Overview

overview

10

Static

static

3

70c569ce0c...28.exe

windows7-x64

10

70c569ce0c...28.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2024 00:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    70c569ce0cef24601ebc96812d06c4fa8c422b7bdf7b86a73ec2ec4a69e14c28.exe

  • Size

    4.9MB

  • MD5

    4c15b0d03df11adc117efa496536e522

  • SHA1

    d0fae02a4a40b1c0fb98e8ea9da4bdec941ec471

  • SHA256

    70c569ce0cef24601ebc96812d06c4fa8c422b7bdf7b86a73ec2ec4a69e14c28

  • SHA512

    ae900037ef1b05771365096f2e3b73353f3c7ff627f130134278d427ac0d414b234cec161bf6f76b860bf0a691dc65cfc8e281b176752550bf989edd82309121

  • SSDEEP

    49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8R:J

Score
10/10
colibridcratbuild1discoveryevasionexecutioninfostealerloaderrattrojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain

Signatures

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

    loadercolibri
  • Colibri family
    colibri
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 42 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 36 IoCs
    evasiontrojan
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 38 IoCs
  • Checks whether UAC is enabled 1 TTPs 24 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 11 IoCs
  • Drops file in Program Files directory 37 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 11 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 36 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\70c569ce0cef24601ebc96812d06c4fa8c422b7bdf7b86a73ec2ec4a69e14c28.exe
    "C:\Users\Admin\AppData\Local\Temp\70c569ce0cef24601ebc96812d06c4fa8c422b7bdf7b86a73ec2ec4a69e14c28.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2344
    • C:\Users\Admin\AppData\Local\Temp\tmp91F2.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp91F2.tmp.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Users\Admin\AppData\Local\Temp\tmp91F2.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp91F2.tmp.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5048
        • C:\Users\Admin\AppData\Local\Temp\tmp91F2.tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\tmp91F2.tmp.exe"
          4⤵
          • Executes dropped EXE
          PID:4128
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3756
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1696
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1492
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3584
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2032
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2236
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5056
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4168
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5068
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1000
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3412
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cE8nyqPAZe.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5000
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:436
        • C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe
          "C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3444
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a4dd6409-0e7c-49b7-b2d5-93196f52c0e6.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:772
            • C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe
              "C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe"
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1960
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b9f2be42-cb7e-48fa-a347-b39d023a5ae2.vbs"
                6⤵
                  PID:1168
                  • C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe
                    "C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe"
                    7⤵
                    • UAC bypass
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • System policy modification
                    PID:1308
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe5acfd0-880f-4429-bf8c-ac12a491b68a.vbs"
                      8⤵
                        PID:3576
                        • C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe
                          "C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe"
                          9⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • System policy modification
                          PID:4904
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8a5ff8b-6535-4e2b-bc1e-ac2ab07680b3.vbs"
                            10⤵
                              PID:376
                              • C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe
                                "C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe"
                                11⤵
                                • UAC bypass
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • System policy modification
                                PID:4652
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3dfec37e-27fe-47f8-9623-726180722c83.vbs"
                                  12⤵
                                    PID:3688
                                    • C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe
                                      "C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe"
                                      13⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • System policy modification
                                      PID:220
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bac99f57-4f2b-465f-8e93-9082f6cdb9de.vbs"
                                        14⤵
                                          PID:2808
                                          • C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe
                                            "C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe"
                                            15⤵
                                            • UAC bypass
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • System policy modification
                                            PID:1012
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26204d29-4df0-457a-9969-abfea394203f.vbs"
                                              16⤵
                                                PID:4880
                                                • C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe
                                                  "C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe"
                                                  17⤵
                                                  • UAC bypass
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • System policy modification
                                                  PID:3204
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9d2e5a9-d59c-447f-a9e1-e9a198942692.vbs"
                                                    18⤵
                                                      PID:4444
                                                      • C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe
                                                        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe"
                                                        19⤵
                                                        • UAC bypass
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • System policy modification
                                                        PID:5104
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e05f5376-32c9-4180-8504-e84c0ec7463b.vbs"
                                                          20⤵
                                                            PID:2052
                                                            • C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe
                                                              "C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe"
                                                              21⤵
                                                              • UAC bypass
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • System policy modification
                                                              PID:5108
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25808635-c87c-4914-88f5-4d03c63e71eb.vbs"
                                                                22⤵
                                                                  PID:5000
                                                                  • C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe
                                                                    "C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe"
                                                                    23⤵
                                                                    • UAC bypass
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • System policy modification
                                                                    PID:3200
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f45f0f4-a83d-4df9-9ba5-b07ef3ff4513.vbs"
                                                                  22⤵
                                                                    PID:3208
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp483A.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmp483A.tmp.exe"
                                                                    22⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4300
                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp483A.tmp.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\tmp483A.tmp.exe"
                                                                      23⤵
                                                                      • Executes dropped EXE
                                                                      PID:4020
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a08639b-b7b5-4e20-b72e-02235eb30862.vbs"
                                                                20⤵
                                                                  PID:4224
                                                                • C:\Users\Admin\AppData\Local\Temp\tmp2ACF.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmp2ACF.tmp.exe"
                                                                  20⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4488
                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp2ACF.tmp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\tmp2ACF.tmp.exe"
                                                                    21⤵
                                                                    • Executes dropped EXE
                                                                    PID:3972
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\21623820-d070-4973-a6c0-120df264aaeb.vbs"
                                                              18⤵
                                                                PID:1488
                                                              • C:\Users\Admin\AppData\Local\Temp\tmpFA88.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmpFA88.tmp.exe"
                                                                18⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3176
                                                                • C:\Users\Admin\AppData\Local\Temp\tmpFA88.tmp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\tmpFA88.tmp.exe"
