6c6a951636ae4dee7a842c6af1d43236.exe

General
Target

6c6a951636ae4dee7a842c6af1d43236.exe

Filesize

1MB

Completed

22-07-2021 08:06

Score
10 /10
MD5

6c6a951636ae4dee7a842c6af1d43236

SHA1

387e2f026ca3ec2a291b09fa76f88fe40ae7007c

SHA256

2ebc7cf945c4eba60eb0f25f6b58eb8d7d0558f6b5622530b2b3808987173952

Malware Config

Extracted

Family darkcomet
Botnet ADSAW
C2

secret92.ddns.net:82

Attributes
InstallPath
MSDCSC\msdcsc.exe
gencode
4ltiP4nFeytX
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate
Signatures 18

Filter: none

Defense Evasion
Discovery
Persistence
  • Darkcomet

    Description

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence
    darknj.exe

    TTPs

    Winlogon Helper DLLModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"darknj.exe
  • njRAT/Bladabindi

    Description

    Widely used RAT written in .NET.

  • Executes dropped EXE
    R-Launcher.exedarknj.exeNJ.EXEmsdcsc.exeWindowsServices.exe

    Reported IOCs

    pidprocess
    1852R-Launcher.exe
    1512darknj.exe
    196NJ.EXE
    3548msdcsc.exe
    3724WindowsServices.exe
  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Sets file to hidden

    Description

    Modifies file attributes to stop it showing in Explorer etc.

    Tags

    TTPs

    Hidden Files and Directories
  • Checks computer location settings
    darknj.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nationdarknj.exe
  • Drops startup file
    WindowsServices.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cf6e0aafbf214c3565426c44740c8dce.exeWindowsServices.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cf6e0aafbf214c3565426c44740c8dce.exeWindowsServices.exe
  • Adds Run key to start application
    msdcsc.exeWindowsServices.exedarknj.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"msdcsc.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\cf6e0aafbf214c3565426c44740c8dce = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsServices.exe\" .."WindowsServices.exe
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cf6e0aafbf214c3565426c44740c8dce = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsServices.exe\" .."WindowsServices.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"darknj.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    36802484WerFault.exejavaw.exe
  • Modifies registry class
    darknj.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instancedarknj.exe
  • Suspicious behavior: EnumeratesProcesses
    WerFault.exeNJ.EXE

    Reported IOCs

    pidprocess
    3680WerFault.exe
    3680WerFault.exe
    3680WerFault.exe
    3680WerFault.exe
    3680WerFault.exe
    3680WerFault.exe
    3680WerFault.exe
    3680WerFault.exe
    3680WerFault.exe
    3680WerFault.exe
    3680WerFault.exe
    3680WerFault.exe
    3680WerFault.exe
    3680WerFault.exe
    3680WerFault.exe
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
    196NJ.EXE
  • Suspicious behavior: GetForegroundWindowSpam
    msdcsc.exe

