Resubmissions

12-01-2023 20:01

230112-yrh6hsae52 10

07-01-2023 04:41

230107-fa3jqagb8t 10

07-01-2023 04:21

230107-eynj2acf87 10

Analysis

  • max time kernel
    59s
  • max time network
    63s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-01-2023 04:41

General

  • Target

    0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

  • Size

    3.8MB

  • MD5

    0a0a64f3c4fa7d960be983aa0a7d0ce8

  • SHA1

    b597c7397ecaff7c5c1aa27f5124fc7b8a94e643

  • SHA256

    6d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1

  • SHA512

    ef04e3eb8f2b10dae6845b97fa66086c3d02c5508adcd1923a93975c88f1ad0f80f984b563c36c4868276670b1dee9e11ae3c57faf7b0509118d121d920df7d4

  • SSDEEP

    98304:F7b3a0t2TiPhx6Sp+ybfnDA4qo34n1oO:FH3Z8cp+gDZ4n1

Malware Config

Signatures

  • DcRat 25 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 8 IoCs
  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 16 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 25 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
    "C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2700
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3476
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\Setup\Registry.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2960
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SIHClient.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4588
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\SIHClient.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1196
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\csrss.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1652
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\spoolsv.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2208
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\SIGNUP\OfficeClickToRun.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4276
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\dwm.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5096
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2588
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XJgX3joyyg.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2196
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:4916
        • C:\Program Files (x86)\Windows Media Player\dwm.exe
          "C:\Program Files (x86)\Windows Media Player\dwm.exe"
          3⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks computer location settings
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1768
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\18b95992-22dc-41dd-8aaf-812ca227ed56.vbs"
            4⤵
              PID:1300
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67fe6794-ea3f-4bf5-9c76-d2589a8d02d7.vbs"
              4⤵
                PID:2700
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Adobe\Setup\Registry.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1688
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Setup\Registry.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:816
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Adobe\Setup\Registry.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4968
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SIHClient.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:2112
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SIHClient" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SIHClient.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4924
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SIHClient.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:364
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\csrss.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:3028
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\csrss.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:3268
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\csrss.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:2980
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\SIHClient.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:2340
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SIHClient" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\SIHClient.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1380
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\SIHClient.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1356
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1308
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:2628
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\winlogon.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:3032
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\dwm.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1312
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\dwm.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4916
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\dwm.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4904
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\OfficeClickToRun.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:2640
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\OfficeClickToRun.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:3512
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\OfficeClickToRun.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1304
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\spoolsv.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4788
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\spoolsv.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:2536
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\spoolsv.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:32
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1556

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Execution

        Scheduled Task

        1
        T1053

        Persistence

        Winlogon Helper DLL

        1
        T1004

        Registry Run Keys / Startup Folder

        1
        T1060

        Scheduled Task

        1
        T1053

        Privilege Escalation

        Bypass User Account Control

        1
        T1088

        Scheduled Task

        1
        T1053

        Defense Evasion

        Modify Registry

        4
        T1112

        Bypass User Account Control

        1
        T1088

        Disabling Security Tools

        1
        T1089

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        3
        T1082

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Windows Media Player\dwm.exe
          Filesize

          3.8MB

          MD5

          1ba71683ca2b077c31c086fb9ec1be0c

          SHA1

          80e166b6a9df8d6347cbfa535d253a981185144e

          SHA256

          31506cfef39e936206adaf2b95c8cbead6863c344d818bd458697b26bc59cc31

          SHA512

          1b2745db8d2ccd4924876c4f6d66b0986d32b27308d3fa37b36f85dc2043956f2114ff1d4d8c3981ae53621bedf241c20721ea71a08155126522ff28caa17677

        • C:\Program Files (x86)\Windows Media Player\dwm.exe
          Filesize

          3.8MB

          MD5

          1ba71683ca2b077c31c086fb9ec1be0c

          SHA1

          80e166b6a9df8d6347cbfa535d253a981185144e

          SHA256

          31506cfef39e936206adaf2b95c8cbead6863c344d818bd458697b26bc59cc31

          SHA512

          1b2745db8d2ccd4924876c4f6d66b0986d32b27308d3fa37b36f85dc2043956f2114ff1d4d8c3981ae53621bedf241c20721ea71a08155126522ff28caa17677

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          3a6bad9528f8e23fb5c77fbd81fa28e8

          SHA1

          f127317c3bc6407f536c0f0600dcbcf1aabfba36

          SHA256

          986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

          SHA512

          846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          3a6bad9528f8e23fb5c77fbd81fa28e8

          SHA1

          f127317c3bc6407f536c0f0600dcbcf1aabfba36

          SHA256

          986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

          SHA512

          846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          3a6bad9528f8e23fb5c77fbd81fa28e8

          SHA1

          f127317c3bc6407f536c0f0600dcbcf1aabfba36

          SHA256

          986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

          SHA512

          846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          3a6bad9528f8e23fb5c77fbd81fa28e8

          SHA1

          f127317c3bc6407f536c0f0600dcbcf1aabfba36

          SHA256

          986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

          SHA512

          846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          3a6bad9528f8e23fb5c77fbd81fa28e8