                                                                  19⤵
                                                                  • Executes dropped EXE
                                                                  PID:3404
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\afb4ae96-e05e-4d86-aab8-3cbc63db1221.vbs"
                                                            16⤵
                                                              PID:2704
                                                            • C:\Users\Admin\AppData\Local\Temp\tmpDE36.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmpDE36.tmp.exe"
                                                              16⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4352
                                                              • C:\Users\Admin\AppData\Local\Temp\tmpDE36.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmpDE36.tmp.exe"
                                                                17⤵
                                                                • Executes dropped EXE
                                                                PID:4412
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25e3d3c2-29a4-4a25-97d5-24380072a9b3.vbs"
                                                          14⤵
                                                            PID:3116
                                                          • C:\Users\Admin\AppData\Local\Temp\tmpC213.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmpC213.tmp.exe"
                                                            14⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5116
                                                            • C:\Users\Admin\AppData\Local\Temp\tmpC213.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmpC213.tmp.exe"
                                                              15⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4704
                                                              • C:\Users\Admin\AppData\Local\Temp\tmpC213.tmp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\tmpC213.tmp.exe"
                                                                16⤵
                                                                • Executes dropped EXE
                                                                PID:2108
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed0e2d90-7a70-4f62-b064-fae6cca1d975.vbs"
                                                        12⤵
                                                          PID:4516
                                                        • C:\Users\Admin\AppData\Local\Temp\tmp9083.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmp9083.tmp.exe"
                                                          12⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2696
                                                          • C:\Users\Admin\AppData\Local\Temp\tmp9083.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmp9083.tmp.exe"
                                                            13⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2592
                                                            • C:\Users\Admin\AppData\Local\Temp\tmp9083.tmp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\tmp9083.tmp.exe"
                                                              14⤵
                                                              • Executes dropped EXE
                                                              PID:4512
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7473b2f8-078d-420f-9e68-be0e4de18a41.vbs"
                                                      10⤵
                                                        PID:5004
                                                      • C:\Users\Admin\AppData\Local\Temp\tmp605B.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmp605B.tmp.exe"
                                                        10⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1968
                                                        • C:\Users\Admin\AppData\Local\Temp\tmp605B.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmp605B.tmp.exe"
                                                          11⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1844
                                                          • C:\Users\Admin\AppData\Local\Temp\tmp605B.tmp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\tmp605B.tmp.exe"
                                                            12⤵
                                                            • Executes dropped EXE
                                                            PID:2264
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\471a691b-c137-464a-8ec0-7d48b763fd1f.vbs"
                                                    8⤵
                                                      PID:2816
                                                    • C:\Users\Admin\AppData\Local\Temp\tmp2EBC.tmp.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\tmp2EBC.tmp.exe"
                                                      8⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1132
                                                      • C:\Users\Admin\AppData\Local\Temp\tmp2EBC.tmp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\tmp2EBC.tmp.exe"
                                                        9⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3540
                                                        • C:\Users\Admin\AppData\Local\Temp\tmp2EBC.tmp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\tmp2EBC.tmp.exe"
                                                          10⤵
                                                          • Executes dropped EXE
                                                          PID:4908
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cee853f4-b795-4f24-9f20-17b18d90903e.vbs"
                                                  6⤵
                                                    PID:4552
                                                  • C:\Users\Admin\AppData\Local\Temp\tmpFFBD.tmp.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\tmpFFBD.tmp.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2696
                                                    • C:\Users\Admin\AppData\Local\Temp\tmpFFBD.tmp.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\tmpFFBD.tmp.exe"
                                                      7⤵
                                                      • Executes dropped EXE
                                                      PID:1696
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\559f879d-225e-4588-945e-e9692dbf0b4b.vbs"
                                                4⤵
                                                  PID:3696
                                                • C:\Users\Admin\AppData\Local\Temp\tmpD040.tmp.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\tmpD040.tmp.exe"
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4532
                                                  • C:\Users\Admin\AppData\Local\Temp\tmpD040.tmp.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\tmpD040.tmp.exe"
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:324
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4544
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:548
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3972
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\Registry.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1200
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Registry.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3404
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\Registry.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3948
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\unsecapp.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4020
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\unsecapp.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3004
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\unsecapp.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:244
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\taskhostw.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1676
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\taskhostw.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3620
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\taskhostw.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2996
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\sihost.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4948
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\sihost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1712
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\sihost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:816
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4920
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1888
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:956
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sppsvc.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4720
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sppsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3080
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sppsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:64
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4984
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1688
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\unsecapp.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2384
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\My Documents\lsass.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2784
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3920
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\My Documents\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4704
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\reports\dwm.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4892
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Crashpad\reports\dwm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2812
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Crashpad\reports\dwm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1112
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\lsass.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:724
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3616
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3624
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\System.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4504
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:5008
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:820
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3428
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2440
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3572
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Music\explorer.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2740
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default\Music\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3580
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Music\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1928

