Analysis

  • max time kernel
    151s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2022, 22:02

General

  • Target

    5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6.exe

  • Size

    1.3MB

  • MD5

    aa32aecefe43d28a45894c3ef3c49b8a

  • SHA1

    7dfdff161eb2bd11a1445091caa7c32752d3320e

  • SHA256

    5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6

  • SHA512

    4ad6a52db6664aaad9a59640d4bd48d331fecb7cecee5b0aa65afbcfcc9809ac1c3a66ccf66ecd68e108b7d8e07b39e90304e7ffa3f01445f8a06429bfe31b61

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 12 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 14 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 11 IoCs
  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6.exe
    "C:\Users\Admin\AppData\Local\Temp\5e218f93ff7c0f24a3d39b6ecb07d850d8b144f2ca610b2e543e0448c1993cf6.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4040
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2040
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3340
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\cmd.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:908
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\RuntimeBroker.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:460
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DiagTrack\lsass.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5096
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\cmd.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2780
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\irnJNagMqq.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1408
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:1120
              • C:\Windows\DiagTrack\lsass.exe
                "C:\Windows\DiagTrack\lsass.exe"
                6⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2852
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cqXkQwtlzQ.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4720
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:4980
                    • C:\Windows\DiagTrack\lsass.exe
                      "C:\Windows\DiagTrack\lsass.exe"
                      8⤵
                      • Executes dropped EXE
                      • Checks computer location settings
                      • Modifies registry class
                      PID:4932
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wLA3izB53h.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2736
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:2068
                          • C:\Windows\DiagTrack\lsass.exe
                            "C:\Windows\DiagTrack\lsass.exe"
                            10⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1916
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1JZ2DT5CuV.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5048
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:1400
                                • C:\Windows\DiagTrack\lsass.exe
                                  "C:\Windows\DiagTrack\lsass.exe"
                                  12⤵
                                  • Executes dropped EXE
                                  • Checks computer location settings
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:4172
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat"
                                    13⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1812
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      14⤵
                                        PID:3000
                                      • C:\Windows\DiagTrack\lsass.exe
                                        "C:\Windows\DiagTrack\lsass.exe"
                                        14⤵
                                        • Executes dropped EXE
                                        • Checks computer location settings
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:1896
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1CE969IshF.bat"
                                          15⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4852
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            16⤵
                                              PID:2312
                                            • C:\Windows\DiagTrack\lsass.exe
                                              "C:\Windows\DiagTrack\lsass.exe"
                                              16⤵
                                              • Executes dropped EXE
                                              • Checks computer location settings
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:4192
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SvvYNrLnHE.bat"
                                                17⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:1924
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  18⤵
                                                    PID:60
                                                  • C:\Windows\DiagTrack\lsass.exe
                                                    "C:\Windows\DiagTrack\lsass.exe"
                                                    18⤵
                                                    • Executes dropped EXE
                                                    • Checks computer location settings
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4780
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9BpIS9nw5f.bat"
                                                      19⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1036
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        20⤵
                                                          PID:2696
                                                        • C:\Windows\DiagTrack\lsass.exe
                                                          "C:\Windows\DiagTrack\lsass.exe"
                                                          20⤵
                                                          • Executes dropped EXE
                                                          • Checks computer location settings
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4944
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vad0LeRbBz.bat"
                                                            21⤵
                                                              PID:3400
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                22⤵
                                                                  PID:4796
                                                                • C:\Windows\DiagTrack\lsass.exe
                                                                  "C:\Windows\DiagTrack\lsass.exe"
                                                                  22⤵
                                                                  • Executes dropped EXE
                                                                  • Checks computer location settings
                                                                  • Modifies registry class
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1124
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FEON83D8AI.bat"
                                                                    23⤵
                                                                      PID:2420
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        24⤵
                                                                          PID:5092
                                                                        • C:\Windows\DiagTrack\lsass.exe
                                                                          "C:\Windows\DiagTrack\lsass.exe"
                                                                          24⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2288
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Windows\CbsTemp\cmd.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:2416
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\CbsTemp\cmd.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:3900
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Windows\CbsTemp\cmd.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:4792
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\RuntimeBroker.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:5048
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\RuntimeBroker.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:2792
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\RuntimeBroker.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:4496
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\cmd.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:4428
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\cmd.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:4400
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\cmd.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:2164
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\DiagTrack\lsass.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:3424
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\DiagTrack\lsass.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:2796
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\DiagTrack\lsass.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:4656

                          Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\lsass.exe.log

                                  Filesize

                                  1KB

                                  MD5

                                  baf55b95da4a601229647f25dad12878

                                  SHA1

                                  abc16954ebfd213733c4493fc1910164d825cac8

                                  SHA256

                                  ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                  SHA512

                                  24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                  Filesize

