "C:\Program Files\dotnet\dwm.exe"
                                                    18⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:1932
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c64f233e-a9f7-4fe7-8276-51f1c7eda249.vbs"
                                                      19⤵
                                                        PID:3432
                                                        • C:\Program Files\dotnet\dwm.exe
                                                          "C:\Program Files\dotnet\dwm.exe"
                                                          20⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:408
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e14ae24d-1767-4aee-96c2-becb1a55ab24.vbs"
                                                            21⤵
                                                              PID:1020
                                                              • C:\Program Files\dotnet\dwm.exe
                                                                "C:\Program Files\dotnet\dwm.exe"
                                                                22⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:2108
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c4c4bccf-d66a-41af-95c7-5bf8e9ef193b.vbs"
                                                                  23⤵
                                                                    PID:1508
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\356c3f33-c32d-4610-bf90-40cba5318056.vbs"
                                                                    23⤵
                                                                      PID:3800
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\910ed589-f136-42ca-ba8e-de90b09b3063.vbs"
                                                                  21⤵
                                                                    PID:1736
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp5ED0.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmp5ED0.tmp.exe"
                                                                    21⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1792
                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp5ED0.tmp.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\tmp5ED0.tmp.exe"
                                                                      22⤵
                                                                      • Executes dropped EXE
                                                                      PID:3584
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e4d35b2c-934d-4902-b5c0-f671316875e9.vbs"
                                                                19⤵
                                                                  PID:2612
                                                                • C:\Users\Admin\AppData\Local\Temp\tmp430A.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp430A.tmp.exe"
                                                                  19⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2956
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp430A.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmp430A.tmp.exe"
                                                                    20⤵
                                                                    • Executes dropped EXE
                                                                    PID:32
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9119bbf7-e48d-403d-a33b-3ddf66ad428a.vbs"
                                                              17⤵
                                                                PID:1888
                                                              • C:\Users\Admin\AppData\Local\Temp\tmp1321.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmp1321.tmp.exe"
                                                                17⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3932
                                                                • C:\Users\Admin\AppData\Local\Temp\tmp1321.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp1321.tmp.exe"
                                                                  18⤵
                                                                  • Executes dropped EXE
                                                                  PID:2308
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e804c189-9bb5-42c3-b389-91fcee1b82cd.vbs"
                                                            15⤵
                                                              PID:4776
                                                            • C:\Users\Admin\AppData\Local\Temp\tmpE0C6.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmpE0C6.tmp.exe"
                                                              15⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1228
                                                              • C:\Users\Admin\AppData\Local\Temp\tmpE0C6.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmpE0C6.tmp.exe"
                                                                16⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5088
                                                                • C:\Users\Admin\AppData\Local\Temp\tmpE0C6.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmpE0C6.tmp.exe"
                                                                  17⤵
                                                                  • Executes dropped EXE
                                                                  PID:1792
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce49bd96-b5e9-4519-bea9-d79be308e999.vbs"
                                                          13⤵
                                                            PID:5060
                                                          • C:\Users\Admin\AppData\Local\Temp\tmpC37A.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmpC37A.tmp.exe"
                                                            13⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:212
                                                            • C:\Users\Admin\AppData\Local\Temp\tmpC37A.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmpC37A.tmp.exe"
                                                              14⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2948
                                                              • C:\Users\Admin\AppData\Local\Temp\tmpC37A.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmpC37A.tmp.exe"
                                                                15⤵
                                                                • Executes dropped EXE
                                                                PID:3400
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5fd0a545-2aa7-4e20-8bb2-ece5eee360f6.vbs"
                                                        11⤵
                                                          PID:2812
                                                        • C:\Users\Admin\AppData\Local\Temp\tmp911F.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmp911F.tmp.exe"
                                                          11⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4708
                                                          • C:\Users\Admin\AppData\Local\Temp\tmp911F.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmp911F.tmp.exe"
                                                            12⤵
                                                            • Executes dropped EXE
                                                            PID:4864
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f457c442-0981-4351-b65f-dbede7c23321.vbs"
                                                      9⤵
                                                        PID:1880
                                                      • C:\Users\Admin\AppData\Local\Temp\tmp5DCB.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmp5DCB.tmp.exe"
                                                        9⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2772
                                                        • C:\Users\Admin\AppData\Local\Temp\tmp5DCB.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmp5DCB.tmp.exe"
                                                          10⤵
                                                          • Executes dropped EXE
                                                          PID:408
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8eb6082b-61b2-4f6b-a931-1112368885dd.vbs"
                                                    7⤵
                                                      PID:224
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\77d19988-1a4e-4a95-baef-4bc818299bfb.vbs"
                                                  5⤵
                                                    PID:1368
                                                  • C:\Users\Admin\AppData\Local\Temp\tmpCDC.tmp.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\tmpCDC.tmp.exe"
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    • System Location Discovery: System Language Discovery
                                                    PID:516
                                                    • C:\Users\Admin\AppData\Local\Temp\tmpCDC.tmp.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\tmpCDC.tmp.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      PID:3036
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5294e5b1-7009-4a13-ae73-72e4343e236f.vbs"
                                                3⤵
                                                  PID:632
                                                • C:\Users\Admin\AppData\Local\Temp\tmpEC63.tmp.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\tmpEC63.tmp.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2940
                                                  • C:\Users\Admin\AppData\Local\Temp\tmpEC63.tmp.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\tmpEC63.tmp.exe"
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:3896
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Windows\Tasks\sihost.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2732
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Tasks\sihost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1528
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Windows\Tasks\sihost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4496
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3516
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4548
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4216
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Documents\My Pictures\dllhost.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:224
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Documents\My Pictures\dllhost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:5064
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Documents\My Pictures\dllhost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4948
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Windows\Media\Garden\explorer.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3520
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Media\Garden\explorer.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1048
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Windows\Media\Garden\explorer.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:536
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Favorites\Idle.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2832
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\Favorites\Idle.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1888
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Favorites\Idle.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2580
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Pictures\backgroundTaskHost.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2548
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\backgroundTaskHost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1244
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Pictures\backgroundTaskHost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1420
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backgroundTaskHost.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3556
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3960
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2164
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\System.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4036
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\System.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1900
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\System.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4448
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\dotnet\dwm.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2408
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\dotnet\dwm.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4108
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\dwm.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4008
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\authman\services.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4800
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\authman\services.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:924
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\Microsoft.NET\authman\services.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4192
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\es-ES\RuntimeBroker.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4696
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3472
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4356

