Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/03/2024, 14:46

General

  • Target

    1994f3ef2118aeecbb74e6c8976fd47b.exe

  • Size

    3.2MB

  • MD5

    1994f3ef2118aeecbb74e6c8976fd47b

  • SHA1

    8f157fc5c2af51db24b66085f29d3c1240be36b2

  • SHA256

    5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c

  • SHA512

    48837e3aa613c2864b6ce2470a9297cac0ca04b58493e322b54f1d76bc3c3778cbebd63bb0aea9232493dd0ae065094f937e55ae4024b186332c277c28b4f15a

  • SSDEEP

    49152:a4iktlQ2cj9ScADsiz76m0JVqeUYfHuv4mDrsdWE2hnKQ9nO1zdhBFMGIEdY/0/w:aXktlQQsE49UguAiu2cp1zjLddZ9QY

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 39 IoCs
  • DCRat payload 7 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Checks whether UAC is enabled 1 TTPs 26 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1994f3ef2118aeecbb74e6c8976fd47b.exe
    "C:\Users\Admin\AppData\Local\Temp\1994f3ef2118aeecbb74e6c8976fd47b.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3652
    • C:\Windows\IME\sihost.exe
      "C:\Windows\IME\sihost.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2824
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15234ff9-bbcb-4579-9fda-e93d30bb2914.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3016
        • C:\Windows\IME\sihost.exe
          C:\Windows\IME\sihost.exe
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2340
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da48e0fc-f022-4033-b910-4729c7b9c20f.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3304
            • C:\Windows\IME\sihost.exe
              C:\Windows\IME\sihost.exe
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1600
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b70013c-6727-4b82-9265-3fa9548cc030.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:4668
                • C:\Windows\IME\sihost.exe
                  C:\Windows\IME\sihost.exe
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:5100
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7567cb4-16d5-4dff-b4bb-bb84e6e28a7f.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1180
                    • C:\Windows\IME\sihost.exe
                      C:\Windows\IME\sihost.exe
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:736
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94e6685f-aa57-4d24-9a3a-e4862051ea63.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3836
                        • C:\Windows\IME\sihost.exe
                          C:\Windows\IME\sihost.exe
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:1004
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3efcd243-0177-4d7d-89ed-122ed781660d.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3956
                            • C:\Windows\IME\sihost.exe
                              C:\Windows\IME\sihost.exe
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:800
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e47e9233-795b-4e17-9aac-54f6c06d962e.vbs"
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4268
                                • C:\Windows\IME\sihost.exe
                                  C:\Windows\IME\sihost.exe
                                  16⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:1816
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\21442f3d-ae3b-4097-9039-dcde8eb658b0.vbs"
                                    17⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4564
                                    • C:\Windows\IME\sihost.exe
                                      C:\Windows\IME\sihost.exe
                                      18⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:5032
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b9155a3a-ba96-4998-99c7-f3b012b76dbb.vbs"
                                        19⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:2824
                                        • C:\Windows\IME\sihost.exe
                                          C:\Windows\IME\sihost.exe
                                          20⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          • System policy modification
                                          PID:2524
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc19abc5-01c1-4dcd-93fb-918855712286.vbs"
                                            21⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:948
                                            • C:\Windows\IME\sihost.exe
                                              C:\Windows\IME\sihost.exe
                                              22⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:2600
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e04fe46-58ee-46b5-b9dd-f868daf08af9.vbs"
                                                23⤵
                                                  PID:4872
                                                  • C:\Windows\IME\sihost.exe
                                                    C:\Windows\IME\sihost.exe
                                                    24⤵
                                                    • UAC bypass
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:1332
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75124d03-8375-4cca-a474-3121e6e88ef1.vbs"
                                                  23⤵
                                                    PID:1660
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\447d858a-acb8-4a4f-828f-f01f7363e6c2.vbs"
                                                21⤵
                                                  PID:2016
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a5418e9-65dc-492f-b816-a8551bc8866c.vbs"
                                              19⤵
                                                PID:4964
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a29f429e-4d42-4939-9ce2-86d93ef89156.vbs"
                                            17⤵
                                              PID:1284
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67a842c9-65c9-44a9-9e03-63f55a2d2296.vbs"
                                          15⤵
                                            PID:2308
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c13d4804-f98e-4837-85df-14e90c84afc0.vbs"
                                        13⤵
                                          PID:5000
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7c64d213-d109-470c-b1a5-f4ebaec1a296.vbs"
                                      11⤵
                                        PID:3736
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fcac7a25-e525-42fb-87d0-bad48b43bcb8.vbs"
                                    9⤵
                                      PID:4960
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48235334-98bc-48cc-b170-61e59946c04a.vbs"
                                  7⤵
                                    PID:3248
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc2caa68-021d-4fb2-bc92-19db02bbde9b.vbs"
                                5⤵
                                  PID:4544
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b013b4bb-b03a-4ba4-ac08-5670cf4f0c95.vbs"
                              3⤵
                                PID:2384
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:1476
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:2052
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:2808
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:3224
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:3980
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:1284
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\sihost.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:5100
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\IME\sihost.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:3968
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Windows\IME\sihost.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:2656
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:3256
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:2444
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:4696
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:4420
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:3960
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:2680
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Windows\DigitalLocker\en-US\WmiPrvSE.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:4272
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:3932
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Windows\DigitalLocker\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:4496
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\wininit.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:3736
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\wininit.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:3168
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\wininit.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:2152
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\swidtag\unsecapp.exe'" /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:3836
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\unsecapp.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:3304
                          • C:\Windows\system32\schtasks.exe
                            schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\swidtag\unsecapp.exe'" /rl HIGHEST /f
                            1⤵
                            • Process spawned unexpected child process
                            • Creates scheduled task(s)
                            PID:1248
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1404 --field-trial-handle=2288,i,11069632825633797559,14829202121434726371,262144 --variations-seed-version /prefetch:8
                            1⤵
                              PID:1292

