Overview

overview

10

Static

static

3

c200cf3b7b...16.exe

windows7-x64

10

c200cf3b7b...16.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2024 14:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c200cf3b7b2a80ea464716618af0d4f99588347d106c3bcea19773d760205e16.exe

  • Size

    4.9MB

  • MD5

    6980bcd5d7d665f70f434120a1d20549

  • SHA1

    8104f0c2f92ecb1ab9c6700f14d56059a93a9465

  • SHA256

    c200cf3b7b2a80ea464716618af0d4f99588347d106c3bcea19773d760205e16

  • SHA512

    2eb62827b55c986e2f6a076e9b5fb880bbcccc938d6581293f56ce9f2970a55f6bd27112486ccf20b792ef493cc7b1351a73a8bdda478af9b5c50e8ba0b00de3

  • SSDEEP

    49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score
10/10
colibridcratbuild1discoveryevasionexecutioninfostealerloaderrattrojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain

Signatures

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri
  • Colibri family
    colibri
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 21 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 48 IoCs
    evasiontrojan
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 43 IoCs
  • Checks whether UAC is enabled 1 TTPs 32 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 13 IoCs
  • Drops file in Program Files directory 9 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 16 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 48 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\c200cf3b7b2a80ea464716618af0d4f99588347d106c3bcea19773d760205e16.exe
    "C:\Users\Admin\AppData\Local\Temp\c200cf3b7b2a80ea464716618af0d4f99588347d106c3bcea19773d760205e16.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4548
    • C:\Users\Admin\AppData\Local\Temp\tmp7B7D.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp7B7D.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Users\Admin\AppData\Local\Temp\tmp7B7D.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp7B7D.tmp.exe"
        3⤵
        • Executes dropped EXE
        PID:3060
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2684
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1696
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4612
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:516
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4392
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:656
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2244
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4556
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3080
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1520
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2808
    • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
      "C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1300
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b8efd84-2c6a-4f72-837b-bebb9ccf85cb.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4768
        • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
          C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1976
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2cb33d44-1d30-40ac-9754-419ffd851922.vbs"
            5⤵
              PID:448
              • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                6⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • System policy modification
                PID:4288
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a4dd63b9-4552-49e0-8b22-2f69f464574f.vbs"
                  7⤵
                    PID:772
                    • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                      C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                      8⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • System policy modification
                      PID:2976
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec196439-a384-4f26-aef8-cadf6908725c.vbs"
                        9⤵
                          PID:4104
                          • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                            C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                            10⤵
                            • UAC bypass
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • System policy modification
                            PID:4984
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d1acc75-1d7e-4fbb-a00d-44fba13a9546.vbs"
                              11⤵
                                PID:400
                                • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                  C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                  12⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • System policy modification
                                  PID:3252
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b9442e5-2b21-4c65-a651-f10139ac3878.vbs"
                                    13⤵
                                      PID:816
                                      • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                        C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                        14⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:232
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\87f8bb88-69e3-4d1d-aa8e-9082dcf91b42.vbs"
                                          15⤵
                                            PID:4216
                                            • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                              C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                              16⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:2244
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\037959b1-97b9-4419-b825-64aabd5edf0b.vbs"
                                                17⤵
                                                  PID:740
                                                  • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                                    C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                                    18⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:5068
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78cb64f2-2481-4478-90af-971c0b4c45f4.vbs"
                                                      19⤵
                                                        PID:1972
                                                        • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                                          C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                                          20⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:2112
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79558d33-7fbc-44dc-9e3a-462b6fb0883c.vbs"
                                                            21⤵
                                                              PID:608
                                                              • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                                                C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                                                22⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:684
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\74ac809f-3fc3-4eb5-a209-63c09b2fa9f0.vbs"
                                                                  23⤵
                                                                    PID:4152
                                                                    • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                                                      C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                                                      24⤵
                                                                      • UAC bypass
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • System policy modification
                                                                      PID:4536
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c6abc35-c8d4-4db5-869b-c2990c6749cb.vbs"
                                                                        25⤵
                                                                          PID:3788
                                                                          • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                                                            C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                                                            26⤵
                                                                            • UAC bypass
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • System policy modification
                                                                            PID:3736