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.log
                                              Filesize

                                              1KB

                                              MD5

                                              4a667f150a4d1d02f53a9f24d89d53d1

                                              SHA1

                                              306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

                                              SHA256

                                              414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

                                              SHA512

                                              4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                              Filesize

                                              2KB

                                              MD5

                                              d85ba6ff808d9e5444a4b369f5bc2730

                                              SHA1

                                              31aa9d96590fff6981b315e0b391b575e4c0804a

                                              SHA256

                                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                              SHA512

                                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              Filesize

                                              944B

                                              MD5

                                              62623d22bd9e037191765d5083ce16a3

                                              SHA1

                                              4a07da6872672f715a4780513d95ed8ddeefd259

                                              SHA256

                                              95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                              SHA512

                                              9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              Filesize

                                              944B

                                              MD5

                                              cadef9abd087803c630df65264a6c81c

                                              SHA1

                                              babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                              SHA256

                                              cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                              SHA512

                                              7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              Filesize

                                              944B

                                              MD5

                                              2e907f77659a6601fcc408274894da2e

                                              SHA1

                                              9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                              SHA256

                                              385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                              SHA512

                                              34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              Filesize

                                              944B

                                              MD5

                                              bd5940f08d0be56e65e5f2aaf47c538e

                                              SHA1

                                              d7e31b87866e5e383ab5499da64aba50f03e8443

                                              SHA256

                                              2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                              SHA512

                                              c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\0cb86906-89f9-4a22-9875-6b2e343f2c0b.vbs
                                              Filesize

                                              707B

                                              MD5

                                              3d2bf883b0edd72389cce3e23d970eab

                                              SHA1

                                              2847b829681c7257987f762e54b0699e0d0cbf52

                                              SHA256

                                              e5256fb45daa7fd83e5cca846d862e57754abd31b175352781bc650ac9d665e6

                                              SHA512

                                              8370032358b15db89c83801c4bd440d3d7a207009d2566764787de50ee7dd4c06654b7df93bc64c70672df6240d541d48292a28b82c7477b0213b0abebc723b0

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\4a139461-fe12-47c0-896e-eaae94aa5541.vbs
                                              Filesize

