Overview

overview

10

Static

static

3

31b10a4ebf...2N.exe

windows7-x64

10

31b10a4ebf...2N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2024 16:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N.exe

  • Size

    4.9MB

  • MD5

    4f2a2b2ffa4db5771f5e9f6927ee7390

  • SHA1

    dbcc615437c6925f3e18010854607e66c3e5bce3

  • SHA256

    31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2

  • SHA512

    51493c4ef3de3a62f6b630f24daf609d509a23cc1f663311496794a49e932fab57c0196f88688ddcd939028eead0bf46b2979bf5042c1ab5de3a0605a67c2f8e

  • SSDEEP

    49152:rl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score
10/10
colibridcratbuild1discoveryevasionexecutioninfostealerloaderrattrojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain

Signatures

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri
  • Colibri family
    colibri
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 36 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 36 IoCs
    evasiontrojan
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 32 IoCs
  • Checks whether UAC is enabled 1 TTPs 24 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 10 IoCs
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 12 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 36 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N.exe
    "C:\Users\Admin\AppData\Local\Temp\31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\tmpB4CC.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpB4CC.tmp.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:632
      • C:\Users\Admin\AppData\Local\Temp\tmpB4CC.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmpB4CC.tmp.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1772
        • C:\Users\Admin\AppData\Local\Temp\tmpB4CC.tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\tmpB4CC.tmp.exe"
          4⤵
          • Executes dropped EXE
          PID:1128
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4288
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3932
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4800
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2628
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5040
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4512
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4924
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1672
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4744
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1172
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1860
    • C:\Windows\ShellComponents\System.exe
      "C:\Windows\ShellComponents\System.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4588
      • C:\Users\Admin\AppData\Local\Temp\tmpDD7F.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmpDD7F.tmp.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4676
        • C:\Users\Admin\AppData\Local\Temp\tmpDD7F.tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\tmpDD7F.tmp.exe"
          4⤵
          • Executes dropped EXE
          PID:440
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\011faf4b-92bc-408e-8ff3-a6662252933f.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1276
        • C:\Windows\ShellComponents\System.exe
          C:\Windows\ShellComponents\System.exe
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2972
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\695a3016-764d-4e87-88ba-678815289079.vbs"
            5⤵
              PID:2548
              • C:\Windows\ShellComponents\System.exe
                C:\Windows\ShellComponents\System.exe
                6⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • System policy modification
                PID:1108
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d2737e3f-cf74-4f49-a216-9d8bdecc1e61.vbs"
                  7⤵
                    PID:4164
                    • C:\Windows\ShellComponents\System.exe
                      C:\Windows\ShellComponents\System.exe
                      8⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • System policy modification
                      PID:4336
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d9187353-48cb-4f9e-961b-9e1b24b4c8b8.vbs"
                        9⤵
                          PID:1816
                          • C:\Windows\ShellComponents\System.exe
                            C:\Windows\ShellComponents\System.exe
                            10⤵
                            • UAC bypass
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • System policy modification
                            PID:5108
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e42fcf3-1e77-4909-88ea-d922ac1d9170.vbs"
                              11⤵
                                PID:1980
                                • C:\Windows\ShellComponents\System.exe
                                  C:\Windows\ShellComponents\System.exe
                                  12⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • System policy modification
                                  PID:3808
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34b4d0a7-36d2-4e06-971c-feb86bf86318.vbs"
                                    13⤵
                                      PID:1708
                                      • C:\Windows\ShellComponents\System.exe
                                        C:\Windows\ShellComponents\System.exe
                                        14⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:2020
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6aa23287-bd31-41bb-8968-67d266dab9a6.vbs"
                                          15⤵
                                            PID:2508
                                            • C:\Windows\ShellComponents\System.exe
                                              C:\Windows\ShellComponents\System.exe
                                              16⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:4788
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48c51488-76ac-454a-a96c-b8b8be10d72a.vbs"
                                                17⤵
                                                  PID:4480
                                                  • C:\Windows\ShellComponents\System.exe
                                                    C:\Windows\ShellComponents\System.exe
                                                    18⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:2340
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f88d1a3-482b-4e43-ae31-a0f70e017d19.vbs"
                                                      19⤵
                                                        PID:4940
                                                        • C:\Windows\ShellComponents\System.exe
                                                          C:\Windows\ShellComponents\System.exe
                                                          20⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:4076
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e1a614be-0ca2-43c8-a5b3-ab75507dbe18.vbs"
                                                            21⤵
                                                              PID:2560
                                                              • C:\Windows\ShellComponents\System.exe
                                                                C:\Windows\ShellComponents\System.exe
                                                                22⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:3444
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9b45c1d1-357a-4b4d-b504-59506b6df828.vbs"
                                                                  23⤵
                                                                    PID:1504
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0494594c-5458-4f61-b823-770db0a117d7.vbs"
                                                                    23⤵
                                                                      PID:1016
                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp742C.tmp.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\tmp742C.tmp.exe"
                                                                      23⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4200
                                                                      • C:\Users\Admin\AppData\Local\Temp\tmp742C.tmp.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\tmp742C.tmp.exe"
                                                                        24⤵
                                                                        • Executes dropped EXE
                                                                        PID:3492
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f5753c7-ba0b-4c18-9f99-9e76e617b69a.vbs"
                                                                  21⤵
                                                                    PID:3580
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6109454f-e509-4949-a520-bd992b863915.vbs"
                                                                19⤵
                                                                  PID:4420
                                                                • C:\Users\Admin\AppData\Local\Temp\tmp26F7.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp26F7.tmp.exe"
