Overview

overview

10

Static

static

3

1982e9b7f3...aN.exe

windows7-x64

10

1982e9b7f3...aN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2024 15:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1982e9b7f36a5bddaac372b2e6fea5cdacbd238bcfb1c548d1184044437488eaN.exe

  • Size

    4.9MB

  • MD5

    9c9a433ffb088d490ec324f3d76d9520

  • SHA1

    60f30b59520078f280e4ff966d727c1fbea7058a

  • SHA256

    1982e9b7f36a5bddaac372b2e6fea5cdacbd238bcfb1c548d1184044437488ea

  • SHA512

    fe78c7cec8d6e752712912dc54ae71c53bfbadc59577031590c1d4e9756bb3a06a9421cbc94ec71672667db80c97a570df288089904b01f8d26bb79466baaead

  • SSDEEP

    49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score
10/10
colibridcratbuild1discoveryevasionexecutioninfostealerloaderrattrojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain

Signatures

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri
  • Colibri family
    colibri
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 36 IoCs
    evasiontrojan
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 39 IoCs
  • Checks whether UAC is enabled 1 TTPs 24 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 11 IoCs
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 11 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 36 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\1982e9b7f36a5bddaac372b2e6fea5cdacbd238bcfb1c548d1184044437488eaN.exe
    "C:\Users\Admin\AppData\Local\Temp\1982e9b7f36a5bddaac372b2e6fea5cdacbd238bcfb1c548d1184044437488eaN.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1608
    • C:\Users\Admin\AppData\Local\Temp\tmpA2E9.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpA2E9.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Users\Admin\AppData\Local\Temp\tmpA2E9.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmpA2E9.tmp.exe"
        3⤵
        • Executes dropped EXE
        PID:2888
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3588
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1896
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:732
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1596
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2676
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4116
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3352
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5064
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5016
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3172
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1016
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YKtyItKL0f.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4312
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:4224
        • C:\Users\Admin\Recent\sysmon.exe
          "C:\Users\Admin\Recent\sysmon.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3600
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f6b0ba6-4b49-40dc-b7dd-777115c155f8.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1960
            • C:\Users\Admin\Recent\sysmon.exe
              C:\Users\Admin\Recent\sysmon.exe
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2772
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\018dfc38-558a-4e0b-a5ae-2ac066db36a7.vbs"
                6⤵
                  PID:2616
                  • C:\Users\Admin\Recent\sysmon.exe
                    C:\Users\Admin\Recent\sysmon.exe
                    7⤵
                    • UAC bypass
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • System policy modification
                    PID:904
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\17c1d1c1-23c8-488b-8d02-38b1c6b6cf63.vbs"
                      8⤵
                        PID:680
                        • C:\Users\Admin\Recent\sysmon.exe
                          C:\Users\Admin\Recent\sysmon.exe
                          9⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • System policy modification
                          PID:4684
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44ab7c92-f463-47b6-8f89-65b258971cb7.vbs"
                            10⤵
                              PID:4936
                              • C:\Users\Admin\Recent\sysmon.exe
                                C:\Users\Admin\Recent\sysmon.exe
                                11⤵
                                • UAC bypass
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • System policy modification
                                PID:5044
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\992f3fff-104d-4a58-a8cd-003a0f3dc5b7.vbs"
                                  12⤵
                                    PID:4412
                                    • C:\Users\Admin\Recent\sysmon.exe
                                      C:\Users\Admin\Recent\sysmon.exe
                                      13⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • System policy modification
                                      PID:3736
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a18dfb3-7317-4c7f-9f67-1312d9a99dff.vbs"
                                        14⤵
                                          PID:3968
                                          • C:\Users\Admin\Recent\sysmon.exe
                                            C:\Users\Admin\Recent\sysmon.exe
                                            15⤵
                                            • UAC bypass
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • System policy modification
                                            PID:2124
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3ae7bc2-81c6-47c0-b1ff-eb7171935f4d.vbs"
                                              16⤵
                                                PID:1892
                                                • C:\Users\Admin\Recent\sysmon.exe
                                                  C:\Users\Admin\Recent\sysmon.exe
                                                  17⤵
                                                  • UAC bypass
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • System policy modification
                                                  PID:2620
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5345d554-7f19-4dae-a70b-e2b92517f04d.vbs"
                                                    18⤵
                                                      PID:824
                                                      • C:\Users\Admin\Recent\sysmon.exe
                                                        C:\Users\Admin\Recent\sysmon.exe
                                                        19⤵
                                                        • UAC bypass
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • System policy modification
                                                        PID:2308
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44f0c02e-b648-4a3c-94ac-6f3371809d2f.vbs"
                                                          20⤵
                                                            PID:3200
                                                            • C:\Users\Admin\Recent\sysmon.exe
                                                              C:\Users\Admin\Recent\sysmon.exe
                                                              21⤵
                                                              • UAC bypass
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • System policy modification
                                                              PID:2460
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7c4323e-acd4-446d-acbe-9f9c21e2dbde.vbs"
                                                                22⤵
                                                                  PID:2152
                                                                  • C:\Users\Admin\Recent\sysmon.exe
                                                                    C:\Users\Admin\Recent\sysmon.exe
                                                                    23⤵
                                                                    • UAC bypass
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • System policy modification
                                                                    PID:392
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f097deb3-df9b-4833-995e-2bd08a35043a.vbs"
                                                                  22⤵
                                                                    PID:3968
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp41C2.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmp41C2.tmp.exe"
                                                                    22⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4360
                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp41C2.tmp.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\tmp41C2.tmp.exe"
                                                                      23⤵
                                                                      • Executes dropped EXE
                                                                      PID:2208
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8dcfe1c0-4cec-4b91-91ce-a549333b3b1b.vbs"
                                                                20⤵
                                                                  PID:3196
                                                                • C:\Users\Admin\AppData\Local\Temp\tmp261C.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp261C.tmp.exe"
                                                                  20⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:3360
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp261C.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmp261C.tmp.exe"
                                                                    21⤵
                                                                    • Executes dropped EXE
                                                                    PID:2392
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4eb01e3f-d59a-4e87-afcd-220bbe47552b.vbs"
                                                              18⤵
                                                                PID:2712
                                                              • C:\Users\Admin\AppData\Local\Temp\tmpF548.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmpF548.tmp.exe"