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c3946a60-1617-44c7-8611-cac1738e30cc.vbs"
                                                                              27⤵
                                                                                PID:2636
                                                                                • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                                                                  C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                                                                  28⤵
                                                                                  • UAC bypass
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Checks whether UAC is enabled
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • System policy modification
                                                                                  PID:1100
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\937ed6e6-0191-47d8-96e4-bc448e2b646d.vbs"
                                                                                    29⤵
                                                                                      PID:3844
                                                                                      • C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                                                                        C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe
                                                                                        30⤵
                                                                                        • UAC bypass
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Checks whether UAC is enabled
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • System policy modification
                                                                                        PID:2512
                                                                                        • C:\Windows\System32\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\623cf9ce-b505-45c0-b9f0-437ae463829b.vbs"
                                                                                          31⤵
                                                                                            PID:960
                                                                                          • C:\Windows\System32\WScript.exe
                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3084b3ab-2f89-4f73-af17-bf80dd355fd6.vbs"
                                                                                            31⤵
                                                                                              PID:4956
                                                                                            • C:\Users\Admin\AppData\Local\Temp\tmp9B6B.tmp.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\tmp9B6B.tmp.exe"
                                                                                              31⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2436
                                                                                              • C:\Users\Admin\AppData\Local\Temp\tmp9B6B.tmp.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\tmp9B6B.tmp.exe"
                                                                                                32⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:3592
                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp9B6B.tmp.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp9B6B.tmp.exe"
                                                                                                  33⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:1152
                                                                                        • C:\Windows\System32\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64b5fca8-db45-4530-be78-dae9f8e90a52.vbs"
                                                                                          29⤵
                                                                                            PID:1972
                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp6B14.tmp.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\tmp6B14.tmp.exe"
                                                                                            29⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2496
                                                                                            • C:\Users\Admin\AppData\Local\Temp\tmp6B14.tmp.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\tmp6B14.tmp.exe"
                                                                                              30⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:3372
                                                                                      • C:\Windows\System32\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4e1aedf-c438-4ae0-b384-a2aaeefe1d43.vbs"
                                                                                        27⤵
                                                                                          PID:4144
                                                                                    • C:\Windows\System32\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b7d9307-0a42-4d97-935c-8d44648b7ed6.vbs"
                                                                                      25⤵
                                                                                        PID:4832
                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmp1F65.tmp.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\tmp1F65.tmp.exe"
                                                                                        25⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:908
                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp1F65.tmp.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\tmp1F65.tmp.exe"
                                                                                          26⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:2832
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9d47a07-1ebd-4734-b3b8-dd667755fe10.vbs"
                                                                                    23⤵
                                                                                      PID:4212
                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpEF6C.tmp.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\tmpEF6C.tmp.exe"
                                                                                      23⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:116
                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpEF6C.tmp.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\tmpEF6C.tmp.exe"
                                                                                        24⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2052
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\374974fb-d1f3-41d2-8871-9235ab0b5b42.vbs"
                                                                                  21⤵
                                                                                    PID:4000
                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpD3E5.tmp.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\tmpD3E5.tmp.exe"
                                                                                    21⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2120
                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpD3E5.tmp.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\tmpD3E5.tmp.exe"
                                                                                      22⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:3060
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad6f8847-4743-41d8-8201-5540cdfc15f0.vbs"
                                                                                19⤵
                                                                                  PID:2276
                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpB689.tmp.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\tmpB689.tmp.exe"
                                                                                  19⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetThreadContext
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1664
                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpB689.tmp.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\tmpB689.tmp.exe"