                                                                  19⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2200
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp26F7.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmp26F7.tmp.exe"
                                                                    20⤵
                                                                    • Executes dropped EXE
                                                                    PID:3316
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39f6df77-ffb1-4573-8052-da3114c87203.vbs"
                                                              17⤵
                                                                PID:2176
                                                              • C:\Users\Admin\AppData\Local\Temp\tmpF354.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmpF354.tmp.exe"
                                                                17⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4536
                                                                • C:\Users\Admin\AppData\Local\Temp\tmpF354.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmpF354.tmp.exe"
                                                                  18⤵
                                                                  • Executes dropped EXE
                                                                  PID:432
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8ddba66d-a107-4861-8aee-a6582f086acd.vbs"
                                                            15⤵
                                                              PID:912
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c24633a6-ab1f-4c9e-b20f-e80141f311e8.vbs"
                                                          13⤵
                                                            PID:784
                                                          • C:\Users\Admin\AppData\Local\Temp\tmpA19A.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmpA19A.tmp.exe"
                                                            13⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2080
                                                            • C:\Users\Admin\AppData\Local\Temp\tmpA19A.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmpA19A.tmp.exe"
                                                              14⤵
                                                              • Executes dropped EXE
                                                              PID:1204
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33c59537-747e-4436-af89-f52e3ae781c6.vbs"
                                                        11⤵
                                                          PID:4048
                                                        • C:\Users\Admin\AppData\Local\Temp\tmp6CBF.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmp6CBF.tmp.exe"
                                                          11⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1864
                                                          • C:\Users\Admin\AppData\Local\Temp\tmp6CBF.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmp6CBF.tmp.exe"
                                                            12⤵
                                                            • Executes dropped EXE
                                                            PID:2648
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34e58ed6-6180-4bc9-834e-9c28ab0fb3a8.vbs"
                                                      9⤵
                                                        PID:5032
                                                      • C:\Users\Admin\AppData\Local\Temp\tmp4F54.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmp4F54.tmp.exe"
                                                        9⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1408
                                                        • C:\Users\Admin\AppData\Local\Temp\tmp4F54.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmp4F54.tmp.exe"
                                                          10⤵
                                                          • Executes dropped EXE
                                                          PID:2200
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1759f6e1-e63e-430d-803e-4bfa0fe60eee.vbs"
                                                    7⤵
                                                      PID:2396
                                                    • C:\Users\Admin\AppData\Local\Temp\tmp31B9.tmp.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\tmp31B9.tmp.exe"
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4792
                                                      • C:\Users\Admin\AppData\Local\Temp\tmp31B9.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmp31B9.tmp.exe"
                                                        8⤵
                                                        • Executes dropped EXE
                                                        PID:512
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0474aac5-1391-49a6-bf41-fc6141f65dbd.vbs"
                                                  5⤵
                                                    PID:2664
                                                  • C:\Users\Admin\AppData\Local\Temp\tmpFFBD.tmp.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\tmpFFBD.tmp.exe"
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2488
                                                    • C:\Users\Admin\AppData\Local\Temp\tmpFFBD.tmp.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\tmpFFBD.tmp.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      PID:784
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36cc0112-55e4-46d9-ba63-fd600f2a09f6.vbs"
                                                3⤵
                                                  PID:916
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2868
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3460
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4188
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3288
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3996
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:5040
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N3" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1088
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:552
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N3" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:5032
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3688
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4448
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1408
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Windows\Migration\WTR\taskhostw.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2472
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\taskhostw.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2832
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Windows\Migration\WTR\taskhostw.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2780
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4048
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4700
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3896
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\ShellComponents\System.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2112
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\ShellComponents\System.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1668
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellComponents\System.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3160
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft\dllhost.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2152
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\dllhost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2168
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\dllhost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1140
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N3" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\host\31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:508
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4076
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N3" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\host\31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2N.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4360
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3504
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3668
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3576
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\unsecapp.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1612
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\unsecapp.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4428
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\unsecapp.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4276
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\dwm.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2428
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3256
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3388