                            Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Recovery\WindowsRE\WmiPrvSE.exe

                                    Filesize

                                    3.2MB

                                    MD5

                                    1994f3ef2118aeecbb74e6c8976fd47b

                                    SHA1

                                    8f157fc5c2af51db24b66085f29d3c1240be36b2

                                    SHA256

                                    5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c

                                    SHA512

                                    48837e3aa613c2864b6ce2470a9297cac0ca04b58493e322b54f1d76bc3c3778cbebd63bb0aea9232493dd0ae065094f937e55ae4024b186332c277c28b4f15a

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log

                                    Filesize

                                    1KB

                                    MD5

                                    caa9da90d9bfc2c0fbadbf7eb57d1aae

                                    SHA1

                                    b0237d1cdb8c7fdb6f89e72475dbfb639c025ed7

                                    SHA256

                                    b5c2348671b5ad62cc02ded41adcf1855341bd6d20706bf45d9d68e4cddd4bbd

                                    SHA512

                                    da20485cf87f6e9b95141dea062188b5a2299ff1e1a7f83446afac0d8b70a2d18d02b60b232b2c9e6af5071906dd08f41cf4637379165c1823a9fa9b82d155d8

                                  • C:\Users\Admin\AppData\Local\Temp\15234ff9-bbcb-4579-9fda-e93d30bb2914.vbs

                                    Filesize

                                    701B

                                    MD5

                                    c197d86851a27e80e79fa26f2a8cd389

                                    SHA1

                                    74f84aeac26093634d4cc98c8889ca31fa11dc1b

                                    SHA256

                                    0d5316e6762e27563d8efac7420bf6cce53db522899c1d0affeb328904f5bb21

                                    SHA512

                                    2ee24e8465f7e267061aa2889604a9554fec7e6e4edd6e32fbd4edb4fa2b482087f3580c11857c707fe2a69242e3a2483f7de3469cde649f8147c57d6b6ecf63

                                  • C:\Users\Admin\AppData\Local\Temp\21442f3d-ae3b-4097-9039-dcde8eb658b0.vbs

                                    Filesize

                                    701B

                                    MD5

                                    1be80a536ae16237e66690e5ef8dd013

                                    SHA1

                                    5c7cd5fc2ac83592b41d985ad5a0c01049115458

                                    SHA256

                                    a1a70a21d8e636ef1a39a3b29a1528a3d49f39a89921e34b62ca2770decd0c9f

                                    SHA512

                                    f1a928a7576ffa67f1340736366eb8b5f17d6501bf3aecb6656bf5f3ddca7c5d14ba452f99d3124d06b6a46fcc428ad076e05fe5c2b776d1f5a6fe64cff04600