    Reported IOCs

    pidprocess
    3548msdcsc.exe
  • Suspicious use of AdjustPrivilegeToken
    darknj.exeWerFault.exemsdcsc.exeNJ.EXEWindowsServices.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeIncreaseQuotaPrivilege1512darknj.exe
    Token: SeSecurityPrivilege1512darknj.exe
    Token: SeTakeOwnershipPrivilege1512darknj.exe
    Token: SeLoadDriverPrivilege1512darknj.exe
    Token: SeSystemProfilePrivilege1512darknj.exe
    Token: SeSystemtimePrivilege1512darknj.exe
    Token: SeProfSingleProcessPrivilege1512darknj.exe
    Token: SeIncBasePriorityPrivilege1512darknj.exe
    Token: SeCreatePagefilePrivilege1512darknj.exe
    Token: SeBackupPrivilege1512darknj.exe
    Token: SeRestorePrivilege1512darknj.exe
    Token: SeShutdownPrivilege1512darknj.exe
    Token: SeDebugPrivilege1512darknj.exe
    Token: SeSystemEnvironmentPrivilege1512darknj.exe
    Token: SeChangeNotifyPrivilege1512darknj.exe
    Token: SeRemoteShutdownPrivilege1512darknj.exe
    Token: SeUndockPrivilege1512darknj.exe
    Token: SeManageVolumePrivilege1512darknj.exe
    Token: SeImpersonatePrivilege1512darknj.exe
    Token: SeCreateGlobalPrivilege1512darknj.exe
    Token: 331512darknj.exe
    Token: 341512darknj.exe
    Token: 351512darknj.exe
    Token: 361512darknj.exe
    Token: SeDebugPrivilege3680WerFault.exe
    Token: SeIncreaseQuotaPrivilege3548msdcsc.exe
    Token: SeSecurityPrivilege3548msdcsc.exe
    Token: SeTakeOwnershipPrivilege3548msdcsc.exe
    Token: SeLoadDriverPrivilege3548msdcsc.exe
    Token: SeSystemProfilePrivilege3548msdcsc.exe
    Token: SeSystemtimePrivilege3548msdcsc.exe
    Token: SeProfSingleProcessPrivilege3548msdcsc.exe
    Token: SeIncBasePriorityPrivilege3548msdcsc.exe
    Token: SeCreatePagefilePrivilege3548msdcsc.exe
    Token: SeBackupPrivilege3548msdcsc.exe
    Token: SeRestorePrivilege3548msdcsc.exe
    Token: SeShutdownPrivilege3548msdcsc.exe
    Token: SeDebugPrivilege3548msdcsc.exe
    Token: SeSystemEnvironmentPrivilege3548msdcsc.exe
    Token: SeChangeNotifyPrivilege3548msdcsc.exe
    Token: SeRemoteShutdownPrivilege3548msdcsc.exe
    Token: SeUndockPrivilege3548msdcsc.exe
    Token: SeManageVolumePrivilege3548msdcsc.exe
    Token: SeImpersonatePrivilege3548msdcsc.exe
    Token: SeCreateGlobalPrivilege3548msdcsc.exe
    Token: 333548msdcsc.exe
    Token: 343548msdcsc.exe
    Token: 353548msdcsc.exe
    Token: 363548msdcsc.exe
    Token: SeDebugPrivilege196NJ.EXE
    Token: SeDebugPrivilege3724WindowsServices.exe
    Token: 333724WindowsServices.exe
    Token: SeIncBasePriorityPrivilege3724WindowsServices.exe
    Token: 333724WindowsServices.exe
    Token: SeIncBasePriorityPrivilege3724WindowsServices.exe
    Token: 333724WindowsServices.exe
    Token: SeIncBasePriorityPrivilege3724WindowsServices.exe
    Token: 333724WindowsServices.exe
    Token: SeIncBasePriorityPrivilege3724WindowsServices.exe
    Token: 333724WindowsServices.exe
    Token: SeIncBasePriorityPrivilege3724WindowsServices.exe
    Token: 333724WindowsServices.exe
    Token: SeIncBasePriorityPrivilege3724WindowsServices.exe
    Token: 333724WindowsServices.exe
  • Suspicious use of SetWindowsHookEx
    msdcsc.exe