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Program Files\Crashpad\reports\dwm.exe
                                            Filesize

                                            4.9MB

                                            MD5

                                            ea551c6ba8c21aaca3c568ac0601d097

                                            SHA1

                                            491e2bc6564dd4db5052f0eb17a79dc4d99e27f0

                                            SHA256

                                            6246a0ecbf95f5b4e77b0f5975c3cf4d02db519306ee68764cf2a0cb74badf29

                                            SHA512

                                            5e546c527c077c7139fcc414688e82351feb8b275b883e6cb01bfb8a9e1654fb153053e90a7c1b9933499e48e0de433301b240b652dc652e1b41b2209a37ecee

                                            Download Submit

                                          • C:\Program Files\Windows Portable Devices\sihost.exe
                                            Filesize

                                            4.9MB

                                            MD5

                                            4c15b0d03df11adc117efa496536e522

                                            SHA1

                                            d0fae02a4a40b1c0fb98e8ea9da4bdec941ec471

                                            SHA256

                                            70c569ce0cef24601ebc96812d06c4fa8c422b7bdf7b86a73ec2ec4a69e14c28

                                            SHA512

                                            ae900037ef1b05771365096f2e3b73353f3c7ff627f130134278d427ac0d414b234cec161bf6f76b860bf0a691dc65cfc8e281b176752550bf989edd82309121

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                            Filesize

                                            2KB

                                            MD5

                                            d85ba6ff808d9e5444a4b369f5bc2730

                                            SHA1

                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                            SHA256

                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                            SHA512

                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\unsecapp.exe.log
                                            Filesize

                                            1KB

                                            MD5

                                            4a667f150a4d1d02f53a9f24d89d53d1

                                            SHA1

                                            306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

                                            SHA256

                                            414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

                                            SHA512

                                            4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            d28a889fd956d5cb3accfbaf1143eb6f

                                            SHA1

                                            157ba54b365341f8ff06707d996b3635da8446f7

                                            SHA256

                                            21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                            SHA512

                                            0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            3a6bad9528f8e23fb5c77fbd81fa28e8

                                            SHA1

                                            f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                            SHA256

                                            986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                            SHA512

                                            846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            bd5940f08d0be56e65e5f2aaf47c538e

                                            SHA1

                                            d7e31b87866e5e383ab5499da64aba50f03e8443

                                            SHA256

                                            2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                            SHA512

                                            c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            59d97011e091004eaffb9816aa0b9abd

                                            SHA1

                                            1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

                                            SHA256

                                            18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

                                            SHA512

                                            d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            cadef9abd087803c630df65264a6c81c

                                            SHA1

                                            babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                            SHA256

                                            cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                            SHA512