                                  • C:\Users\Admin\AppData\Local\Temp\3e04fe46-58ee-46b5-b9dd-f868daf08af9.vbs

                                    Filesize

                                    701B

                                    MD5

                                    bd108ac39a6242efc9fb010349bec6fd

                                    SHA1

                                    3bac999a0d5f9cf64edc63a09cc73ba6e70ab759

                                    SHA256

                                    645e20c335b9932fd3a6545f29949dbd153a8117bba54e4951ec128fd8ca2127

                                    SHA512

                                    c4886037f151a89dc0f01cf690677076d5f0d50f3113e70efb7d6b96afadd18acad02274d09d414899bc5c1033e5127458625ffeccecc4e0d6e3216e11008afe

                                  • C:\Users\Admin\AppData\Local\Temp\3efcd243-0177-4d7d-89ed-122ed781660d.vbs

                                    Filesize

                                    701B

                                    MD5

                                    932dd01f505d029a58bd9ad1b5702500

                                    SHA1

                                    413833da9a3a209cd00166525ed4b8679ae47114

                                    SHA256

                                    80933d16c707bc8b93bd7ec4bec57ba1b3bd53195b992acc93a0b95ec4a4b43a

                                    SHA512

                                    de00c156fea8e8152120f22a978c1053f95b55d5a5ca88f97ea65732b9cbc0081b10c59fca50f6664d01aa689fc2d69983488091241405d326e1954afb3a9abb

                                  • C:\Users\Admin\AppData\Local\Temp\721f9b048f73638b90e5a081c86a3cfb90a41d4d.exe

                                    Filesize

                                    2.6MB

                                    MD5

                                    b0d37d80f38c5a9b2c6bbd82cbe9b02f

                                    SHA1

                                    023ea65c16cbdb86648c06b257473f267b9dced4

                                    SHA256

                                    d2c34cafaecb5326c0d7128a5f2ccf3fe8694675579aa5b81caef4549d591952

                                    SHA512

                                    f151bd0db69a63b2b6a7d9ab2bac2a13b96508240b7c2e3db9a9773ed24eede1d9d62c33355db3d282d56bbe2aac9fdb8396226ded09d92f3fb8818f446a8929

                                  • C:\Users\Admin\AppData\Local\Temp\7b70013c-6727-4b82-9265-3fa9548cc030.vbs

                                    Filesize

                                    701B

                                    MD5

                                    7b0d75ad5be2ae9635155b3d693acb02

                                    SHA1

                                    f1114fbad4e3333bea3b6054eece870391141332

                                    SHA256

                                    b1680b8abac818b72e8ac595f812290b9699464118984ccdbfa62f155c3b1a8c

                                    SHA512

                                    8ab2175a32f50320c722577e5a9f33f912d4baa6545a73bc26c1ffb4e3f7478f6a24df15a06a032fe3a001ca08f92adab0cc4db0bbee86346d1c431000b41e6f

                                  • C:\Users\Admin\AppData\Local\Temp\94e6685f-aa57-4d24-9a3a-e4862051ea63.vbs

                                    Filesize

                                    700B

                                    MD5

                                    e848b08fb6632d8ab39cd172d89ddafd

                                    SHA1

                                    48f5fc9c617dac5c9440cb4a0793284cfc3598c7

                                    SHA256

                                    348fbde7951db51755b40c388eb69d0f4d299fde542009fdb674ab7874e63002

                                    SHA512

                                    6f9ab508685569c1a9bc54d9f9601b5008db2d7a98cac3b1e55bc5f41f9343e89a5a70d48e8b007005fba1ec895f8326b5e85fe20522422437f6b2d6afec045e

