darkcomet | 511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc

Analysis

max time kernel
67s
max time network
83s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe
Size

2.8MB
MD5

ff9142946eaf74497cce37d6042a001e
SHA1

84a9a186ca189b94b6cc96149b8a891fbb1ad4b8
SHA256

511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc
SHA512

c124a5d17c0d350d3c5b180644bee992e4eb634e25e6c8cce2f4da2336461d98eb5901a0b69b61b7b81aa4bc771c2f2f40fd7f8040b44894c9c84ae7cdb7a249
SSDEEP

49152:GNX1vMYf017Whi8bfjQagbDEeqJJrn5m/4sit6QNt9NSlCf:K9MDW08bfjQagceqTr53YC

Score

10^/10

darkcomet defors guest16 persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

darkcometratt.no-ip.org:1604

Mutex

DC_MUTEX-WG0MMGJ

Attributes

gencode
Rsl0xg3qg2h8
install
false
offline_keylogger
true
persistence
false

Extracted

Family

darkcomet

Botnet

DEFORS

rsnoip.ddns.net:1997

Mutex

DCMIN_MUTEX-C5RDYJH

Attributes

gencode
NToT30g4twDC
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows\\Windows.exe"	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe

Executes dropped EXE 3 IoCs

Processes:

File.exenotepad .exeap.exe

pid process

1764 File.exe
2016 notepad .exe
1012 ap.exe

pid	process
1764	File.exe
2016	notepad .exe
1012	ap.exe

Loads dropped DLL 4 IoCs

Processes:

511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.execmd.exe

pid	process
1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe
1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe
1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe
1196	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe

description	pid	process	target process
PID 1760 set thread context of 2016	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	notepad .exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1912 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

1420 tasklist.exe

pid	process
1912	timeout.exe

pid	process
1420	tasklist.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe

pid	process
1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe
1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe
1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exeFile.exetasklist.exeap.exe

description	pid	process
Token: SeDebugPrivilege	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe
Token: SeIncreaseQuotaPrivilege	1764	File.exe
Token: SeSecurityPrivilege	1764	File.exe
Token: SeTakeOwnershipPrivilege	1764	File.exe
Token: SeLoadDriverPrivilege	1764	File.exe
Token: SeSystemProfilePrivilege	1764	File.exe
Token: SeSystemtimePrivilege	1764	File.exe
Token: SeProfSingleProcessPrivilege	1764	File.exe
Token: SeIncBasePriorityPrivilege	1764	File.exe
Token: SeCreatePagefilePrivilege	1764	File.exe
Token: SeBackupPrivilege	1764	File.exe
Token: SeRestorePrivilege	1764	File.exe
Token: SeShutdownPrivilege	1764	File.exe
Token: SeDebugPrivilege	1764	File.exe
Token: SeSystemEnvironmentPrivilege	1764	File.exe
Token: SeChangeNotifyPrivilege	1764	File.exe
Token: SeRemoteShutdownPrivilege	1764	File.exe
Token: SeUndockPrivilege	1764	File.exe
Token: SeManageVolumePrivilege	1764	File.exe
Token: SeImpersonatePrivilege	1764	File.exe
Token: SeCreateGlobalPrivilege	1764	File.exe
Token: 33	1764	File.exe
Token: 34	1764	File.exe
Token: 35	1764	File.exe
Token: SeDebugPrivilege	1420	tasklist.exe
Token: SeDebugPrivilege	1012	ap.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

File.exe

pid process

1764 File.exe

pid	process
1764	File.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.execmd.exewscript.execmd.exe