                                            7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\3dfec37e-27fe-47f8-9623-726180722c83.vbs
                                            Filesize

                                            745B

                                            MD5

                                            7cfeda24a20709ab1998dd4e7a7be340

                                            SHA1

                                            f3112c78f4832dad540ee929064f761a9e669598

                                            SHA256

                                            838ab3180b07e500f7629a9c7e3fbb087752b137a66bd13330e119cc264981fe

                                            SHA512

                                            23651373d168a2155b6f1a11ec948ab65557e32e77555f08fb6385287eba816e26eea403300f5993029d42779e0a5a1fa0f63ceff1d9a4132136b96040b6f493

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\559f879d-225e-4588-945e-e9692dbf0b4b.vbs
                                            Filesize

                                            521B

                                            MD5

                                            29d06d2ba6ebbe5db3edeccde849ee21

                                            SHA1

                                            083270ea3d3863436f39bcc476e34ac590568982

                                            SHA256

                                            5d0584e575f13189659bdf4f94d09e37fc66c9f427d7839b13e529e6c7e58956

                                            SHA512

                                            8d21f3aeccae9816b9f01ef3103e361d97e6f560dafc989cc5e50c885707579e01cde55c7d526e736e260a0adc198b83f35d476f6587035fdbc45e2e94d49363

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v0ncznqd.kir.ps1
                                            Filesize

                                            60B

                                            MD5

                                            d17fe0a3f47be24a6453e9ef58c94641

                                            SHA1

                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                            SHA256

                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                            SHA512

                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a4dd6409-0e7c-49b7-b2d5-93196f52c0e6.vbs
                                            Filesize

                                            745B

                                            MD5

                                            fa2d27535ee07352cac30844594a126f

                                            SHA1

                                            a38289103779b7737294bde1cb8d6b9d3e8a7a05

                                            SHA256

                                            d8cfbd1135b050f21a9fb6ad46170a6979c4bed1ca47c0fed282493415fec683

                                            SHA512

                                            a13e8e498f921e9169913e639aae6da5570683a4dc159fd8b8981c0968f3d6fd69b8d3a91dc4beb648ee6a320f0e22b63b56ea038889be8deeffada2a7b22cb9

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\b9f2be42-cb7e-48fa-a347-b39d023a5ae2.vbs
                                            Filesize

                                            745B

                                            MD5

                                            9886535a7b0cc13f7023c0dcd4c31efa

                                            SHA1

                                            cff853e532906a9eb81f3218142474060126ba10

                                            SHA256

                                            96e6ac550aadeb4114556c7dd800078158bffc7cd95aa093496bca46f6d651db

                                            SHA512

                                            029a2e2922a59af78dc71c6d74c3a1840111b09c3e118fec7c56797d02022e002a9e97105ae6d75448700ae12376c95cfa3abc9d43e747790d39a1ecf3ed1cec

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\bac99f57-4f2b-465f-8e93-9082f6cdb9de.vbs
                                            Filesize

                                            744B

                                            MD5

                                            8312004a334e5af13c7e2482010af2a8

                                            SHA1

                                            f8e6d1dacb94f7947bcea19566a5383039dc3128

                                            SHA256

                                            8d3c666da31bc817580771a9d570d9a8a12fdba7496fc360e0aefc1ea47921d1

                                            SHA512

                                            b7e6fd835882c237d0a7b8b329be98d3764855459549d172d43bdda79978440fdfaaac50cef2363a1b6f2a60f4e03f25cc53a1365f1d5fa2ebabea352e50e9cb

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\cE8nyqPAZe.bat
                                            Filesize

                                            234B

                                            MD5

                                            25b5a72f1335538e3cd446446c68a0af

                                            SHA1

                                            92795f5dae13fc367e433be6d03e6fe235b994a4

                                            SHA256

                                            dd35bd5451d404ed311a8042190ebb61d219d14559d0bf790dac199b9df67821

                                            SHA512

                                            da7f3e6e8d6bc140d5ea8765706371b961fbd0cc0302a31b4dbcb29705f11a00bb8a161c4846db918f82444c774b33d972bf0cc53d0d4a7a1d2593808943defc

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\d8a5ff8b-6535-4e2b-bc1e-ac2ab07680b3.vbs
                                            Filesize