    Reported IOCs

    pidprocess
    3548msdcsc.exe
  • Suspicious use of WriteProcessMemory
    6c6a951636ae4dee7a842c6af1d43236.exeR-Launcher.exedarknj.execmd.execmd.exemsdcsc.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 656 wrote to memory of 18526566c6a951636ae4dee7a842c6af1d43236.exeR-Launcher.exe
    PID 656 wrote to memory of 18526566c6a951636ae4dee7a842c6af1d43236.exeR-Launcher.exe
    PID 656 wrote to memory of 18526566c6a951636ae4dee7a842c6af1d43236.exeR-Launcher.exe
    PID 656 wrote to memory of 15126566c6a951636ae4dee7a842c6af1d43236.exedarknj.exe
    PID 656 wrote to memory of 15126566c6a951636ae4dee7a842c6af1d43236.exedarknj.exe
    PID 656 wrote to memory of 15126566c6a951636ae4dee7a842c6af1d43236.exedarknj.exe
    PID 1852 wrote to memory of 24841852R-Launcher.exejavaw.exe
    PID 1852 wrote to memory of 24841852R-Launcher.exejavaw.exe
    PID 1512 wrote to memory of 31201512darknj.execmd.exe
    PID 1512 wrote to memory of 31201512darknj.execmd.exe
    PID 1512 wrote to memory of 31201512darknj.execmd.exe
    PID 1512 wrote to memory of 28241512darknj.execmd.exe
    PID 1512 wrote to memory of 28241512darknj.execmd.exe
    PID 1512 wrote to memory of 28241512darknj.execmd.exe
    PID 1512 wrote to memory of 1961512darknj.exeNJ.EXE
    PID 1512 wrote to memory of 1961512darknj.exeNJ.EXE
    PID 1512 wrote to memory of 1961512darknj.exeNJ.EXE
    PID 3120 wrote to memory of 9563120cmd.exeattrib.exe
    PID 3120 wrote to memory of 9563120cmd.exeattrib.exe
    PID 3120 wrote to memory of 9563120cmd.exeattrib.exe
    PID 2824 wrote to memory of 28722824cmd.exeattrib.exe
    PID 2824 wrote to memory of 28722824cmd.exeattrib.exe
    PID 2824 wrote to memory of 28722824cmd.exeattrib.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 39401512darknj.exenotepad.exe
    PID 1512 wrote to memory of 35481512darknj.exemsdcsc.exe
    PID 1512 wrote to memory of 35481512darknj.exemsdcsc.exe
    PID 1512 wrote to memory of 35481512darknj.exemsdcsc.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
    PID 3548 wrote to memory of 13603548msdcsc.exenotepad.exe
  • Views/modifies file attributes
    attrib.exeattrib.exe

    Tags

    TTPs

    Hidden Files and Directories

    Reported IOCs

    pidprocess
    2872attrib.exe
    956attrib.exe
Processes 15
  • C:\Users\Admin\AppData\Local\Temp\6c6a951636ae4dee7a842c6af1d43236.exe
    "C:\Users\Admin\AppData\Local\Temp\6c6a951636ae4dee7a842c6af1d43236.exe"
    Suspicious use of WriteProcessMemory
    PID:656
    • C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe"
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1852
      • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
        "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe"
        PID:2484
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 2484 -s 356
          Program crash
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          PID:3680
    • C:\Users\Admin\AppData\Local\Temp\darknj.exe
      "C:\Users\Admin\AppData\Local\Temp\darknj.exe"
      Modifies WinLogon for persistence
      Executes dropped EXE
      Checks computer location settings
      Adds Run key to start application
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1512
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\darknj.exe" +s +h
        Suspicious use of WriteProcessMemory
        PID:3120
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp\darknj.exe" +s +h
          Views/modifies file attributes
          PID:956
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
          Views/modifies file attributes
          PID:2872
      • C:\Users\Admin\AppData\Local\Temp\NJ.EXE
        "C:\Users\Admin\AppData\Local\Temp\NJ.EXE"
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:196
        • C:\Users\Admin\AppData\Roaming\WindowsServices.exe
          "C:\Users\Admin\AppData\Roaming\WindowsServices.exe"
          Executes dropped EXE
          Drops startup file
          Adds Run key to start application
          Suspicious use of AdjustPrivilegeToken
          PID:3724
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\WindowsServices.exe" "WindowsServices.exe" ENABLE
            PID:1836
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        PID:3940
      • C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
        "C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        PID:3548
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          PID:1360
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe