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Recovery\WindowsRE\sihost.exe
                                              Filesize

                                              4.9MB

                                              MD5

                                              4f2820048bf0e013adc67493d3bd1c21

                                              SHA1

                                              402e2d40a155542ea2b8bdfb7961ed69a3ddc73b

                                              SHA256

                                              fe10468c1ef634ebbea2828127ff0e311aa1fe571da57d9632064547ac598921

                                              SHA512

                                              b299e28ded1792ce5da7f82a265d801ee686ade6f3d5928ddaf743c0cdbb24105eb5afe551ac8d794fd7db431d9782666acf3de93531dcb7de1b1b51e8b8fc27

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System.exe.log
                                              Filesize

                                              1KB

                                              MD5

                                              4a667f150a4d1d02f53a9f24d89d53d1

                                              SHA1

                                              306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

                                              SHA256

                                              414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

                                              SHA512

                                              4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                              Filesize

                                              2KB

                                              MD5

                                              d85ba6ff808d9e5444a4b369f5bc2730

                                              SHA1

                                              31aa9d96590fff6981b315e0b391b575e4c0804a

                                              SHA256

                                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                              SHA512

                                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              Filesize

                                              944B

                                              MD5

                                              bd5940f08d0be56e65e5f2aaf47c538e

                                              SHA1

                                              d7e31b87866e5e383ab5499da64aba50f03e8443

                                              SHA256

                                              2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                              SHA512

                                              c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              Filesize

                                              944B

                                              MD5

                                              cadef9abd087803c630df65264a6c81c

                                              SHA1

                                              babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                              SHA256

                                              cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                              SHA512

                                              7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\011faf4b-92bc-408e-8ff3-a6662252933f.vbs
                                              Filesize

                                              713B

                                              MD5

                                              d6ab849b9dc9b6ce06d427d7bb1ae437

                                              SHA1

                                              0755a63ea10c0eef3af2f737c1343584ca758577

                                              SHA256

                                              4e44c94a366df8ed98c9f577969515573184165b7e8fb5f0b6f4b2dad060db38

                                              SHA512

                                              990556f22f049d1235ac78a2701167c44247b789d6cc3d8f154e6d336220170367becf2d1744dbeca35cff80b2d69d1f463f54f77f72adf077de8cad35ff2776

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\34b4d0a7-36d2-4e06-971c-feb86bf86318.vbs
                                              Filesize

                                              713B

                                              MD5

                                              44be681e5f2fa1a201d99824a59b263c

                                              SHA1

                                              f37e4378e86c3d5276d5f83df6647d275ce15c79

                                              SHA256

                                              42ac34a0bf9ea3b4e2e6666a1393c48ea200ad4c51b775883131c8f38b042206

                                              SHA512

                                              4a82cf7b5aad84cac7836224f356a16e742291b1a5e93d6860f35f1feeaf5a98f24cafba743cafbe2bc3d23b36f5a6eb6baeb00da9ea4f317f22a20fa4aebac5

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\36cc0112-55e4-46d9-ba63-fd600f2a09f6.vbs
                                              Filesize