                                              707B

                                              MD5

                                              90e3205b23cdd9ee6281689ca9c19cdf

                                              SHA1

                                              c4e58881387e64ad540ef62194d6205b896a5acb

                                              SHA256

                                              a4503e4cf1f2b5f31ad9b30765b7fb681ffde6ea6b873d0ee3c26f13a4c51b08

                                              SHA512

                                              6ea97a66fa216d797d1c99f359b28aaf2b626c865a92ded7992b050d9bac2a42c09b5c61f22a0dc326a139bac3b3b9ac7218de80c8c494aabe26497d75c129dd

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\5294e5b1-7009-4a13-ae73-72e4343e236f.vbs
                                              Filesize

                                              483B

                                              MD5

                                              5e77fc684d253f4d3dbdfeba8b88435b

                                              SHA1

                                              9499dfda99a6ba9344824cbb845e3183e176dfd7

                                              SHA256

                                              0436c7b451d1ab3b7338e8363b175c7445bfe755874f6d472c5881ab6b61cf4b

                                              SHA512

                                              7005ab639b1b52c931df393730b2b761697ea304d09117f5115757e7553f3b43f4c10ad323935777d1b8d0d5881351513a8e50dec8ad082d0c4521a2a1849226

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n4vuxhva.hsr.ps1
                                              Filesize

                                              60B

                                              MD5

                                              d17fe0a3f47be24a6453e9ef58c94641

                                              SHA1

                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                              SHA256

                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                              SHA512

                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\abee33db-4285-4f44-b4c0-1104eeef7d1a.vbs
                                              Filesize

                                              707B

                                              MD5

                                              1bd62ecf5a08f541b4acd8c0c0df531d

                                              SHA1

                                              443f13620af53a536252d28be6d51db2698ab545

                                              SHA256

                                              17a8c3a12767e138138cc92fcee64544361395da0415a239916ba8a5aef970c6

                                              SHA512

                                              a96bfeb5a28bf0fd84550088fc7c57b369390406414c4bf1319834bef468fcba44b1ec177bfc070795567b2dd1e1028be7149af283fed4d515a539a5533d74d7

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\c7c51ae5-3e8c-47db-ae01-dc88a482477b.vbs
                                              Filesize

                                              707B

                                              MD5

                                              c6902472524a7a3e4ab3c594663acad8

                                              SHA1

                                              9c61691906a656c10e471c77bfe38b8fec50a11a

                                              SHA256

                                              235849682125a4418092e05487006f08cb338a0851d9bf4d5233c289445a052e

                                              SHA512

                                              ea8cd721b4b18f25342e835d29c05f88ac3236916908e22428125819f513f8e499965a5360d0028b7d99bcda68030d8ded0f3a4a1dd40dbbb82a2b8bc7a60a4e

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\da515f39-805f-4a65-b74e-e63b1b0f7894.vbs
                                              Filesize

                                              707B

                                              MD5

                                              de96f4b17af654645d744cab921ddf9e

                                              SHA1

                                              77dcb4ac352f78ff24dafabb2d8d5573a87dd2fd

                                              SHA256

                                              ff486c89cbd4cd8de75442aa0382451b298d9d31e2c394c5e6ff4e7ef451e7d7

                                              SHA512

                                              71da2a27ee171ef27670888312d450d76d3ab368e95438a53cdb637fcb5b1abee9cc70dfe1e514b842475c06467c5ea455e922dac602af940a744255bd5f06be

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\da5590f2-7106-457f-8d55-34be09481b89.vbs
                                              Filesize

                                              707B

                                              MD5

                                              4fa50b4447f52b50166acb90011c44cc

                                              SHA1

                                              a1b4024fe160a74009059a93371e7a235026cdd9

                                              SHA256

                                              c5777f1f1b108632b76be8a0145f25fcfae516cbfd05080fac362ba766b20064

                                              SHA512

                                              7315c17677f0f36bc6c4e62d34b4992813420848d4748a3d545a1c584b43b4bd0f8e754940ffd065053129fdfeac28ae27c45f82b33b0152d6260f4635208faf

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\f7183eba-160d-4b8c-8340-b0a68b97fb24.vbs
                                              Filesize

                                              707B

                                              MD5

                                              917d377a9d27c5461f8e61f54ada002f

                                              SHA1

                                              d26e3dc94dfb20a4b2ea68ad8bfa1fb9348c1bd8

                                              SHA256

                                              41b3799b054e86c5f4bef386cb83e0ad6932322056ce646722bfdc4a128d5186

                                              SHA512

                                              622910c12e080b3dd04a977c1eba808ae3d063febedeb8c12827d50843517a66db804c9f2009d2450d2a753a8a770df4054dd7a89727536ef64f8e3d49d9a0f0