                                                                18⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4076
                                                                • C:\Users\Admin\AppData\Local\Temp\tmpF548.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmpF548.tmp.exe"
                                                                  19⤵
                                                                  • Executes dropped EXE
                                                                  PID:4124
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96b80253-3b88-4b06-8cc6-c1b296b8869a.vbs"
                                                            16⤵
                                                              PID:3192
                                                            • C:\Users\Admin\AppData\Local\Temp\tmpC445.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmpC445.tmp.exe"
                                                              16⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3576
                                                              • C:\Users\Admin\AppData\Local\Temp\tmpC445.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmpC445.tmp.exe"
                                                                17⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4816
                                                                • C:\Users\Admin\AppData\Local\Temp\tmpC445.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmpC445.tmp.exe"
                                                                  18⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2356
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpC445.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmpC445.tmp.exe"
                                                                    19⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2460
                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpC445.tmp.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\tmpC445.tmp.exe"
                                                                      20⤵
                                                                      • Executes dropped EXE
                                                                      PID:1828
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9143e25-e91a-40ee-9b17-d0e43a9ae270.vbs"
                                                          14⤵
                                                            PID:3976
                                                          • C:\Users\Admin\AppData\Local\Temp\tmpA63E.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmpA63E.tmp.exe"
                                                            14⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3520
                                                            • C:\Users\Admin\AppData\Local\Temp\tmpA63E.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmpA63E.tmp.exe"
                                                              15⤵
                                                              • Executes dropped EXE
                                                              PID:2516
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9a20c679-2980-4457-bef8-36670ee03f7a.vbs"
                                                        12⤵
                                                          PID:3652
                                                        • C:\Users\Admin\AppData\Local\Temp\tmp878A.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmp878A.tmp.exe"
                                                          12⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3240
                                                          • C:\Users\Admin\AppData\Local\Temp\tmp878A.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmp878A.tmp.exe"
                                                            13⤵
                                                            • Executes dropped EXE
                                                            PID:2980
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\784e28eb-316b-42da-8581-0cbd6d38f60c.vbs"
                                                      10⤵
                                                        PID:932
                                                      • C:\Users\Admin\AppData\Local\Temp\tmp55BC.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmp55BC.tmp.exe"
                                                        10⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4536
                                                        • C:\Users\Admin\AppData\Local\Temp\tmp55BC.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmp55BC.tmp.exe"
                                                          11⤵
                                                          • Executes dropped EXE
                                                          PID:3588
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67527e79-344a-4dd3-b3dd-6e820b3b7d25.vbs"
                                                    8⤵
                                                      PID:3972
                                                    • C:\Users\Admin\AppData\Local\Temp\tmp38DE.tmp.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\tmp38DE.tmp.exe"
                                                      8⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2204
                                                      • C:\Users\Admin\AppData\Local\Temp\tmp38DE.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmp38DE.tmp.exe"
                                                        9⤵
                                                        • Executes dropped EXE
                                                        PID:3656
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91636ffe-46d3-47af-9ed6-4750011d0567.vbs"
                                                  6⤵
                                                    PID:1748
                                                  • C:\Users\Admin\AppData\Local\Temp\tmp8A6.tmp.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\tmp8A6.tmp.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4360
                                                    • C:\Users\Admin\AppData\Local\Temp\tmp8A6.tmp.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\tmp8A6.tmp.exe"
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1328
                                                      • C:\Users\Admin\AppData\Local\Temp\tmp8A6.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmp8A6.tmp.exe"
                                                        8⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3928
                                                        • C:\Users\Admin\AppData\Local\Temp\tmp8A6.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmp8A6.tmp.exe"
                                                          9⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5076
                                                          • C:\Users\Admin\AppData\Local\Temp\tmp8A6.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmp8A6.tmp.exe"
                                                            10⤵
                                                            • Executes dropped EXE
                                                            PID:4448
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\692f23f1-6a13-4237-8043-3ca53ed7b262.vbs"
                                                4⤵
                                                  PID:4592
                                                • C:\Users\Admin\AppData\Local\Temp\tmpD7E1.tmp.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\tmpD7E1.tmp.exe"
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4608
                                                  • C:\Users\Admin\AppData\Local\Temp\tmpD7E1.tmp.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\tmpD7E1.tmp.exe"
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:1196
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\SppExtComObj.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1260
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\SppExtComObj.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:232
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\SppExtComObj.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1280
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\NetHood\unsecapp.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4572
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\unsecapp.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4936
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\NetHood\unsecapp.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2424
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\sihost.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:5000
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\sihost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2008
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\sihost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1436
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\images\explorer.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4592
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\images\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:948
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\images\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4380
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\Idle.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1732
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3292
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4496
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1888
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2272
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:620
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Recent\sysmon.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2380
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Admin\Recent\sysmon.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2620
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Recent\sysmon.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4600
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4492
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1176
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4448