description	pid	process	target process
PID 1760 wrote to memory of 1764	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	File.exe
PID 1760 wrote to memory of 1764	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	File.exe
PID 1760 wrote to memory of 1764	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	File.exe
PID 1760 wrote to memory of 1764	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	File.exe
PID 1760 wrote to memory of 1380	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	cmd.exe
PID 1760 wrote to memory of 1380	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	cmd.exe
PID 1760 wrote to memory of 1380	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	cmd.exe
PID 1760 wrote to memory of 1380	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	cmd.exe
PID 1380 wrote to memory of 948	1380	cmd.exe	wscript.exe
PID 1380 wrote to memory of 948	1380	cmd.exe	wscript.exe
PID 1380 wrote to memory of 948	1380	cmd.exe	wscript.exe
PID 1380 wrote to memory of 948	1380	cmd.exe	wscript.exe
PID 1760 wrote to memory of 2016	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	notepad .exe
PID 1760 wrote to memory of 2016	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	notepad .exe
PID 1760 wrote to memory of 2016	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	notepad .exe
PID 1760 wrote to memory of 2016	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	notepad .exe
PID 1760 wrote to memory of 2016	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	notepad .exe
PID 1760 wrote to memory of 2016	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	notepad .exe
PID 1760 wrote to memory of 2016	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	notepad .exe
PID 1760 wrote to memory of 2016	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	notepad .exe
PID 1760 wrote to memory of 2016	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	notepad .exe
PID 1760 wrote to memory of 2016	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	notepad .exe
PID 1760 wrote to memory of 2016	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	notepad .exe
PID 1760 wrote to memory of 2016	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	notepad .exe
PID 1760 wrote to memory of 2016	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	notepad .exe
PID 948 wrote to memory of 1096	948	wscript.exe	cmd.exe
PID 948 wrote to memory of 1096	948	wscript.exe	cmd.exe
PID 948 wrote to memory of 1096	948	wscript.exe	cmd.exe
PID 948 wrote to memory of 1096	948	wscript.exe	cmd.exe
PID 1760 wrote to memory of 1196	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	cmd.exe
PID 1760 wrote to memory of 1196	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	cmd.exe
PID 1760 wrote to memory of 1196	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	cmd.exe
PID 1760 wrote to memory of 1196	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	cmd.exe
PID 1760 wrote to memory of 1756	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	cmd.exe
PID 1760 wrote to memory of 1756	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	cmd.exe
PID 1760 wrote to memory of 1756	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	cmd.exe
PID 1760 wrote to memory of 1756	1760	511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe	cmd.exe
PID 1196 wrote to memory of 1912	1196	cmd.exe	timeout.exe
PID 1196 wrote to memory of 1912	1196	cmd.exe	timeout.exe
PID 1196 wrote to memory of 1912	1196	cmd.exe	timeout.exe
PID 1196 wrote to memory of 1912	1196	cmd.exe	timeout.exe
PID 1196 wrote to memory of 1420	1196	cmd.exe	tasklist.exe
PID 1196 wrote to memory of 1420	1196	cmd.exe	tasklist.exe
PID 1196 wrote to memory of 1420	1196	cmd.exe	tasklist.exe
PID 1196 wrote to memory of 1420	1196	cmd.exe	tasklist.exe
PID 1196 wrote to memory of 2024	1196	cmd.exe	find.exe
PID 1196 wrote to memory of 2024	1196	cmd.exe	find.exe
PID 1196 wrote to memory of 2024	1196	cmd.exe	find.exe
PID 1196 wrote to memory of 2024	1196	cmd.exe	find.exe
PID 1196 wrote to memory of 1012	1196	cmd.exe	ap.exe
PID 1196 wrote to memory of 1012	1196	cmd.exe	ap.exe
PID 1196 wrote to memory of 1012	1196	cmd.exe	ap.exe
PID 1196 wrote to memory of 1012	1196	cmd.exe	ap.exe

C:\Users\Admin\AppData\Local\Temp\511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe
"C:\Users\Admin\AppData\Local\Temp\511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\AppData\Local\Temp\File.exe
"C:\Users\Admin\AppData\Local\Temp\File.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1764

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Windows\mata.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Windows\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\Windows\mata2.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\Windows\mata2.bat" "
4⤵
PID:1096

C:\Users\Admin\AppData\Local\Temp\notepad .exe
"C:\Users\Admin\AppData\Local\Temp\notepad .exe"
2⤵
- Executes dropped EXE
PID:2016

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\Windows\stres.bat" "
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\timeout.exe
timeout /t @@
3⤵
- Delays execution with timeout.exe
PID:1912

C:\Windows\SysWOW64\tasklist.exe
tasklist /nh /fi "imagename eq notepad .exe"
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Windows\SysWOW64\find.exe
find /i "notepad .exe"
3⤵
PID:2024