                                                                                    20⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2548
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca6c542f-94bb-4e6d-9bdf-0ae756ed13fa.vbs"
                                                                              17⤵
                                                                                PID:3424
                                                                              • C:\Users\Admin\AppData\Local\Temp\tmp8529.tmp.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\tmp8529.tmp.exe"
                                                                                17⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetThreadContext
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2568
                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp8529.tmp.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp8529.tmp.exe"
                                                                                  18⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:1296
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\65cf39df-93cc-4a92-88b6-1529629da7b8.vbs"
                                                                            15⤵
                                                                              PID:1848
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c8f059f-3648-4689-b706-90a1163fd12b.vbs"
                                                                          13⤵
                                                                            PID:3724
                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp4BD9.tmp.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\tmp4BD9.tmp.exe"
                                                                            13⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetThreadContext
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2324
                                                                            • C:\Users\Admin\AppData\Local\Temp\tmp4BD9.tmp.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\tmp4BD9.tmp.exe"
                                                                              14⤵
                                                                              • Executes dropped EXE
                                                                              PID:1756
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e604a95e-4a47-4f98-8a0e-e426de77b88c.vbs"
                                                                        11⤵
                                                                          PID:2620
                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp1BB1.tmp.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\tmp1BB1.tmp.exe"
                                                                          11⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1544
                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp1BB1.tmp.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\tmp1BB1.tmp.exe"
                                                                            12⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetThreadContext
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1696
                                                                            • C:\Users\Admin\AppData\Local\Temp\tmp1BB1.tmp.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\tmp1BB1.tmp.exe"
                                                                              13⤵
                                                                              • Executes dropped EXE
                                                                              PID:2616
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\58f4e4f4-e8c2-4ffa-860b-0109a259379f.vbs"
                                                                      9⤵
                                                                        PID:2740
                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpFF20.tmp.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\tmpFF20.tmp.exe"
                                                                        9⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4136
                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpFF20.tmp.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\tmpFF20.tmp.exe"
                                                                          10⤵
                                                                          • Executes dropped EXE
                                                                          PID:4352
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa7f224a-815b-48e2-aa36-894c822cd787.vbs"
                                                                    7⤵
                                                                      PID:3660
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6adbe796-05fd-437b-8f80-9ba10b45ca83.vbs"
                                                                  5⤵
                                                                    PID:2200
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpC68C.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmpC68C.tmp.exe"
                                                                    5⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5032
                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpC68C.tmp.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\tmpC68C.tmp.exe"
                                                                      6⤵
                                                                      • Executes dropped EXE
                                                                      PID:1520
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\772c7a0b-9ba2-4d6f-a1be-f9ae438aa238.vbs"
                                                                3⤵
                                                                  PID:3276
                                                                • C:\Users\Admin\AppData\Local\Temp\tmp9589.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp9589.tmp.exe"
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3728
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp9589.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmp9589.tmp.exe"
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    PID:2328
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:1544
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4836
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:1204
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\spoolsv.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2136
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\spoolsv.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2592
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\spoolsv.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:3256
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\taskhostw.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:228
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\taskhostw.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:1480
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\taskhostw.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4920
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\LiveKernelReports\csrss.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4924
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\csrss.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:1412
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\LiveKernelReports\csrss.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:816
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Saved Games\OfficeClickToRun.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4740
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2888
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Saved Games\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:708
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Windows\Speech\Registry.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4664
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Speech\Registry.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4316
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Windows\Speech\Registry.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2368
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe'" /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:4896
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2328
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Windows\SystemResources\Windows.UI.Shell\pris\sysmon.exe'" /rl HIGHEST /f
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2952