                                  • C:\Users\Admin\AppData\Local\Temp\b013b4bb-b03a-4ba4-ac08-5670cf4f0c95.vbs

                                    Filesize

                                    477B

                                    MD5

                                    ae69c49a9e4ff35f66476085d64fe9e8

                                    SHA1

                                    71dc96965de06ce02c5de133589e43e318f98c87

                                    SHA256

                                    99d31f720a1169c989bd8b553ee4340b6e7186775d2698dfd4af200b69b11aea

                                    SHA512

                                    2f7cbe5201fa3f524155ab5513a26e3135b73562ff5d70e39ed27c459b50ed7d39225c26c41f79b0934c29ba2ab352b5c6981c058d33353f5f20269c1b4a0279

                                  • C:\Users\Admin\AppData\Local\Temp\b7567cb4-16d5-4dff-b4bb-bb84e6e28a7f.vbs

                                    Filesize

                                    701B

                                    MD5

                                    9aa99fa17b336b4e99388fde3a93c1a1

                                    SHA1

                                    169503477daecc8aeccd1f7f466e50539603a6e8

                                    SHA256

                                    c755cd395df9622480553e93ace749ce01287cad92d9fa8714e9827df5ed35eb

                                    SHA512

                                    57fd634b84c150d637b87f0447db6530600287db61dbdabb5464244ba9aba05b50ff586e7212033c592227411c9c123e20a3e2585d19ca69a5b1bd2738b40cdc

                                  • C:\Users\Admin\AppData\Local\Temp\b9155a3a-ba96-4998-99c7-f3b012b76dbb.vbs

                                    Filesize

                                    701B

                                    MD5

                                    e4b3252bfc8a732ba543e0316a2b48f6

                                    SHA1

                                    4b26183a81e3215db513a21ccc8ea1463422cb2a

                                    SHA256

                                    06cabbdde4774fa04fc6d2620dfc43c75a3cf2191a597d6dda706e485dd6b314

                                    SHA512

                                    ec01ef6b2a09f359db463f46bc98cc7f1ca0521936d72e5d98b0d16c5eebeeb67d461930504d007d8a9da61aa56c3b4ddecd53e6b20680c1b062b4e0f82a6f62

                                  • C:\Users\Admin\AppData\Local\Temp\da48e0fc-f022-4033-b910-4729c7b9c20f.vbs

                                    Filesize

                                    701B

                                    MD5

                                    758fbc3773cd47b587e18ffe8c5c97c0

                                    SHA1

                                    0be7cd3bad942a91be07bc9c2e6c3a2d54cca6cb

                                    SHA256

                                    af79947f9e91e78051b4983e74fd6163474995c8abb1965f05ada57f87ce7fc2

                                    SHA512

                                    5d74f41bdd9b472ea9414cf4475c8f984e5578b676967561c128b59eb3bb4e6b0cca5a006e06df5979afc367ab4cb4171d972ab9b703fce2d31325fdd94647b2

                                  • C:\Users\Admin\AppData\Local\Temp\dc19abc5-01c1-4dcd-93fb-918855712286.vbs

                                    Filesize

                                    701B

                                    MD5

                                    c620990b01cfffcd2b1c5440fd42a88c

                                    SHA1

                                    dacb204296f1e3dd7cbdd5813f7596a8718eacb3

                                    SHA256

                                    2e31b33e3b28ed7a3d49a92301b3a8f9868970c8bb6ac1b9be8a1101ded3c287

                                    SHA512

                                    6fe3bc58bcaef072b51c9959fc161e7832ec5839bf6b80b3bc4cd7512d15643574c357fb84f66522278d1093d8dc19bacc5139f5e6b447b8802d02a9244f06ac

                                  • C:\Users\Admin\AppData\Local\Temp\e47e9233-795b-4e17-9aac-54f6c06d962e.vbs

                                    Filesize

                                    700B

                                    MD5

                                    887014ce5b8fc69f95c890e9b277e6bd

                                    SHA1

                                    fcec44c84571ebf765f190280f32ec070c7d0e14

                                    SHA256

                                    619ef7b684ef1e825512678c6f5abb9c2a067d6912d6d4d3582ec24d3dc2abe1

                                    SHA512

                                    b6323b809ac900663dab28fe799ae188d9cc27b02cf37bfbc3acb4f8379bc48decd4a492ae777ff50b0147853a1a067cbd07e73d1c9dcbe29fb4b365d95da31d