                                              489B

                                              MD5

                                              1ab2e04e92b45a1a3d61d48079e5100a

                                              SHA1

                                              ce0e9e6f3eec3d2ac623995d623e2d0a69cacda2

                                              SHA256

                                              4d860cd2490ee5e659312804a1786f097d0956360a2b43f22976b9d96cdb8a33

                                              SHA512

                                              8cdcce31afc317291e3b378f1c4ac9cdf7a8fa20cddc49f9e418e8d7ff3387874b5fc0863adae4251e98c330ffbeeef7b36cef6a79bdcd9b8e70e4d1568044c2

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\695a3016-764d-4e87-88ba-678815289079.vbs
                                              Filesize

                                              713B

                                              MD5

                                              9029524f981d553ab60d11a98273af49

                                              SHA1

                                              7085869dddb1d8483e07c7a4d91896855083fbac

                                              SHA256

                                              bd1b09c4644430a24a62a09a6f30fc74368e2ed7c70f22a5ce31a94f6cfe3305

                                              SHA512

                                              c6f8cf350371e7a12aaeda8fe89be0fb73e26e5852512a62947df55c2b147e2dc1fd2e9d4952110e2cfb1e8e94cfeba798573dd2549f713848a53e99bce7b2a3

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\6aa23287-bd31-41bb-8968-67d266dab9a6.vbs
                                              Filesize

                                              713B

                                              MD5

                                              a96c798de18f80e4903913da18900624

                                              SHA1

                                              761a15477c4b05f2e89a835f81d88596fd9489f4

                                              SHA256

                                              95153f9103cd7e7b3699b6ab11502daa7d98c6775e9dbd8df3192bd269d2befd

                                              SHA512

                                              121137af120416fd134132030b8b894dab45c65db15d4495861b6d2a94619ed4b8190d802f9ee5b0d706b2c433cf7fdc4cd0e9ea3d1aa5a2dcb00c3160f0a455

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\8e42fcf3-1e77-4909-88ea-d922ac1d9170.vbs
                                              Filesize

                                              713B

                                              MD5

                                              7e2c6212b84313690af10c690ed892f7

                                              SHA1

                                              40c8c3235f61e2e6ff33a65c3312e76c4582424d

                                              SHA256

                                              d65604abfa69ce00d1f00626c238fb1e46ae5b142fea459a854252cf135932fa

                                              SHA512

                                              bc064488f1f458829db04c9e9f121b6165f46b50e2fef369e15303a66940c4bb1aa8ba50e6601b392a45e2df58d8e9dea33edd97f4444a36b2cc4bf87306d779

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gjq321nh.zfr.ps1
                                              Filesize

                                              60B

                                              MD5

                                              d17fe0a3f47be24a6453e9ef58c94641

                                              SHA1

                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                              SHA256

                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                              SHA512

                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\d2737e3f-cf74-4f49-a216-9d8bdecc1e61.vbs
                                              Filesize

                                              713B

                                              MD5

                                              e87233ea1747c535704d54931960d526

                                              SHA1

                                              5c24cee86fb2e2f324434db3cfc7124f4a288825

                                              SHA256

                                              c97bcc6a4489b134a69720e62dc16764faae73130264190deefe29c1f03c3920

                                              SHA512

                                              904e7cf25e3a2e1a93007dd8111ebcd9b7a1db395be3ca10ce4e07852af04236d9fec56a512288af8a644647b718f41c0ad7e72fdeb861e57cdb03f3034a4d0d

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\d9187353-48cb-4f9e-961b-9e1b24b4c8b8.vbs
                                              Filesize

                                              713B

                                              MD5

                                              d51da823720b61b937f67c43680a22ba

                                              SHA1

                                              65114a5ad9362b59209b7c94bd3735bb8447564b

                                              SHA256

                                              fa466c7d67c88799d1193f7cdf1c017cd451a780fc31a86354500c72f8dd64fc

                                              SHA512

                                              874ce8f956fca27b8e8801020e0db5083969557d3399488ebfb491a162d3aad329e467a049be31e8d21ae61722462f62999ecc13bff461147a4ade48deaeb154

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\tmpB4CC.tmp.exe
                                              Filesize

                                              75KB

                                              MD5

                                              e0a68b98992c1699876f818a22b5b907

                                              SHA1

                                              d41e8ad8ba51217eb0340f8f69629ccb474484d0

                                              SHA256

                                              2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

                                              SHA512

                                              856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

                                              Download Submit

                                            • C:\Windows\Migration\WTR\taskhostw.exe
                                              Filesize