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                              Filesize

                                                              2KB

                                                              MD5

                                                              d85ba6ff808d9e5444a4b369f5bc2730

                                                              SHA1

                                                              31aa9d96590fff6981b315e0b391b575e4c0804a

                                                              SHA256

                                                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                              SHA512

                                                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log
                                                              Filesize

                                                              1KB

                                                              MD5

                                                              4a667f150a4d1d02f53a9f24d89d53d1

                                                              SHA1

                                                              306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

                                                              SHA256

                                                              414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

                                                              SHA512

                                                              4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                              Filesize

                                                              944B

                                                              MD5

                                                              6d3e9c29fe44e90aae6ed30ccf799ca8

                                                              SHA1

                                                              c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                              SHA256

                                                              2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                              SHA512

                                                              60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                              Filesize

                                                              944B

                                                              MD5

                                                              2e907f77659a6601fcc408274894da2e

                                                              SHA1

                                                              9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                              SHA256

                                                              385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                              SHA512

                                                              34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                              Filesize

                                                              944B

                                                              MD5

                                                              59d97011e091004eaffb9816aa0b9abd

                                                              SHA1

                                                              1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

                                                              SHA256

                                                              18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

                                                              SHA512

                                                              d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                              Filesize

                                                              944B

                                                              MD5

                                                              bd5940f08d0be56e65e5f2aaf47c538e

                                                              SHA1

                                                              d7e31b87866e5e383ab5499da64aba50f03e8443

                                                              SHA256

                                                              2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                                              SHA512

                                                              c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                              Filesize

                                                              944B

                                                              MD5

                                                              3a6bad9528f8e23fb5c77fbd81fa28e8

                                                              SHA1

                                                              f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                              SHA256

                                                              986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                              SHA512

                                                              846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\037959b1-97b9-4419-b825-64aabd5edf0b.vbs
                                                              Filesize

                                                              735B

                                                              MD5

                                                              8d4cef82858edcc48141dfd1558ac218

                                                              SHA1

                                                              1d16971401e9f1fa0caa4b51090174fff3394a4c

                                                              SHA256

                                                              b6a4eb4610578a1ec616acc5de05108a58b171a2e37a0b1288b38723661bd3e5

                                                              SHA512

                                                              1290ada7c2c9187936764f1a14186db4e18a7067274cf4eefe6dff7c1bc29b172c22547a72d998973e370ae4b0f9f4fe7f90f8d46d7643252d60ee346ac96c53

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\2cb33d44-1d30-40ac-9754-419ffd851922.vbs
                                                              Filesize

                                                              735B

                                                              MD5

                                                              773a7ed8dae3c95a0338c1ded4ba32c8

                                                              SHA1

                                                              03dce905e65c5b993133ac4d86c347ecdac8e3e5

                                                              SHA256

                                                              d20ee400fa1aa763d142f1d23ad00a9fdf0b0922fac9d354df47ea496c310760

                                                              SHA512

                                                              c22a91efa730cdb5d27fa7bb0ae750d80250134bdd0708fbd1af7ffed742cf1e4ee482be07805ee6c096c14175904b4ffc54640b31da44f323ed81cbc18aa64f

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\3d1acc75-1d7e-4fbb-a00d-44fba13a9546.vbs
                                                              Filesize

                                                              735B

                                                              MD5

                                                              59ce8cc8d41dc8e61572d74269bbb9ab

                                                              SHA1

                                                              3a0af89d53ef6d8bef57d0a31d5d28ddb5bdcb55

                                                              SHA256

                                                              1aca5a6101d863260741497ab7f974c9472678a02337e4a3580a03c242ba81c3

                                                              SHA512

                                                              a2546385ba2add96586f8dc17a9c192a6a34ce69f51029a2ecec426ce624bb566af15fd4e442c666384917854ab0e0b2b8e739d4984fe822a3cc981a7f5bbb49

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\6b9442e5-2b21-4c65-a651-f10139ac3878.vbs
                                                              Filesize

                                                              735B

                                                              MD5

                                                              4e5a37aa06df78da12c0725d009ae915

                                                              SHA1

                                                              575b452c446ea522441c8d995c2f745322ff5419

                                                              SHA256

                                                              de6411132f70618566499e17a125678b7f0fd730dfcc99b3a667a7c1fca3c0c7

                                                              SHA512

                                                              0b418bb8dd8d638f1682acbe752a9e0e644eb884adaad8f6584bfcb23800dcdd793a79c1c8ec2ab372a5a4e7a690e464c64c5844cce5bb1e5e3291e63f03fee7

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\772c7a0b-9ba2-4d6f-a1be-f9ae438aa238.vbs
                                                              Filesize

                                                              511B

                                                              MD5

                                                              3af1781223920899a7a5dfa60d8f6867

                                                              SHA1

                                                              6d78b34a1252a00234179fc6a35cb0832cac7c7e

                                                              SHA256

                                                              de92822044edaeef52f6662f059243b4517fac00315e9ae4c2622b1e7653a9e9

                                                              SHA512

                                                              3446f13e885289c4c0594ec539b2470d851a306f347f4439403e5aca93ad1759b506247c294ff46b4819f4c1e7244abedebcb3c5220bcaafa8fe9a749d1f9c1e