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\Idle.exe
                                            Filesize

                                            4.9MB

                                            MD5

                                            9c9a433ffb088d490ec324f3d76d9520

                                            SHA1

                                            60f30b59520078f280e4ff966d727c1fbea7058a

                                            SHA256

                                            1982e9b7f36a5bddaac372b2e6fea5cdacbd238bcfb1c548d1184044437488ea

                                            SHA512

                                            fe78c7cec8d6e752712912dc54ae71c53bfbadc59577031590c1d4e9756bb3a06a9421cbc94ec71672667db80c97a570df288089904b01f8d26bb79466baaead

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                            Filesize

                                            2KB

                                            MD5

                                            d85ba6ff808d9e5444a4b369f5bc2730

                                            SHA1

                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                            SHA256

                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                            SHA512

                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log
                                            Filesize

                                            1KB

                                            MD5

                                            4a667f150a4d1d02f53a9f24d89d53d1

                                            SHA1

                                            306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

                                            SHA256

                                            414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

                                            SHA512

                                            4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            d28a889fd956d5cb3accfbaf1143eb6f

                                            SHA1

                                            157ba54b365341f8ff06707d996b3635da8446f7

                                            SHA256

                                            21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                            SHA512

                                            0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            6d3e9c29fe44e90aae6ed30ccf799ca8

                                            SHA1

                                            c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                            SHA256

                                            2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                            SHA512

                                            60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            3a6bad9528f8e23fb5c77fbd81fa28e8

                                            SHA1

                                            f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                            SHA256

                                            986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                            SHA512

                                            846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            62623d22bd9e037191765d5083ce16a3

                                            SHA1

                                            4a07da6872672f715a4780513d95ed8ddeefd259

                                            SHA256

                                            95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                            SHA512

                                            9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\018dfc38-558a-4e0b-a5ae-2ac066db36a7.vbs
                                            Filesize