C:\Users\Admin\AppData\Local\Temp\ap.exe
"C:\Users\Admin\AppData\Local\Temp\ap.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1012

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Windows\melt.bat
2⤵
PID:1756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Process Discovery

T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\File.exe
Filesize
658KB

MD5
dc18c395b4bc2ed84c73a92e24ec180f

SHA1
000d0ae05deb7cb68619042ef8bdfa2018eb74d0

SHA256
164c50a009fac9a4b478a34c06f46bddb707dd9960d7e83a776f29b64e4d8d0c

SHA512
a5315d65056c478ac1751b6e0f8f45dcc28912f4c895d91668ab9043d645e5b3037063f8204ff4c1e136689a2274b0d46301e09abd9c060d1d0c10f599c9bde7

Download Submit
C:\Users\Admin\AppData\Local\Temp\File.exe
Filesize
658KB

MD5
dc18c395b4bc2ed84c73a92e24ec180f

SHA1
000d0ae05deb7cb68619042ef8bdfa2018eb74d0

SHA256
164c50a009fac9a4b478a34c06f46bddb707dd9960d7e83a776f29b64e4d8d0c

SHA512
a5315d65056c478ac1751b6e0f8f45dcc28912f4c895d91668ab9043d645e5b3037063f8204ff4c1e136689a2274b0d46301e09abd9c060d1d0c10f599c9bde7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\Windows.exe
Filesize
2.8MB

MD5
ff9142946eaf74497cce37d6042a001e

SHA1
84a9a186ca189b94b6cc96149b8a891fbb1ad4b8

SHA256
511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc

SHA512
c124a5d17c0d350d3c5b180644bee992e4eb634e25e6c8cce2f4da2336461d98eb5901a0b69b61b7b81aa4bc771c2f2f40fd7f8040b44894c9c84ae7cdb7a249

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\invs.vbs
Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\mata.bat
Filesize
63B

MD5
260efbd339dd3b0ab091d66df5cd3a16

SHA1
69d4e59b4e8edc557ee9b9a351576ea61f3092cc

SHA256
1d87c3291eda5b1fd8f3ff3fccb7efde33955fea4487369dfa23132f63e3b969

SHA512
cad75d955bb4ca61a8d2a9f5fac0c0ddc8fe97d05ad12850b2734efadb237b5310d4264745972f8a78b3918a90e23fba8d540fd64791eac8c3be9a5e50042812

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\mata2.bat
Filesize
68B

MD5
553af02e55667d29f9054e5c101e2681

SHA1
1e4dfaf248d5800a1b61cec13d0f47370550510b

SHA256
0cf596fc133d75e2d007682a3f9caf1ae61137e50d3eb1354edca506434d7bb9

SHA512
4fa45b23be7f6900a50f7e6540017e137b88d770960148a05a8f00f52ce98762f6f2ef4d9cd721c5b2033ae0d6f063ab0ad8a1fd4fa2c94dff30fb0fb0d53e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\rundll11-.txt
Filesize
2.8MB

MD5
ff9142946eaf74497cce37d6042a001e

SHA1
84a9a186ca189b94b6cc96149b8a891fbb1ad4b8

SHA256
511535e2c71f17fbb05320f5e3d109c7258bddf6b738a2bc819eb7131208c0bc

SHA512
c124a5d17c0d350d3c5b180644bee992e4eb634e25e6c8cce2f4da2336461d98eb5901a0b69b61b7b81aa4bc771c2f2f40fd7f8040b44894c9c84ae7cdb7a249

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\stres.bat
Filesize
197B

MD5
baa5967892307b9bfb407b3af219d530

SHA1
0885a05bfaf364c6558d78ab7dd2d4acadca243f

SHA256
88ab119f42700edf3b3960a0c3737570d66d869a3d81205e415526bf3534bf95

SHA512
1f1caa8923401394c3ddb7c5c3a2683f2ff01e1b20366988dabbb37d3db3cdd35f4f19412f994068eba88dfce9519d6e4a27834835d4c4ea3db2531a72b654f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ap.exe
Filesize
156KB

