Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2024, 02:11

General

  • Target

    5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c.exe

  • Size

    3.2MB

  • MD5

    1994f3ef2118aeecbb74e6c8976fd47b

  • SHA1

    8f157fc5c2af51db24b66085f29d3c1240be36b2

  • SHA256

    5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c

  • SHA512

    48837e3aa613c2864b6ce2470a9297cac0ca04b58493e322b54f1d76bc3c3778cbebd63bb0aea9232493dd0ae065094f937e55ae4024b186332c277c28b4f15a

  • SSDEEP

    49152:a4iktlQ2cj9ScADsiz76m0JVqeUYfHuv4mDrsdWE2hnKQ9nO1zdhBFMGIEdY/0/w:aXktlQQsE49UguAiu2cp1zjLddZ9QY

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 27 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 27 IoCs
  • DCRat payload 18 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Detects executables packed with SmartAssembly 8 IoCs
  • Executes dropped EXE 9 IoCs
  • Checks whether UAC is enabled 1 TTPs 18 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 27 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 27 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c.exe
    "C:\Users\Admin\AppData\Local\Temp\5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:272
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HEWX68JQRQ.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1396
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:1556
        • C:\Program Files\Windows Portable Devices\taskhost.exe
          "C:\Program Files\Windows Portable Devices\taskhost.exe"
          3⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2100
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9b1faba7-8be4-4277-bda7-c7af6e7267fe.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1760
            • C:\Program Files\Windows Portable Devices\taskhost.exe
              "C:\Program Files\Windows Portable Devices\taskhost.exe"
              5⤵
              • UAC bypass
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2352
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\efab0641-dc63-4a40-a90c-20f9b55c12f0.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:2524
                • C:\Program Files\Windows Portable Devices\taskhost.exe
                  "C:\Program Files\Windows Portable Devices\taskhost.exe"
                  7⤵
                  • UAC bypass
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:2580
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38f4b424-09d2-47e5-8131-39468d9594c5.vbs"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2932
                    • C:\Program Files\Windows Portable Devices\taskhost.exe
                      "C:\Program Files\Windows Portable Devices\taskhost.exe"
                      9⤵
                      • UAC bypass
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:2676
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c91e2168-0cc0-4dc7-af5d-60e006404385.vbs"
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1396
                        • C:\Program Files\Windows Portable Devices\taskhost.exe
                          "C:\Program Files\Windows Portable Devices\taskhost.exe"
                          11⤵
                          • UAC bypass
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:704
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40ef7bf1-6515-4952-8dfa-f5d30cf1649a.vbs"
                            12⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1648
                            • C:\Program Files\Windows Portable Devices\taskhost.exe
                              "C:\Program Files\Windows Portable Devices\taskhost.exe"
                              13⤵
                              • UAC bypass
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:2512
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eaeb500c-8888-46c1-82eb-d8d5c6e8ee87.vbs"
                                14⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2632
                                • C:\Program Files\Windows Portable Devices\taskhost.exe
                                  "C:\Program Files\Windows Portable Devices\taskhost.exe"
                                  15⤵
                                  • UAC bypass
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:2648
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ffd9dfd1-3b58-49ca-957d-9d6dc7f1fe84.vbs"
                                    16⤵
                                      PID:2508
                                      • C:\Program Files\Windows Portable Devices\taskhost.exe
                                        "C:\Program Files\Windows Portable Devices\taskhost.exe"
                                        17⤵
                                        • UAC bypass
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:2164
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\efa11173-157f-433e-903c-af59ae7aee42.vbs"
                                          18⤵
                                            PID:1576
                                            • C:\Program Files\Windows Portable Devices\taskhost.exe
                                              "C:\Program Files\Windows Portable Devices\taskhost.exe"
                                              19⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2976
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\56ff67d3-f552-4cca-838e-4318b56d7eba.vbs"
                                            18⤵
                                              PID:2296
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\55554c62-aa26-4d14-a2b1-ce3cb4fd9776.vbs"
                                          16⤵
                                            PID:1044
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9779ddd3-160f-4355-9928-fe0a1de73e50.vbs"
                                        14⤵
                                          PID:2128
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a792473-89f2-4026-b7b9-c3c24021a1ae.vbs"
                                      12⤵
                                        PID:2832
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\66470262-aa26-4459-aa35-caee02d96a17.vbs"
                                    10⤵
                                      PID:1364
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07d82ff2-5c02-411a-b215-7a2e81012cb5.vbs"
                                  8⤵
                                    PID:1812
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e7cc682-13ad-47d4-a834-2fce43e65dbb.vbs"
                                6⤵
                                  PID:1944
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2257f5aa-a96d-4391-bd92-6f2cae19b328.vbs"
                              4⤵
                                PID:1536
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2500
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2812
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2584
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\taskhost.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2416
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\taskhost.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2468
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\taskhost.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2924
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\audiodg.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2936
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2392
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1708
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Windows\Cursors\audiodg.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2748
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\Cursors\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1076
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Windows\Cursors\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2400
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\1cc83c02-d10e-11ee-94d5-decc1f73fbe3\wininit.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1016
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\1cc83c02-d10e-11ee-94d5-decc1f73fbe3\wininit.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1996
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\1cc83c02-d10e-11ee-94d5-decc1f73fbe3\wininit.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2756
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c5" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:592
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1004
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c5" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender\5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:572
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\DVD Maker\fr-FR\Idle.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2780
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\fr-FR\Idle.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2600
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\DVD Maker\fr-FR\Idle.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1828
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\wininit.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1524
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\wininit.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:1448
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\wininit.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2268
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\winlogon.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2920
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\winlogon.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2044
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\winlogon.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Creates scheduled task(s)
                          PID:2304