          SHA1

          f127317c3bc6407f536c0f0600dcbcf1aabfba36

          SHA256

          986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

          SHA512

          846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          3a6bad9528f8e23fb5c77fbd81fa28e8

          SHA1

          f127317c3bc6407f536c0f0600dcbcf1aabfba36

          SHA256

          986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

          SHA512

          846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          5f0ddc7f3691c81ee14d17b419ba220d

          SHA1

          f0ef5fde8bab9d17c0b47137e014c91be888ee53

          SHA256

          a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

          SHA512

          2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          5f0ddc7f3691c81ee14d17b419ba220d

          SHA1

          f0ef5fde8bab9d17c0b47137e014c91be888ee53

          SHA256

          a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

          SHA512

          2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

        • C:\Users\Admin\AppData\Local\Temp\18b95992-22dc-41dd-8aaf-812ca227ed56.vbs
          Filesize

          727B

          MD5

          2cfe830c91f32a54876fdc449641db59

          SHA1

          6a14c1d46bef656ffb523adad934f0f928b81bd5

          SHA256

          d16c80cd8389a723a278f8219ab9ea3c328e7dab5ee4f93955e3e2ba825adf0a

          SHA512

          28b36b820889899c7da9bfa78dcf188b33534385405e6a742e27b4ab4a151def5bec00711ac536e1f92454f3a90a120e78111030a3496c515a1050c7eb9d246d

        • C:\Users\Admin\AppData\Local\Temp\67fe6794-ea3f-4bf5-9c76-d2589a8d02d7.vbs
          Filesize

          503B

          MD5

          eccc3ca55e786ac5611f63a1fdc53bf0

          SHA1

          445f6b013b361639e21c1a04d649e5d1e4d830a1

          SHA256

          f0c9e34ec34c3eb6b792247173063cae0fc9dfc0c90664ddfff66167d3822ae6

          SHA512

          d4c9edb27f39d31424679d074675b96b9c45139e1f35cffcdf9e4767b603d1bf2eb2c14ec9aca85c1c6e5fe3ad5fc74ce18ab3b627cba5ba64157689c1a63e94

        • C:\Users\Admin\AppData\Local\Temp\XJgX3joyyg.bat
          Filesize

          216B

          MD5

          65b49ea0066bb3006c0d2688d0a40749

          SHA1

          d2923af05e2bb2dfb6fe5fb1461ecadcfacc3ee7

          SHA256

          9aa1c13e9ea87e9139010d647ff1adce4dca690088640c6695fe387e9bc64549

          SHA512

          3c47f8df39ca9aa38d3a611fb15122061ec38342da55dcb68a4a383143614837d42a05de0d2f9d1ca85762b3d9b6650e1111c38d11af0cf4804e3b19b7c3152c

        • memory/1196-152-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/1196-140-0x0000000000000000-mapping.dmp
        • memory/1196-166-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/1300-182-0x0000000000000000-mapping.dmp
        • memory/1652-169-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/1652-139-0x0000000000000000-mapping.dmp
        • memory/1652-150-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/1768-181-0x00007FF99EAE0000-0x00007FF99F5A1000-memory.dmp
          Filesize

          10.8MB

        • memory/1768-187-0x000000001E490000-0x000000001E652000-memory.dmp
          Filesize

          1.8MB

        • memory/1768-186-0x00007FF99EAE0000-0x00007FF99F5A1000-memory.dmp
          Filesize

          10.8MB

        • memory/1768-180-0x0000000000950000-0x0000000000D1A000-memory.dmp
          Filesize

          3.8MB

        • memory/1768-177-0x0000000000000000-mapping.dmp
        • memory/2196-146-0x0000000000000000-mapping.dmp
        • memory/2208-157-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/2208-170-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/2208-144-0x0000000000000000-mapping.dmp
        • memory/2588-141-0x0000000000000000-mapping.dmp
        • memory/2588-172-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/2588-153-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/2700-133-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/2700-147-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/2700-132-0x0000000000180000-0x000000000054A000-memory.dmp
          Filesize

          3.8MB

        • memory/2700-135-0x000000001C880000-0x000000001CDA8000-memory.dmp
          Filesize

          5.2MB

        • memory/2700-184-0x0000000000000000-mapping.dmp
        • memory/2700-134-0x0000000002750000-0x00000000027A0000-memory.dmp
          Filesize

          320KB

        • memory/2960-137-0x0000000000000000-mapping.dmp
        • memory/2960-168-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/2960-149-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/3476-145-0x000001A136720000-0x000001A136742000-memory.dmp
          Filesize

          136KB

        • memory/3476-136-0x0000000000000000-mapping.dmp
        • memory/3476-148-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/3476-159-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/4276-155-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/4276-143-0x0000000000000000-mapping.dmp
        • memory/4276-171-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/4588-138-0x0000000000000000-mapping.dmp
        • memory/4588-151-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/4588-174-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/4916-158-0x0000000000000000-mapping.dmp
        • memory/5096-156-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB

        • memory/5096-142-0x0000000000000000-mapping.dmp
        • memory/5096-176-0x00007FF99EA80000-0x00007FF99F541000-memory.dmp
          Filesize

          10.8MB