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\7b8efd84-2c6a-4f72-837b-bebb9ccf85cb.vbs
                                                              Filesize

                                                              735B

                                                              MD5

                                                              160d7d2e93a985cb1c097ba8c0f88e0b

                                                              SHA1

                                                              56d016946c0b2991cbb5512f1a7e276698336190

                                                              SHA256

                                                              16475340cd941663b54da9452bffbd65bc004c967dacbe923902035cfb23ef34

                                                              SHA512

                                                              52fa07c4c778e0f895f44c30797411b61425f98ecd706ca1cf09cf2f473d20184c7ada91917a028a8ec85f3289636f27bd330b80a87c8a3a5dafed38a55b5723

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\87f8bb88-69e3-4d1d-aa8e-9082dcf91b42.vbs
                                                              Filesize

                                                              734B

                                                              MD5

                                                              f8d848394cc5713ef4f1d7c31c439e80

                                                              SHA1

                                                              a899bea6716c67cbd33de19c6b1d847654ab844d

                                                              SHA256

                                                              8e0532fd8e0fb0d86e928a2be3d2c96832412dc4fdf80f5cc8df7cc1c9cca71b

                                                              SHA512

                                                              18975ace31ef79e7ae1f4716619411f74586837d291485f2b6478ad71184e6af87b103d6f55a0fe3ec383e95fb64940e77c4ed8c3b6728473f61bc68c29a555e

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fnkr4303.gor.ps1
                                                              Filesize

                                                              60B

                                                              MD5

                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                              SHA1

                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                              SHA256

                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                              SHA512

                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\a4dd63b9-4552-49e0-8b22-2f69f464574f.vbs
                                                              Filesize

                                                              735B

                                                              MD5

                                                              4d7fefb63d65a1cff8b6f591cff80797

                                                              SHA1

                                                              3944b86e94ebb3f804f8d9040cbfa7193d59b64c

                                                              SHA256

                                                              26080e14d92acdda031772620806a0cca553396cab52b2df0d39fa870e35efd0

                                                              SHA512

                                                              cf28050d4d5799a9485e9b3ed0ea2f0f2c6b88b192af93e65714e1a456f349e4fa79ab2954d6a3057c6dc575e1912d49efa9efcb1f3bd04865e3a3c9190ef78d

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\ec196439-a384-4f26-aef8-cadf6908725c.vbs
                                                              Filesize

                                                              735B

                                                              MD5

                                                              98d09bbbf30460acce97ab3aaefe0b5e

                                                              SHA1

                                                              acaa53481f3f0025fdb3287e35785f3848397a52

                                                              SHA256

                                                              1cbbb03114aebdea8a755d4338abb1c61e035c2b8f683524ad1815732ebe7c2c

                                                              SHA512

                                                              18325114304d1f7a4e4472ab90c1076b8bbd33dfd2536b2c5966d24745a59dbd66086d436449ebcedc19362d92c270b3c7ccaa47887890cf641b7424adbc5c9c

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\tmp7B7D.tmp.exe
                                                              Filesize

                                                              75KB

                                                              MD5

                                                              e0a68b98992c1699876f818a22b5b907

                                                              SHA1

                                                              d41e8ad8ba51217eb0340f8f69629ccb474484d0

                                                              SHA256

                                                              2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

                                                              SHA512

                                                              856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

                                                              Download Submit

                                                            • C:\Users\Default\Saved Games\OfficeClickToRun.exe
                                                              Filesize

                                                              4.9MB

                                                              MD5

                                                              6980bcd5d7d665f70f434120a1d20549

                                                              SHA1

                                                              8104f0c2f92ecb1ab9c6700f14d56059a93a9465

                                                              SHA256

                                                              c200cf3b7b2a80ea464716618af0d4f99588347d106c3bcea19773d760205e16

                                                              SHA512

                                                              2eb62827b55c986e2f6a076e9b5fb880bbcccc938d6581293f56ce9f2970a55f6bd27112486ccf20b792ef493cc7b1351a73a8bdda478af9b5c50e8ba0b00de3

                                                              Download Submit

                                                            • memory/516-154-0x000001BAB7770000-0x000001BAB7792000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/684-491-0x000000001D670000-0x000000001D772000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                              Download