                                              4.9MB

                                              MD5

                                              4f2a2b2ffa4db5771f5e9f6927ee7390

                                              SHA1

                                              dbcc615437c6925f3e18010854607e66c3e5bce3

                                              SHA256

                                              31b10a4ebf0f0a98a283f4fd5cd09f18be036846d59d9528b5e28112debf98e2

                                              SHA512

                                              51493c4ef3de3a62f6b630f24daf609d509a23cc1f663311496794a49e932fab57c0196f88688ddcd939028eead0bf46b2979bf5042c1ab5de3a0605a67c2f8e

                                              Download Submit

                                            • memory/1128-72-0x0000000000400000-0x0000000000407000-memory.dmp

                                              Filesize

                                              28KB

                                              Download

                                            • memory/2848-299-0x00007FFA89BB0000-0x00007FFA8A671000-memory.dmp

                                              Filesize

                                              10.8MB

                                              Download

                                            • memory/2848-2-0x00007FFA89BB0000-0x00007FFA8A671000-memory.dmp

                                              Filesize

                                              10.8MB

                                              Download

                                            • memory/2848-17-0x000000001C7F0000-0x000000001C7F8000-memory.dmp

                                              Filesize

                                              32KB

                                              Download

                                            • memory/2848-0-0x00007FFA89BB3000-0x00007FFA89BB5000-memory.dmp

                                              Filesize

                                              8KB

                                              Download

                                            • memory/2848-18-0x000000001C900000-0x000000001C90C000-memory.dmp

                                              Filesize

                                              48KB

                                              Download

                                            • memory/2848-15-0x000000001C7D0000-0x000000001C7DE000-memory.dmp

                                              Filesize

                                              56KB

                                              Download

                                            • memory/2848-137-0x00007FFA89BB3000-0x00007FFA89BB5000-memory.dmp

                                              Filesize

                                              8KB

                                              Download

                                            • memory/2848-13-0x000000001C760000-0x000000001C76A000-memory.dmp

                                              Filesize

                                              40KB

                                              Download

                                            • memory/2848-12-0x000000001CD00000-0x000000001D228000-memory.dmp

                                              Filesize

                                              5.2MB

                                              Download

                                            • memory/2848-287-0x00007FFA89BB0000-0x00007FFA8A671000-memory.dmp

                                              Filesize

                                              10.8MB

                                              Download

                                            • memory/2848-1-0x0000000000D60000-0x0000000001254000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/2848-16-0x000000001C7E0000-0x000000001C7E8000-memory.dmp

                                              Filesize

                                              32KB

                                              Download

                                            • memory/2848-9-0x00000000034B0000-0x00000000034C0000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2848-10-0x000000001BFE0000-0x000000001BFEA000-memory.dmp

                                              Filesize

                                              40KB

                                              Download

                                            • memory/2848-11-0x000000001C750000-0x000000001C762000-memory.dmp

                                              Filesize

                                              72KB

                                              Download

                                            • memory/2848-8-0x000000001C730000-0x000000001C746000-memory.dmp

                                              Filesize

                                              88KB

                                              Download

                                            • memory/2848-5-0x000000001C780000-0x000000001C7D0000-memory.dmp

                                              Filesize

                                              320KB

                                              Download

                                            • memory/2848-6-0x0000000003300000-0x0000000003308000-memory.dmp

                                              Filesize

                                              32KB

                                              Download

                                            • memory/2848-7-0x00000000034A0000-0x00000000034B0000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/2848-4-0x0000000003470000-0x000000000348C000-memory.dmp

                                              Filesize

                                              112KB

                                              Download

                                            • memory/2848-3-0x000000001C000000-0x000000001C12E000-memory.dmp

                                              Filesize

                                              1.2MB

                                              Download

                                            • memory/2848-14-0x000000001C770000-0x000000001C77E000-memory.dmp

                                              Filesize

                                              56KB

                                              Download

                                            • memory/3444-513-0x000000001BC20000-0x000000001BC32000-memory.dmp

                                              Filesize

                                              72KB

                                              Download

                                            • memory/4512-193-0x000001BB62A40000-0x000001BB62A62000-memory.dmp

                                              Filesize

                                              136KB

                                              Download