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Program Files\Windows Portable Devices\taskhost.exe

                                Filesize

                                1.4MB

                                MD5

                                20c10eec8ec6fc259112b6002003b733

                                SHA1

                                6d29de2fc60ab7327514893ac4f1be7ae77cdac1

                                SHA256

                                efd499d86b400fcf862f1d23b778b0c2d4de52f0b831a5cee06a997a99d3ddc1

                                SHA512

                                7d52d8c26780d8872ef1ac95166ddd26a6444a3fea971a54f6eb7bd7473dbe4fc61ac0b1122bbbfb651b023de45fde23fb6eb3da62735264537ffdaf7a8b3482

                              • C:\Program Files\Windows Portable Devices\taskhost.exe

                                Filesize

                                128KB

                                MD5

                                780855762200dc776393db6145c78e16

                                SHA1

                                cd93f05b6da2c6550d00e59b28763247be9b2f0b

                                SHA256

                                be464e525ae2df977512e103bb15dc83a5242885927ab734fc0198f2aa24f333

                                SHA512

                                ed15a14758e6ac45654982f240282e4323c1a6de9ca1b0dc832a6bf49b6b904642f246d481fea2e7f57b77b24b542d707661df1dfbaf4d9a0d74a54782faed68

                              • C:\Recovery\1cc83c02-d10e-11ee-94d5-decc1f73fbe3\wininit.exe

                                Filesize

                                3.2MB

                                MD5

                                1994f3ef2118aeecbb74e6c8976fd47b

                                SHA1

                                8f157fc5c2af51db24b66085f29d3c1240be36b2

                                SHA256

                                5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c

                                SHA512

                                48837e3aa613c2864b6ce2470a9297cac0ca04b58493e322b54f1d76bc3c3778cbebd63bb0aea9232493dd0ae065094f937e55ae4024b186332c277c28b4f15a

                              • C:\Users\Admin\AppData\Local\Temp\2257f5aa-a96d-4391-bd92-6f2cae19b328.vbs

                                Filesize

                                506B

                                MD5

                                fb30d99b99c17309a9ed1ec45db00be5

                                SHA1

                                c11a379197cdf8c1c478e2ee59854a14cac24322

                                SHA256

                                8d2d7a915d2c725e8a5f7cabb5e5c8c484279ed53d16baef15c210751bf581ab

                                SHA512

                                6197d9f31db104c994bfc5b58ad2c7a08bc88fe4538f7bcbf3afe8db9413d15d15ff2965eca260c9f2773c1812184c4a61d13429cfafae3ebec45acb2e858c45