                                            745B

                                            MD5

                                            994e4619402839137af482e1163f1045

                                            SHA1

                                            cf7eb3ad21730b12d6c138b9472f1ce512898074

                                            SHA256

                                            80c79d1abb004a651c97983433851bf8f36c605a4937f5fffb06fb96f63dd003

                                            SHA512

                                            952d280d07cb7e9a62d5138df24412f5405d794a33e786925650bb2d64637a72cd6093df9221115ca4abcb5d40830b48bacb06f482a993152b419b3df918d2e1

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\fe5acfd0-880f-4429-bf8c-ac12a491b68a.vbs
                                            Filesize

                                            745B

                                            MD5

                                            70ca6f20b9efab236f8f21611227a298

                                            SHA1

                                            b09b2a61a0c1f6fda86b9d98c4221c9d7394813c

                                            SHA256

                                            8a1701043773b466212489dee31af39ebfc77cfe122f9550ad4fe8910d0a14f4

                                            SHA512

                                            f3c43c0a4d4fba0dc2027cb0927b17deee79f3c00e5e22318140d03775e7f4f10ce90501452d4622af6a292b02ca510bb00d1084c05e65e850bb9fcc3da65558

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\tmp91F2.tmp.exe
                                            Filesize

                                            75KB

                                            MD5

                                            e0a68b98992c1699876f818a22b5b907

                                            SHA1

                                            d41e8ad8ba51217eb0340f8f69629ccb474484d0

                                            SHA256

                                            2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

                                            SHA512

                                            856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

                                            Download Submit

                                          • C:\Users\Admin\Documents\lsass.exe
                                            Filesize

                                            4.9MB

                                            MD5

                                            e98446a668898f8e9c601999647c46fa

                                            SHA1

                                            0da25691fe3630d323705b0820ed722ffede5586

                                            SHA256

                                            c6e92055e2579ab372b43b3bc032254a103c1bfb37adb3c33643b3d235f77f23

                                            SHA512

                                            78e0d19f48528630c4eab7f5851c75171665de1b4dfea7b3a80daace3a43ea998dd45332cc652183392011916e3a02b958d5440e95daef770e11c06908ea2acd

                                            Download Submit

                                          • memory/1492-171-0x000001821D8C0000-0x000001821D8E2000-memory.dmp

                                            Filesize

                                            136KB

                                            Download

                                          • memory/2344-10-0x00000000033F0000-0x00000000033FA000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/2344-8-0x0000000001B10000-0x0000000001B26000-memory.dmp

                                            Filesize

                                            88KB

                                            Download

                                          • memory/2344-12-0x000000001CE10000-0x000000001D338000-memory.dmp

                                            Filesize

                                            5.2MB

                                            Download

                                          • memory/2344-151-0x00007FFCC7683000-0x00007FFCC7685000-memory.dmp

                                            Filesize

                                            8KB

                                            Download

                                          • memory/2344-165-0x00007FFCC7680000-0x00007FFCC8141000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/2344-16-0x000000001C070000-0x000000001C078000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/2344-18-0x000000001C090000-0x000000001C09C000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/2344-14-0x0000000003420000-0x000000000342E000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/2344-15-0x0000000003430000-0x000000000343E000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/2344-11-0x0000000003400000-0x0000000003412000-memory.dmp

                                            Filesize

                                            72KB

                                            Download

                                          • memory/2344-17-0x000000001C080000-0x000000001C088000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/2344-1-0x0000000000D40000-0x0000000001234000-memory.dmp

                                            Filesize

                                            5.0MB

                                            Download

                                          • memory/2344-13-0x0000000003410000-0x000000000341A000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/2344-9-0x0000000001B30000-0x0000000001B40000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/2344-6-0x0000000001A50000-0x0000000001A58000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/2344-7-0x0000000001B00000-0x0000000001B10000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/2344-0-0x00007FFCC7683000-0x00007FFCC7685000-memory.dmp

                                            Filesize

                                            8KB

                                            Download

                                          • memory/2344-5-0x0000000003440000-0x0000000003490000-memory.dmp

                                            Filesize

                                            320KB

                                            Download

                                          • memory/2344-4-0x0000000001A30000-0x0000000001A4C000-memory.dmp

                                            Filesize

                                            112KB

                                            Download

                                          • memory/2344-3-0x000000001C1B0000-0x000000001C2DE000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/2344-2-0x00007FFCC7680000-0x00007FFCC8141000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/4128-83-0x0000000000400000-0x0000000000407000-memory.dmp

                                            Filesize

                                            28KB

                                            Download

                                          • memory/4652-392-0x000000001B970000-0x000000001B982000-memory.dmp

                                            Filesize

                                            72KB

                                            Download