                                  2KB

                                  MD5

                                  d85ba6ff808d9e5444a4b369f5bc2730

                                  SHA1

                                  31aa9d96590fff6981b315e0b391b575e4c0804a

                                  SHA256

                                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                  SHA512

                                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  944B

                                  MD5

                                  d28a889fd956d5cb3accfbaf1143eb6f

                                  SHA1

                                  157ba54b365341f8ff06707d996b3635da8446f7

                                  SHA256

                                  21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                  SHA512

                                  0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  944B

                                  MD5

                                  3a6bad9528f8e23fb5c77fbd81fa28e8

                                  SHA1

                                  f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                  SHA256

                                  986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                  SHA512

                                  846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  944B

                                  MD5

                                  3a6bad9528f8e23fb5c77fbd81fa28e8

                                  SHA1

                                  f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                  SHA256

                                  986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                  SHA512

                                  846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  944B

                                  MD5

                                  d28a889fd956d5cb3accfbaf1143eb6f

                                  SHA1

                                  157ba54b365341f8ff06707d996b3635da8446f7

                                  SHA256

                                  21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                  SHA512

                                  0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                • C:\Users\Admin\AppData\Local\Temp\1CE969IshF.bat

                                  Filesize

                                  195B

                                  MD5

                                  af5bb0e3fa593d8086ead66470d81aa0

                                  SHA1

                                  31b86e92e486d70669e1e25ba12bda0d2ba5aac7

                                  SHA256

                                  e02d6bf0cdc6df4dd9c3bbb127ddfc1b89f108ac713e93aecb8b259cb30b1e0b

                                  SHA512

                                  ce274963f56ed4d5bbf86cee0a378bec04a3258380f5a127d5639d3520a549b7bd8dafddb440b8327750b131402e9eeb0e71a8fe711b91b276c4507b0c6b1c58

                                • C:\Users\Admin\AppData\Local\Temp\1JZ2DT5CuV.bat

                                  Filesize

                                  195B

                                  MD5

                                  79ea06e4d40bf6748bc630cbad944681

                                  SHA1

                                  979a0a928d6c753c26388bfb59c037fc3379936c

                                  SHA256

                                  1db33f133c410499e1d3613523971e84c524f9d9b26e9a40faa92849e37c892d

                                  SHA512

                                  8fb23842ed0b594b7aa341173c1dd732cb16a1665451b9da647ccd171b8ed4a836637c63cb55526a37ba27b11c1dd5358c34667e468be61112284b644564bc66

                                • C:\Users\Admin\AppData\Local\Temp\9BpIS9nw5f.bat

                                  Filesize

                                  195B

                                  MD5

                                  56e3a8114a612caaada0389e3cfb8467

                                  SHA1

                                  a59a6cece0fddc460d60458f22422ca6aa8084fe

                                  SHA256

                                  00d234b580237bb8c87bca2cc07810dbad2f262d54a2b10ec0ac2db70fdcc03b

                                  SHA512

                                  9e2fb7096cd9a8eeb2afa355cdf44f2135faaef5fcd72cc778d630204b640701acf32a9bf4114b4695537213ec04cbac188ce0cc0ef521faf8169b5599eee390

                                • C:\Users\Admin\AppData\Local\Temp\FEON83D8AI.bat

                                  Filesize

                                  195B

                                  MD5

                                  b867584eeec7e8354d7ad7fab9ee693c

                                  SHA1

                                  889ff9727c1772cbdf21df92b7aa1ca52ab5306f

                                  SHA256

                                  45bda478ddb96b70627c359ca61f5befe05a556217fcb0129e8c034f8e102f72

                                  SHA512

                                  98ce57fefb97739fcae630121a8619c35b0579c8a3801e21d997c389c75b2998a9f795f45ad500920505f54d0216b44991982cf41e93d70d752968273e1aaf85

                                • C:\Users\Admin\AppData\Local\Temp\SvvYNrLnHE.bat

                                  Filesize

                                  195B

                                  MD5

                                  bee3a831e117f2c4141bbfff11f0a96f

                                  SHA1

                                  aaced54772bbfd5eeed58b9e2f66b902c79b598e

                                  SHA256

                                  84bfb2ac021d0046944cafca7d349cd9d73d3af1c44169864466ef3c5c223010

                                  SHA512

                                  2b3259385be1fb6e0370696aa58fb43f8c14607daacea46908db541083bae1d94e38077a5a793eac9e0a8233c86538d5b318ebffe20948c558e714bebafb2de9