                              • C:\Users\Admin\AppData\Local\Temp\38f4b424-09d2-47e5-8131-39468d9594c5.vbs

                                Filesize

                                730B

                                MD5

                                62c7cf704c4f77b7d9d715fe50451d90

                                SHA1

                                50741e588742808d38e7c5c0e1b77dc498fc6df9

                                SHA256

                                b30e6303e2570c51c87817962fa0486d6d1eab543dc528d3abc5e8a30401c765

                                SHA512

                                20957d863391a678882a4bda2dbc5ede684851d68b56f8331b3ebc8e9abd6919260156f2e2fa35cd58dd567f4c025c9ba4e03b113ba46c683966cb227501d040

                              • C:\Users\Admin\AppData\Local\Temp\40ef7bf1-6515-4952-8dfa-f5d30cf1649a.vbs

                                Filesize

                                729B

                                MD5

                                b2e21634779ae86b5362d1d1f710f45a

                                SHA1

                                a149a922ccfc2bf8ef5399ccc24e2618a133beac

                                SHA256

                                e3ff4db766744048a1737e0ff4bd83e45be893f3f67c9017396d8631528d819a

                                SHA512

                                4619d7daa0165a235cc82a444020888539faddca031a2e3ef915b0ccb264744a8062369d7d88fe49a17f1aab27fc386f4e2722476b09ebb5d8b6acd0bc438556

                              • C:\Users\Admin\AppData\Local\Temp\9b1faba7-8be4-4277-bda7-c7af6e7267fe.vbs

                                Filesize

                                730B

                                MD5

                                515f8ce95f4c3088b0d0f65355cf1bdf

                                SHA1

                                b3181078e20ce4bf67cd19a9f111deebd5d6601d

                                SHA256

                                04635cf477a09a8395eb6f77dfb3f19a9b43f59b897f2b02bc3167a5a7d10ab1

                                SHA512

                                90b558fa5579a6b2623efd7d61bcf64e9d0a0b5c1196330b93d0fc7658a76f9363c172f474ddb140f4f2e3b9e7fbc8dc5b67ff8f3f839040f711ba409705509c

                              • C:\Users\Admin\AppData\Local\Temp\HEWX68JQRQ.bat

                                Filesize

                                219B

                                MD5

                                0e4d081b13e82284dafa3cac305d972c

                                SHA1

                                8bfd416385dfb5e4561c89b2236c2204676086e1

                                SHA256

                                f3d018f48fb147ecbdb27f74d697c467554c2b23830efeaed0e1d704bc86ca40

                                SHA512

                                42b1d5914f4eff37a7647f632965af3e9747e7bcd234ba819edfe38fb05e0e006f15d6cf62f544dc27d20246781edb158dbcda431a339e8afcd5255415e79ba2

                              • C:\Users\Admin\AppData\Local\Temp\c91e2168-0cc0-4dc7-af5d-60e006404385.vbs

                                Filesize

                                730B

                                MD5

                                451303066e69071b439a46272896df64

                                SHA1

                                636506ff2e321ad39816c92f03ab051746ec7c92

                                SHA256

                                c3b0171832d03e856292792aa2c18f6d69ce08f2f22db374fe32072ab3d638fd

                                SHA512

                                05b8867a5be603a69636464295bfc1db40cd3fdb12d2e64d329f441ca08a0474ab1e1bd7cf8539e1a53ee04d1637ebb06f266763d8e08d7617d902a8d27f52ba