                                            708B

                                            MD5

                                            35d9cacc4a33696c701b374b3208491d

                                            SHA1

                                            ae516d65875c4e35b43bdfda237d5b5dde634c6e

                                            SHA256

                                            32752524889ff8b76b36b44fe5acfb4ce9d96f2f0e998988d12a89848054230b

                                            SHA512

                                            d29067e9612c066a3d35ab21b32e7e9c4b6691f18ea0b8578ebdb57336d56bbbdade1c372635aebf5b4ca8f5c32607e63f5d108d98bc848bc89acea2958ad280

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\17c1d1c1-23c8-488b-8d02-38b1c6b6cf63.vbs
                                            Filesize

                                            707B

                                            MD5

                                            f27a67ae83a61b5e074973f9c2599938

                                            SHA1

                                            deff751ac96d471d4ab4f2d1f83c329bb384456b

                                            SHA256

                                            37dbea9c14b226d34b239e676edd2e2e46fd77fd8bb3ad76f09719e4c1952c51

                                            SHA512

                                            953e299bb08b308c28ef48b7827005029dc1d07eeacdd05daa2d50624520dd41a6eab791e89b6f7fcda27bfe5a2f2a90fdace7bbcf8ebd1acb86996b270c3989

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\44ab7c92-f463-47b6-8f89-65b258971cb7.vbs
                                            Filesize

                                            708B

                                            MD5

                                            2a173ee1f09410c23dbf6d8b4400f97d

                                            SHA1

                                            e54f710bcffa5d17101a165fc196d4170ad7a678

                                            SHA256

                                            d445165ccb9ebed00d7ea02848fa5560d59e44cb5d43635b079408bcb9d32e16

                                            SHA512

                                            84cc09bfc16a82c56d558b9dd332fa8c88acb7860315256ae3c12c06d0d1ca0557396931f077b5d9673aa548b3fb2cdc25bca1472697584d1aeb2a17de4a3fd7

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\4f6b0ba6-4b49-40dc-b7dd-777115c155f8.vbs
                                            Filesize

                                            708B

                                            MD5

                                            8f078580dd0a60ca8ebe7f7af5325459

                                            SHA1

                                            00281bab972452396ac8c5a549b4174d6dc7edb6

                                            SHA256

                                            fdbff9b17742415b75149532a820593603ebf9f88552e186c3b72eae5577f2a0

                                            SHA512

                                            b6ec1d5f79c12ae0915a465f0ab59cb4ab33da573ad7e033fed187a14bffd614a67563671849cf680c6cde049a841c115520bab32f632d6aa2dc0dfd09fb7a3c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\5a18dfb3-7317-4c7f-9f67-1312d9a99dff.vbs
                                            Filesize

                                            708B

                                            MD5

                                            89ea5924cddc07de16326d9dd337fc1b

                                            SHA1

                                            b8891d8367556fb2809bd63886b909b49e4b3639

                                            SHA256

                                            b4d59aaf92bd49776ce062a8a77c74d6db1e2499e9d22e5454d8d57946030f85

                                            SHA512

                                            3cb9ff1abb5fc7dfe2b0ffe9a8d65c698402de29abdad0fb22f7f4a673b4da391197e65093c9ff4c5a62675ec7b2878a51f6f2582982911a7383d336a07e60aa

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\692f23f1-6a13-4237-8043-3ca53ed7b262.vbs
                                            Filesize

                                            484B

                                            MD5

                                            e6c7f7308399a4127b47954bc3298636

                                            SHA1

                                            08492a1095335cf1c47fcb5a7d9466f2e7ee3daf

                                            SHA256

                                            b663390e1c82f433e8d2290c92eaff17459ed9b9df35d3deb8809c4d36fdb251

                                            SHA512

                                            6f1c1299adcf96377295529410632b11d761654af07fcbd7af37a1392004d62b7c7d73d9d33604d2a01f5ed4c394257f5ad96c7d73ad96add9edc1e8698d2783

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\992f3fff-104d-4a58-a8cd-003a0f3dc5b7.vbs
                                            Filesize

                                            708B

                                            MD5

                                            bc26046b2a70a29d9121d8e992dbb1a8

                                            SHA1

                                            e06ee7bc43803e7f16e0bd333bfd822bf9674788

                                            SHA256

                                            1528dc676449ac7372435f9dd99f613e34168b93f956ffa73f06b45cad75d8c8

                                            SHA512

                                            df3cafaaafb7f2ff5ab43a76d4ce029a30bf31119640b9686670b792231cddf3f70f04410bca2e8fba9ed860a6f34fb2bcd70289008e3fe071b18f7b8979a99a

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\YKtyItKL0f.bat
                                            Filesize