                                  • C:\Windows\IME\sihost.exe

                                    Filesize

                                    832KB

                                    MD5

                                    6ec7dd5d1c82cd6031c2579b6282699e

                                    SHA1

                                    0546c098d69dc312606ab273cbc5dcb928f65453

                                    SHA256

                                    1b0c172d0db46827b918934f88c34e74fa0ffcb79ebead3ea03e26d8f7186580

                                    SHA512

                                    d7050d15ca7c1164bd3a3f61296ea78af19332aa332ea799361da02f35701739234043571a5e5a902f1badbab605e2ca8a7b111c9135d01d5b2aaf5d95aad945

                                  • C:\Windows\IME\sihost.exe

                                    Filesize

                                    1024KB

                                    MD5

                                    8b2ca5725b53c924f814806bccc73a34

                                    SHA1

                                    f1dacc8df8f52f2fcab15c5c80bcc686c9b08db2

                                    SHA256

                                    e8c2d275a9e46065c470b273039bcca11bc691ed2319d5553237deadfe009370

                                    SHA512

                                    e7f68e0ba90431a07ce952c5199242376eb2424f9b0c396359ed3f9b176b21eb32ea6a7ecfa5ba9a713c03dda0aff0f1f275482f68c7921a4f2d3d3991567318

                                  • C:\Windows\IME\sihost.exe

                                    Filesize

                                    2.0MB

                                    MD5

                                    c27c96535b0354240030124f1b323e48

                                    SHA1

                                    beab51e8d4cd917cb446153f9526a23267e01bac

                                    SHA256

                                    9e4b1d0e68b6ab5e47a7c4a354aed06b8b10d5194f85a7d3c52051e7e65f14ae

                                    SHA512

                                    69072761f6e9cfbfaee03fc7dc62b28087a761b2b278a104a4b8118616725d41bae54449bf89bcb0848847d249f5c466f6bb8cdddb08d9564f93605cac1a8291

                                  • C:\Windows\IME\sihost.exe

                                    Filesize

                                    1.6MB

                                    MD5

                                    82d45dfd4a00c69ce48efc368d274c6f

                                    SHA1

                                    f7688e639d5f71cc62a602879eb70436f8db095f

                                    SHA256

                                    4a962da9ab8a3e14da476b61239458cb9e134f50812753a6e5992277c6575da4

                                    SHA512

                                    1f2254768fae9c3b46f0ad3ab214f9afb7314de640dc1266faf84ca4242683f3e111a288b9eacff06775b07fe236621b1bf4021d24f2089f220e6eaf8ea4389b

                                  • memory/736-133-0x00007FFC44720000-0x00007FFC451E1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/736-121-0x00007FFC44720000-0x00007FFC451E1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/736-122-0x000000001B980000-0x000000001B990000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/800-149-0x00007FFC44720000-0x00007FFC451E1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/800-161-0x00007FFC44720000-0x00007FFC451E1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/800-150-0x0000000002650000-0x0000000002662000-memory.dmp

                                    Filesize

                                    72KB

                                  • memory/1004-136-0x000000001BF70000-0x000000001BF80000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/1004-147-0x00007FFC44720000-0x00007FFC451E1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1004-135-0x00007FFC44720000-0x00007FFC451E1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1600-93-0x00007FFC44720000-0x00007FFC451E1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1600-94-0x000000001BF60000-0x000000001BF70000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/1600-105-0x00007FFC44720000-0x00007FFC451E1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1816-163-0x00007FFC448E0000-0x00007FFC453A1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/1816-164-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/1816-165-0x000000001BC50000-0x000000001BC62000-memory.dmp

                                    Filesize

                                    72KB

                                  • memory/1816-176-0x00007FFC448E0000-0x00007FFC453A1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2340-91-0x00007FFC44720000-0x00007FFC451E1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2340-80-0x00000000012C0000-0x00000000012D0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2340-79-0x00007FFC44720000-0x00007FFC451E1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2824-65-0x0000000001360000-0x0000000001370000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/2824-76-0x00007FFC444D0000-0x00007FFC44F91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/2824-63-0x00007FFC444D0000-0x00007FFC44F91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3652-20-0x000000001BAA0000-0x000000001BAB2000-memory.dmp