                              • C:\Users\Admin\AppData\Local\Temp\d367612823e45d490f3a6c1100d856af30363eba.exe

                                Filesize

                                1.1MB

                                MD5

                                3c73747ca7887309c86648b400adc4ef

                                SHA1

                                4051eb58f3edba6fb06d55bb80b64347523c9d69

                                SHA256

                                cc5481f1ab3982bb92d3a44c72aa48c68b58b7b69ae8e2ba8b6f0cd4d296655c

                                SHA512

                                549414730d6827f4bdb71175f9fb93f0d610c1cfdadd1b43e5dedbf2dc0fe7e47f14c467624afc26944703ddb4c905f60762fcfd0d4901d5afa24304a23f1029

                              • C:\Users\Admin\AppData\Local\Temp\d367612823e45d490f3a6c1100d856af30363eba.exe

                                Filesize

                                2.3MB

                                MD5

                                2eed9706ea6c42a65f386e3d8f08e8a9

                                SHA1

                                f1c436097c969a2c1bb2f4e583a665447076973b

                                SHA256

                                a45a7a7ec30f021cab59d26e68fdd056f851ba7f0d85c3052d4524471a2d9343

                                SHA512

                                3c37cd9905a2c74fd31b69183d05504cbf7510fc50425eb1ac7c5a760fb3c206e36dd7ea313fa3929b397222bdbb075db05e72be61ae8c88953c2d87314fdfef

                              • C:\Users\Admin\AppData\Local\Temp\d367612823e45d490f3a6c1100d856af30363eba.exe

                                Filesize

                                1.8MB

                                MD5

                                1990cab86254f561c848a92d01f8dd5d

                                SHA1

                                efed23a1f8d4a5add3b86d42c6ff5373e466503f

                                SHA256

                                ca4bc3845e09ca9574045bb19a043d023d98098f167deb0d9e316cc5160250aa

                                SHA512

                                697ed01abb07afc3628f0ff12bc80e46d7bf793e0a3c2883e638c31b4e5d7398a841feafb1be5435aa6fb00d5d480cb3ea0f7eb2c72727212bb4ade2982ee3c2

                              • C:\Users\Admin\AppData\Local\Temp\eaeb500c-8888-46c1-82eb-d8d5c6e8ee87.vbs

                                Filesize

                                730B

                                MD5

                                9c740d7919e02505ca9b3930f5da9bdf

                                SHA1

                                0de7f72ab95f3823e9cfa4f6dc4ef5332380eae8

                                SHA256

                                f0554d873f3d369eeb9242fc93046cd239244b66ed6896d7e6167ce76623ca42

                                SHA512

                                bec3431cc155ea4103cf47eb90e14fcf3ca446d535d3ad5943d78614a80e89ed5f21c40fc80efc8ff80b2fdd3ba683931dc8b9a27f2c45b2d0602861bf70e099

                              • C:\Users\Admin\AppData\Local\Temp\efa11173-157f-433e-903c-af59ae7aee42.vbs

                                Filesize

                                730B

                                MD5

                                192bbfbf13aa0ff6dac51d0929fe5851

                                SHA1

                                33d5359ecf2f78eb29bc7cd110b849b9b0b1ca9a

                                SHA256

                                e73e68679668df2ba782aea763b6a6a24cf64f95bfb1def52cceff6b789fd73f

                                SHA512

                                79b577d2f827eaba709e340f5485261b06acfe8bb0ed87d1a83d8d71c7f0ebf00a00cd9ff89044df7614aa55c4795eadb5127725e8f98d3bd2db35d2a880c444

                              • C:\Users\Admin\AppData\Local\Temp\efab0641-dc63-4a40-a90c-20f9b55c12f0.vbs

                                Filesize

                                730B

                                MD5

                                83d36f5c51d9aa7957ac6d208f3e204a

                                SHA1

                                5b08c22b2a6d917dc1d8a97206b18c97102ef11a

                                SHA256

                                4d5b345a43eec5e97cfc54641ec2702299d13ab210511fc30b8aa946fdf22367

                                SHA512

                                89e008453f3c44ba79705d138f8fad004e7238893e27acdfa843961b5e13b7cda4bfd58dd9cd7791c68faa6d3386387642cb1def5494eefea865eb1e77e0c939