                                                            • memory/1100-533-0x000000001D5D0000-0x000000001D6D2000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                              Download

                                                            • memory/2112-474-0x000000001CBB0000-0x000000001CCB2000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                              Download

                                                            • memory/2512-552-0x000000001CB90000-0x000000001CC92000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                              Download

                                                            • memory/3060-65-0x0000000000400000-0x0000000000407000-memory.dmp

                                                              Filesize

                                                              28KB

                                                              Download

                                                            • memory/3736-516-0x000000001CB80000-0x000000001CC82000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                              Download

                                                            • memory/4536-508-0x000000001D040000-0x000000001D142000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                              Download

                                                            • memory/4548-12-0x000000001C1A0000-0x000000001C6C8000-memory.dmp

                                                              Filesize

                                                              5.2MB

                                                              Download

                                                            • memory/4548-10-0x000000001B450000-0x000000001B45A000-memory.dmp

                                                              Filesize

                                                              40KB

                                                              Download

                                                            • memory/4548-18-0x000000001B520000-0x000000001B52C000-memory.dmp

                                                              Filesize

                                                              48KB

                                                              Download

                                                            • memory/4548-16-0x000000001B4B0000-0x000000001B4B8000-memory.dmp

                                                              Filesize

                                                              32KB

                                                              Download

                                                            • memory/4548-17-0x000000001B510000-0x000000001B518000-memory.dmp

                                                              Filesize

                                                              32KB

                                                              Download

                                                            • memory/4548-13-0x000000001B480000-0x000000001B48A000-memory.dmp

                                                              Filesize

                                                              40KB

                                                              Download

                                                            • memory/4548-14-0x000000001B490000-0x000000001B49E000-memory.dmp

                                                              Filesize

                                                              56KB

                                                              Download

                                                            • memory/4548-15-0x000000001B4A0000-0x000000001B4AE000-memory.dmp

                                                              Filesize

                                                              56KB

                                                              Download

                                                            • memory/4548-0-0x00007FF92B7C3000-0x00007FF92B7C5000-memory.dmp

                                                              Filesize

                                                              8KB

                                                              Download

                                                            • memory/4548-11-0x000000001B470000-0x000000001B482000-memory.dmp

                                                              Filesize

                                                              72KB

                                                              Download

                                                            • memory/4548-1-0x00000000001C0000-0x00000000006B4000-memory.dmp

                                                              Filesize

                                                              5.0MB

                                                              Download

                                                            • memory/4548-255-0x00007FF92B7C0000-0x00007FF92C281000-memory.dmp

                                                              Filesize

                                                              10.8MB

                                                              Download

                                                            • memory/4548-5-0x000000001B4C0000-0x000000001B510000-memory.dmp

                                                              Filesize

                                                              320KB

                                                              Download

                                                            • memory/4548-6-0x00000000028D0000-0x00000000028D8000-memory.dmp

                                                              Filesize

                                                              32KB

                                                              Download

                                                            • memory/4548-8-0x000000001B420000-0x000000001B436000-memory.dmp

                                                              Filesize

                                                              88KB

                                                              Download

                                                            • memory/4548-2-0x00007FF92B7C0000-0x00007FF92C281000-memory.dmp

                                                              Filesize

                                                              10.8MB

                                                              Download

                                                            • memory/4548-9-0x000000001B440000-0x000000001B450000-memory.dmp

                                                              Filesize

                                                              64KB

                                                              Download

                                                            • memory/4548-7-0x00000000028F0000-0x0000000002900000-memory.dmp

                                                              Filesize

                                                              64KB

                                                              Download

                                                            • memory/4548-4-0x00000000028B0000-0x00000000028CC000-memory.dmp

                                                              Filesize

                                                              112KB

                                                              Download

                                                            • memory/4548-3-0x000000001B540000-0x000000001B66E000-memory.dmp

                                                              Filesize

                                                              1.2MB

                                                              Download

                                                            • memory/4984-360-0x000000001C020000-0x000000001C032000-memory.dmp

                                                              Filesize

                                                              72KB

                                                              Download

                                                            • memory/5068-457-0x000000001CAB0000-0x000000001CBB2000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                              Download