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\tmpC575.tmp.exe
                                              Filesize

                                              75KB

                                              MD5

                                              e0a68b98992c1699876f818a22b5b907

                                              SHA1

                                              d41e8ad8ba51217eb0340f8f69629ccb474484d0

                                              SHA256

                                              2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

                                              SHA512

                                              856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

                                              Download Submit

                                            • C:\Users\Default\Favorites\Idle.exe
                                              Filesize

                                              4.9MB

                                              MD5

                                              c19d6e26d2bb9da6cfe5d93f0c7123c0

                                              SHA1

                                              4c7b1e4dd55956143de9bbdda2fb4b72792a2993

                                              SHA256

                                              e9f29aa8cb2cd0a51f1efa943e5d0fc1c49d39dec5e7dfd9c0d38612bc504cc0

                                              SHA512

                                              c4da5528b43be763d6ce388f5774bf2a131a75277dbab1623695652737c1d967690d569dd529da670e4fa3eb4651c423ec4e017d2bb34a2de27418c7b6adb50f

                                              Download Submit

                                            • memory/980-198-0x000001D773230000-0x000001D773252000-memory.dmp

                                              Filesize

                                              136KB

                                              Download

                                            • memory/2628-14-0x000000001BCC0000-0x000000001BCCE000-memory.dmp

                                              Filesize

                                              56KB

                                              Download

                                            • memory/2628-1-0x00000000009F0000-0x0000000000EE4000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/2628-16-0x000000001C470000-0x000000001C478000-memory.dmp

                                              Filesize

                                              32KB

                                              Download

                                            • memory/2628-11-0x000000001BCA0000-0x000000001BCB2000-memory.dmp

                                              Filesize

                                              72KB

                                              Download

                                            • memory/2628-15-0x000000001C460000-0x000000001C46E000-memory.dmp

                                              Filesize

                                              56KB

                                              Download

                                            • memory/2628-17-0x000000001C480000-0x000000001C488000-memory.dmp

                                              Filesize

                                              32KB

                                              Download

                                            • memory/2628-213-0x00007FFA210C3000-0x00007FFA210C5000-memory.dmp

                                              Filesize

                                              8KB

                                              Download

                                            • memory/2628-301-0x00007FFA210C0000-0x00007FFA21B81000-memory.dmp

                                              Filesize

                                              10.8MB

                                              Download

                                            • memory/2628-12-0x000000001C990000-0x000000001CEB8000-memory.dmp

                                              Filesize

                                              5.2MB

                                              Download

                                            • memory/2628-10-0x000000001BC90000-0x000000001BC9A000-memory.dmp

                                              Filesize

                                              40KB

                                              Download

                                            • memory/2628-0-0x00007FFA210C3000-0x00007FFA210C5000-memory.dmp

                                              Filesize

                                              8KB

                                              Download

                                            • memory/2628-18-0x000000001C490000-0x000000001C49C000-memory.dmp

                                              Filesize

                                              48KB

                                              Download

                                            • memory/2628-13-0x000000001BCB0000-0x000000001BCBA000-memory.dmp

                                              Filesize

                                              40KB

                                              Download

                                            • memory/2628-8-0x000000001BC60000-0x000000001BC76000-memory.dmp

                                              Filesize

                                              88KB

                                              Download

                                            • memory/2628-9-0x000000001BC80000-0x000000001BC90000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2628-5-0x000000001C410000-0x000000001C460000-memory.dmp

                                              Filesize

                                              320KB

                                              Download

                                            • memory/2628-2-0x00007FFA210C0000-0x00007FFA21B81000-memory.dmp

                                              Filesize

                                              10.8MB

                                              Download

                                            • memory/2628-6-0x0000000003040000-0x0000000003048000-memory.dmp

                                              Filesize

                                              32KB

                                              Download

                                            • memory/2628-7-0x000000001BC50000-0x000000001BC60000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2628-4-0x000000001BC30000-0x000000001BC4C000-memory.dmp

                                              Filesize

                                              112KB

                                              Download

                                            • memory/2628-3-0x000000001BCE0000-0x000000001BE0E000-memory.dmp

                                              Filesize

                                              1.2MB

                                              Download

                                            • memory/3252-76-0x0000000000400000-0x0000000000407000-memory.dmp

                                              Filesize

                                              28KB

                                              Download

                                            • memory/4824-349-0x000000001BC80000-0x000000001BC92000-memory.dmp

                                              Filesize

                                              72KB

                                              Download