                      MD5

                      b0fe10b99dd5f8494e7c71b8fda9239b

                      SHA1

                      e93f7447408e10424ea3f4b3a92473e125d2af6b

                      SHA256

                      121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536

                      SHA512

                      6c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518

                    • C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe

                      MD5

                      b0fe10b99dd5f8494e7c71b8fda9239b

                      SHA1

                      e93f7447408e10424ea3f4b3a92473e125d2af6b

                      SHA256

                      121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536

                      SHA512

                      6c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518

                    • C:\Users\Admin\AppData\Local\Temp\NJ.EXE

                      MD5

                      d3b0deb25e223b27361f1024bdbcba0c

                      SHA1

                      8e250d9ea3abf31f589005d9406eb6850a2a02b6

                      SHA256

                      ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d

                      SHA512

                      d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d

                    • C:\Users\Admin\AppData\Local\Temp\NJ.EXE

                      MD5

                      d3b0deb25e223b27361f1024bdbcba0c

                      SHA1

                      8e250d9ea3abf31f589005d9406eb6850a2a02b6

                      SHA256

                      ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d

                      SHA512

                      d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d

                    • C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe

                      MD5

                      f09f583748cb26682f60279b8bba14c8

                      SHA1

                      caf750a85d3abd708c080ebfa995bc2cc0b4cafd

                      SHA256

                      7f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc

                      SHA512

                      cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9

                    • C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe

                      MD5

                      f09f583748cb26682f60279b8bba14c8

                      SHA1

                      caf750a85d3abd708c080ebfa995bc2cc0b4cafd

                      SHA256

                      7f5b29de3370f01b63bcdf4fc7939728f2b11428462d0e2ba77a2bb62b7698dc

                      SHA512

                      cf8c278f297e250966ce2302191718dae3e7b09f5f9e2da2efb2bfe87ba87196f69be5c0fe52bf7048230ce616bee76d005a11fa646986fa8b33688d95861ae9

                    • C:\Users\Admin\AppData\Local\Temp\darknj.exe

                      MD5

                      b0fe10b99dd5f8494e7c71b8fda9239b

                      SHA1

                      e93f7447408e10424ea3f4b3a92473e125d2af6b

                      SHA256

                      121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536

                      SHA512

                      6c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518

                    • C:\Users\Admin\AppData\Local\Temp\darknj.exe

                      MD5

                      b0fe10b99dd5f8494e7c71b8fda9239b

                      SHA1

                      e93f7447408e10424ea3f4b3a92473e125d2af6b

                      SHA256

                      121a202b4ff70f91e823c347f13784ec44525a9b0d4940c449e5db442acc6536

                      SHA512

                      6c9fdf8b1d097e454c4530a1660ef67aa1daed8e9eab8045c200b3ab1b89a8df84ef0d68be2a3c5affc30000d610dede7ea2fa7760f78c8a9983ad5d0283e518

                    • C:\Users\Admin\AppData\Roaming\WindowsServices.exe

                      MD5

                      d3b0deb25e223b27361f1024bdbcba0c

                      SHA1

                      8e250d9ea3abf31f589005d9406eb6850a2a02b6

                      SHA256

                      ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d

                      SHA512

                      d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d

                    • C:\Users\Admin\AppData\Roaming\WindowsServices.exe

                      MD5

                      d3b0deb25e223b27361f1024bdbcba0c

                      SHA1

                      8e250d9ea3abf31f589005d9406eb6850a2a02b6

                      SHA256

                      ee68e3f8ce8f704003575076c1b48a29361adb3af5fe858e0e59b5f41c685d8d

                      SHA512

                      d392c1202b14b99418158f75dc1496cb35f079911d8c5922d3b23d8d5a188027dee3650dfa145ff14e8f01e57c01c0f0fda09603f210e1884354e5c621565b7d

                    • memory/196-124-0x0000000000000000-mapping.dmp

                    • memory/196-130-0x00000000001F0000-0x00000000001F1000-memory.dmp

                    • memory/956-127-0x0000000000000000-mapping.dmp

                    • memory/1360-135-0x0000000000000000-mapping.dmp

                    • memory/1360-137-0x0000000003050000-0x0000000003051000-memory.dmp

                    • memory/1512-121-0x0000000002380000-0x0000000002381000-memory.dmp

                    • memory/1512-116-0x0000000000000000-mapping.dmp

                    • memory/1836-142-0x0000000000000000-mapping.dmp

                    • memory/1852-114-0x0000000000000000-mapping.dmp

                    • memory/2484-120-0x0000000000000000-mapping.dmp

                    • memory/2824-123-0x0000000000000000-mapping.dmp

                    • memory/2872-128-0x0000000000000000-mapping.dmp

                    • memory/3120-122-0x0000000000000000-mapping.dmp

                    • memory/3548-132-0x0000000000000000-mapping.dmp

                    • memory/3548-136-0x0000000000590000-0x000000000063E000-memory.dmp

                    • memory/3724-141-0x0000000000960000-0x0000000000961000-memory.dmp

                    • memory/3724-138-0x0000000000000000-mapping.dmp

                    • memory/3940-131-0x0000000002E40000-0x0000000002E41000-memory.dmp

                    • memory/3940-129-0x0000000000000000-mapping.dmp