                                • C:\Users\Admin\AppData\Local\Temp\cqXkQwtlzQ.bat

                                  Filesize

                                  195B

                                  MD5

                                  14013794f1c645edaea7bb8f262d1ebd

                                  SHA1

                                  f99e3a306d01d70ec88f8939ef321735503c0b17

                                  SHA256

                                  2f21afe46280fa3df7830b40a9a78e90bc8b175f3e68e22d9cfcf7ca6e6637b0

                                  SHA512

                                  2b70b308e37f9ddb855df6540bb3491ed1802719482c6ada8b2ab79dc8f0bfc3cfea29908e6e626acd430dc99bf5fff13a581ccf33308cbdd5f12fb94086be24

                                • C:\Users\Admin\AppData\Local\Temp\irnJNagMqq.bat

                                  Filesize

                                  195B

                                  MD5

                                  b273e72cd1503aa91b31b2b4173c880b

                                  SHA1

                                  f4f3041a7e79bae93d9a9cf19a1277db42438901

                                  SHA256

                                  75ea1d25dd7252d18a3ea67ba3330b4ea2599a064df17ab7a81dfe61954eba92

                                  SHA512

                                  a20cdce6a14aa420357144352263ea02c0ed6bc042975ee2ce0d4f8584ce6055bb0558c9606dae4fd0c6bc1042bef1e9796f2af541af978a1c13336f1001a242

                                • C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat

                                  Filesize

                                  195B

                                  MD5

                                  ee9b3dc58e24c54654bc529718a9c104

                                  SHA1

                                  4e99963cf7893909fa616fa6cf9de42fe4b18240

                                  SHA256

                                  a5ed73f70512b1c0d639870cf68c1b6a4f8697899d2f1ffb80fb9ac9f7b03bd0

                                  SHA512

                                  9aeeca15401ea0c6fd7450536260f43cedccb4e6eefa98c8e25002273aa76a109d24dc10fd7ed06aed0f9a18cce72c94a3c5e926727aaa396690c1454fd228d5

                                • C:\Users\Admin\AppData\Local\Temp\vad0LeRbBz.bat

                                  Filesize

                                  195B

                                  MD5

                                  8eb56e7d2e3b7e312a17b27194ec77a2

                                  SHA1

                                  b11d5c5e7db2b4ff1baa443254c42f7436f9734e

                                  SHA256

                                  ab0533daacc8731040b1b0f4d15a37c317759aba4e9315feead1597d05319d18

                                  SHA512

                                  b141d0494a452b602a2085bcb2ce128e70a24067268a93da33bab28c65e975bfd74967bf90c0f9db99e250d6231ab21d5ffc4a916f54bb1a67c8b71bc8ec8cd6

                                • C:\Windows\DiagTrack\lsass.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\Windows\DiagTrack\lsass.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\Windows\DiagTrack\lsass.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\Windows\DiagTrack\lsass.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\Windows\DiagTrack\lsass.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\Windows\DiagTrack\lsass.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\Windows\DiagTrack\lsass.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\Windows\DiagTrack\lsass.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\Windows\DiagTrack\lsass.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\Windows\DiagTrack\lsass.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\Windows\DiagTrack\lsass.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\providercommon\1zu9dW.bat

                                  Filesize

                                  36B

                                  MD5

                                  6783c3ee07c7d151ceac57f1f9c8bed7

                                  SHA1

                                  17468f98f95bf504cc1f83c49e49a78526b3ea03

                                  SHA256

                                  8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                  SHA512

                                  c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                • C:\providercommon\DllCommonsvc.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\providercommon\DllCommonsvc.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                  Filesize

                                  197B

                                  MD5

                                  8088241160261560a02c84025d107592

                                  SHA1

                                  083121f7027557570994c9fc211df61730455bb5

                                  SHA256

                                  2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                  SHA512

                                  20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                • memory/460-158-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/460-147-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/908-164-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/908-146-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/1124-223-0x00007FFFEE130000-0x00007FFFEEBF1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/1124-226-0x00007FFFEE130000-0x00007FFFEEBF1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/1896-194-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/1896-198-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/1916-180-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/1916-184-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/2040-139-0x00000000004A0000-0x00000000005B0000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/2040-152-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/2040-140-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/2288-230-0x00007FFFEE130000-0x00007FFFEEBF1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/2780-162-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/2780-148-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/2852-169-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/2852-173-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/3340-155-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/3340-165-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/4172-191-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/4172-187-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/4192-206-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/4192-205-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/4192-201-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/4780-209-0x00007FFFEE130000-0x00007FFFEEBF1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/4780-213-0x00007FFFEE130000-0x00007FFFEEBF1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/4944-219-0x00007FFFEE130000-0x00007FFFEEBF1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/4944-216-0x00007FFFEE130000-0x00007FFFEEBF1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/5096-159-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/5096-151-0x00007FFFEDF30000-0x00007FFFEE9F1000-memory.dmp

                                  Filesize

                                  10.8MB

                                • memory/5096-150-0x000001A6FF850000-0x000001A6FF872000-memory.dmp

                                  Filesize

                                  136KB