MD5
a5b656183ccf21ef700f56406eb21525

SHA1
554aa9e72a3be3dff7e1a069d9c2e1fcf54e6b41

SHA256
aaa68a7b2131ad9ab852a66b8110d08dcc483bcee5afec941f65fe94c3a670b5

SHA512
e98d8370a7cd04586b18694be7d7586f76b2c1b9a642ead759716c6ce4b95be2aad69fa555f2f84cb83e76163c6702d37c3d0199e52162f35d5c5229a81107df

Download Submit
C:\Users\Admin\AppData\Local\Temp\ap.exe
Filesize
156KB

MD5
a5b656183ccf21ef700f56406eb21525

SHA1
554aa9e72a3be3dff7e1a069d9c2e1fcf54e6b41

SHA256
aaa68a7b2131ad9ab852a66b8110d08dcc483bcee5afec941f65fe94c3a670b5

SHA512
e98d8370a7cd04586b18694be7d7586f76b2c1b9a642ead759716c6ce4b95be2aad69fa555f2f84cb83e76163c6702d37c3d0199e52162f35d5c5229a81107df

Download Submit
C:\Users\Admin\AppData\Local\Temp\notepad .exe
Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
\Users\Admin\AppData\Local\Temp\File.exe
Filesize
658KB

MD5
dc18c395b4bc2ed84c73a92e24ec180f

SHA1
000d0ae05deb7cb68619042ef8bdfa2018eb74d0

SHA256
164c50a009fac9a4b478a34c06f46bddb707dd9960d7e83a776f29b64e4d8d0c

SHA512
a5315d65056c478ac1751b6e0f8f45dcc28912f4c895d91668ab9043d645e5b3037063f8204ff4c1e136689a2274b0d46301e09abd9c060d1d0c10f599c9bde7

Download Submit
\Users\Admin\AppData\Local\Temp\File.exe
Filesize
658KB

MD5
dc18c395b4bc2ed84c73a92e24ec180f

SHA1
000d0ae05deb7cb68619042ef8bdfa2018eb74d0

SHA256
164c50a009fac9a4b478a34c06f46bddb707dd9960d7e83a776f29b64e4d8d0c

SHA512
a5315d65056c478ac1751b6e0f8f45dcc28912f4c895d91668ab9043d645e5b3037063f8204ff4c1e136689a2274b0d46301e09abd9c060d1d0c10f599c9bde7

Download Submit
\Users\Admin\AppData\Local\Temp\ap.exe
Filesize
156KB

MD5
a5b656183ccf21ef700f56406eb21525

SHA1
554aa9e72a3be3dff7e1a069d9c2e1fcf54e6b41

SHA256
aaa68a7b2131ad9ab852a66b8110d08dcc483bcee5afec941f65fe94c3a670b5

SHA512
e98d8370a7cd04586b18694be7d7586f76b2c1b9a642ead759716c6ce4b95be2aad69fa555f2f84cb83e76163c6702d37c3d0199e52162f35d5c5229a81107df

Download Submit
\Users\Admin\AppData\Local\Temp\notepad .exe
Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
memory/948-65-0x0000000000000000-mapping.dmp

Download
memory/1012-103-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/1012-100-0x0000000000000000-mapping.dmp

Download
memory/1096-88-0x0000000000000000-mapping.dmp

Download
memory/1196-90-0x0000000000000000-mapping.dmp

Download
memory/1380-63-0x0000000000000000-mapping.dmp

Download
memory/1420-95-0x0000000000000000-mapping.dmp

Download
memory/1756-93-0x0000000000000000-mapping.dmp

Download
memory/1760-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1760-55-0x0000000074FB0000-0x000000007555B000-memory.dmp

Filesize
5.7MB

Download
memory/1760-96-0x0000000074FB0000-0x000000007555B000-memory.dmp

Filesize
5.7MB

Download
memory/1760-56-0x0000000074FB0000-0x000000007555B000-memory.dmp

Filesize
5.7MB

Download
memory/1764-59-0x0000000000000000-mapping.dmp

Download
memory/1912-94-0x0000000000000000-mapping.dmp

Download
memory/2016-85-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2016-83-0x0000000000000000-mapping.dmp

Download
memory/2016-81-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2016-79-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2016-77-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2016-75-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2016-73-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2016-71-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2016-69-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2016-67-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2024-97-0x0000000000000000-mapping.dmp

Download