                                            197B

                                            MD5

                                            d84ad64d7659ef1c2309b45a72bf7cc2

                                            SHA1

                                            c8d38891fb04824c1e0c45a62e12caf416b3daa2

                                            SHA256

                                            28151738eed04d4364c29e2f821f1c3ef0d8eada6e2408381c9214368afeb2e3

                                            SHA512

                                            809a2262ccb2d9b83a1f47cdcb204bc1092ecdf423ddd0875145944e9a66202784dd2fa7c5a427ba25760785979e008e07a6ffdff63f5db2972e171964b778dd

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ocw52ltr.v25.ps1
                                            Filesize

                                            60B

                                            MD5

                                            d17fe0a3f47be24a6453e9ef58c94641

                                            SHA1

                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                            SHA256

                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                            SHA512

                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\f3ae7bc2-81c6-47c0-b1ff-eb7171935f4d.vbs
                                            Filesize

                                            708B

                                            MD5

                                            582a53c0f69c3b0895f77e853ce84553

                                            SHA1

                                            7b4c5571743b1e3b21566c7a3626691563e20498

                                            SHA256

                                            88282247c6aab2d461c3724cfa406fe2a563a1e9ef6461581441535f4a66a322

                                            SHA512

                                            cb42ff6279ed2ac67a5e9a0adcb3aa793c7582a3196d40ca9474f1e7f02bfaecaf4ed066866b604a5ef7c2f97c7a1fc8e357e330fdfb13be6c31955ccedeb1f5

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\tmpA2E9.tmp.exe
                                            Filesize

                                            75KB

                                            MD5

                                            e0a68b98992c1699876f818a22b5b907

                                            SHA1

                                            d41e8ad8ba51217eb0340f8f69629ccb474484d0

                                            SHA256

                                            2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

                                            SHA512

                                            856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

                                            Download Submit

                                          • memory/1608-10-0x0000000002A60000-0x0000000002A6A000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/1608-109-0x00007FF98BBA0000-0x00007FF98C661000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/1608-18-0x000000001BD30000-0x000000001BD3C000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/1608-1-0x0000000000290000-0x0000000000784000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/1608-2-0x00007FF98BBA0000-0x00007FF98C661000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/1608-3-0x000000001B580000-0x000000001B6AE000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/1608-17-0x000000001BD20000-0x000000001BD28000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/1608-9-0x0000000002A50000-0x0000000002A60000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/1608-15-0x000000001BD00000-0x000000001BD0E000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/1608-13-0x0000000002A80000-0x0000000002A8A000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/1608-12-0x000000001C230000-0x000000001C758000-memory.dmp

                                            Filesize

                                            5.2MB

                                            Download

                                          • memory/1608-11-0x0000000002A70000-0x0000000002A82000-memory.dmp

                                            Filesize

                                            72KB

                                            Download

                                          • memory/1608-0-0x00007FF98BBA3000-0x00007FF98BBA5000-memory.dmp

                                            Filesize

                                            8KB

                                            Download

                                          • memory/1608-16-0x000000001BD10000-0x000000001BD18000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/1608-14-0x0000000002A90000-0x0000000002A9E000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/1608-8-0x0000000002A30000-0x0000000002A46000-memory.dmp

                                            Filesize

                                            88KB

                                            Download

                                          • memory/1608-5-0x000000001BCB0000-0x000000001BD00000-memory.dmp

                                            Filesize

                                            320KB

                                            Download

                                          • memory/1608-6-0x00000000010A0000-0x00000000010A8000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/1608-7-0x0000000002A20000-0x0000000002A30000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/1608-4-0x0000000001080000-0x000000000109C000-memory.dmp

                                            Filesize

                                            112KB

                                            Download

                                          • memory/2460-442-0x00000000032D0000-0x00000000032E2000-memory.dmp

                                            Filesize

                                            72KB

                                            Download

                                          • memory/2620-409-0x000000001BFC0000-0x000000001BFD2000-memory.dmp

                                            Filesize

                                            72KB

                                            Download

                                          • memory/2888-61-0x0000000000400000-0x0000000000407000-memory.dmp

                                            Filesize

                                            28KB

                                            Download

                                          • memory/3172-119-0x000001F97A1A0000-0x000001F97A1C2000-memory.dmp

                                            Filesize

                                            136KB

                                            Download

                                          • memory/3600-235-0x0000000002CC0000-0x0000000002CD2000-memory.dmp

                                            Filesize

                                            72KB

                                            Download