                                    Filesize

                                    72KB

                                  • memory/3652-19-0x000000001B330000-0x000000001B338000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/3652-18-0x000000001B320000-0x000000001B32C000-memory.dmp

                                    Filesize

                                    48KB

                                  • memory/3652-64-0x00007FFC444D0000-0x00007FFC44F91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3652-33-0x000000001BD70000-0x000000001BD78000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/3652-32-0x000000001BD60000-0x000000001BD6C000-memory.dmp

                                    Filesize

                                    48KB

                                  • memory/3652-30-0x000000001BD40000-0x000000001BD48000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/3652-31-0x000000001BD50000-0x000000001BD5E000-memory.dmp

                                    Filesize

                                    56KB

                                  • memory/3652-29-0x000000001BD30000-0x000000001BD3E000-memory.dmp

                                    Filesize

                                    56KB

                                  • memory/3652-27-0x000000001BD20000-0x000000001BD28000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/3652-28-0x000000001BE30000-0x000000001BE3A000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/3652-26-0x000000001BB10000-0x000000001BB1C000-memory.dmp

                                    Filesize

                                    48KB

                                  • memory/3652-25-0x000000001BB00000-0x000000001BB0C000-memory.dmp

                                    Filesize

                                    48KB

                                  • memory/3652-24-0x000000001BAF0000-0x000000001BAF8000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/3652-23-0x000000001BAE0000-0x000000001BAEC000-memory.dmp

                                    Filesize

                                    48KB

                                  • memory/3652-1-0x00007FFC444D0000-0x00007FFC44F91000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/3652-2-0x000000001B340000-0x000000001B350000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/3652-22-0x000000001BAD0000-0x000000001BADC000-memory.dmp

                                    Filesize

                                    48KB

                                  • memory/3652-3-0x0000000000F90000-0x0000000000F9E000-memory.dmp

                                    Filesize

                                    56KB

                                  • memory/3652-21-0x000000001C000000-0x000000001C528000-memory.dmp

                                    Filesize

                                    5.2MB

                                  • memory/3652-35-0x000000001BD90000-0x000000001BD9C000-memory.dmp

                                    Filesize

                                    48KB

                                  • memory/3652-0-0x0000000000340000-0x0000000000670000-memory.dmp

                                    Filesize

                                    3.2MB

                                  • memory/3652-34-0x000000001BD80000-0x000000001BD8A000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/3652-17-0x000000001B310000-0x000000001B318000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/3652-16-0x0000000002820000-0x000000000282C000-memory.dmp

                                    Filesize

                                    48KB

                                  • memory/3652-15-0x000000001BA50000-0x000000001BAA6000-memory.dmp

                                    Filesize

                                    344KB

                                  • memory/3652-14-0x0000000002810000-0x000000000281A000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/3652-13-0x0000000002800000-0x0000000002810000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/3652-12-0x00000000027E0000-0x00000000027E8000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/3652-11-0x00000000027F0000-0x00000000027FC000-memory.dmp

                                    Filesize

                                    48KB

                                  • memory/3652-10-0x00000000027D0000-0x00000000027E2000-memory.dmp

                                    Filesize

                                    72KB

                                  • memory/3652-9-0x00000000027C0000-0x00000000027C8000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/3652-8-0x00000000027A0000-0x00000000027B6000-memory.dmp

                                    Filesize

                                    88KB

                                  • memory/3652-7-0x0000000002790000-0x00000000027A0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/3652-6-0x0000000002780000-0x0000000002788000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/3652-5-0x0000000002770000-0x0000000002778000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/3652-4-0x0000000000FA0000-0x0000000000FAE000-memory.dmp

                                    Filesize

                                    56KB

                                  • memory/5032-178-0x00007FFC448E0000-0x00007FFC453A1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/5032-179-0x000000001B5B0000-0x000000001B5C0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/5100-119-0x00007FFC44720000-0x00007FFC451E1000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/5100-108-0x0000000001750000-0x0000000001760000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/5100-107-0x00007FFC44720000-0x00007FFC451E1000-memory.dmp

                                    Filesize

                                    10.8MB