                              • C:\Users\Admin\AppData\Local\Temp\ffd9dfd1-3b58-49ca-957d-9d6dc7f1fe84.vbs

                                Filesize

                                730B

                                MD5

                                e05540d911e4648a67988d018db2c704

                                SHA1

                                a37d9abbd9a430c593e669e3319aaea94f8582d8

                                SHA256

                                7ecc6751db1920e869aa916c8bbe0b7b7e444c3307022971acd5128bceead0da

                                SHA512

                                800de6bf8164dac3bab6b1d2f622ab042077c82a6cd16f74470bb7579415726f34e7148308435e044924d579874144bafaa30d6a4c4e2a83db27fda52b67de1f

                              • memory/272-14-0x0000000000700000-0x000000000070A000-memory.dmp

                                Filesize

                                40KB

                              • memory/272-58-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/272-18-0x0000000000650000-0x000000000065C000-memory.dmp

                                Filesize

                                48KB

                              • memory/272-19-0x0000000000660000-0x0000000000668000-memory.dmp

                                Filesize

                                32KB

                              • memory/272-20-0x0000000000710000-0x0000000000722000-memory.dmp

                                Filesize

                                72KB

                              • memory/272-21-0x0000000000740000-0x000000000074C000-memory.dmp

                                Filesize

                                48KB

                              • memory/272-22-0x0000000000920000-0x000000000092C000-memory.dmp

                                Filesize

                                48KB

                              • memory/272-23-0x0000000000930000-0x0000000000938000-memory.dmp

                                Filesize

                                32KB

                              • memory/272-24-0x0000000000940000-0x000000000094C000-memory.dmp

                                Filesize

                                48KB

                              • memory/272-25-0x0000000000950000-0x000000000095C000-memory.dmp

                                Filesize

                                48KB

                              • memory/272-26-0x0000000002350000-0x0000000002358000-memory.dmp

                                Filesize

                                32KB

                              • memory/272-28-0x0000000002310000-0x000000000231E000-memory.dmp

                                Filesize

                                56KB

                              • memory/272-27-0x0000000000960000-0x000000000096A000-memory.dmp

                                Filesize

                                40KB

                              • memory/272-29-0x0000000002320000-0x0000000002328000-memory.dmp

                                Filesize

                                32KB

                              • memory/272-30-0x0000000002330000-0x000000000233E000-memory.dmp

                                Filesize

                                56KB

                              • memory/272-31-0x0000000002340000-0x000000000234C000-memory.dmp

                                Filesize

                                48KB

                              • memory/272-32-0x0000000002360000-0x0000000002368000-memory.dmp

                                Filesize

                                32KB

                              • memory/272-33-0x00000000023F0000-0x00000000023FA000-memory.dmp

                                Filesize

                                40KB

                              • memory/272-34-0x0000000002400000-0x000000000240C000-memory.dmp

                                Filesize

                                48KB

                              • memory/272-16-0x0000000000630000-0x000000000063C000-memory.dmp

                                Filesize

                                48KB

                              • memory/272-15-0x00000000008D0000-0x0000000000926000-memory.dmp

                                Filesize

                                344KB

                              • memory/272-17-0x0000000000640000-0x0000000000648000-memory.dmp

                                Filesize

                                32KB

                              • memory/272-13-0x00000000006C0000-0x00000000006D0000-memory.dmp

                                Filesize

                                64KB

                              • memory/272-12-0x00000000006B0000-0x00000000006B8000-memory.dmp

                                Filesize

                                32KB

                              • memory/272-0-0x00000000002F0000-0x0000000000620000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/272-11-0x00000000006E0000-0x00000000006EC000-memory.dmp

                                Filesize

                                48KB

                              • memory/272-10-0x00000000006D0000-0x00000000006E2000-memory.dmp

                                Filesize

                                72KB

                              • memory/272-9-0x00000000006A0000-0x00000000006A8000-memory.dmp

                                Filesize

                                32KB

                              • memory/272-8-0x0000000000680000-0x0000000000696000-memory.dmp

                                Filesize

                                88KB

                              • memory/272-7-0x0000000000670000-0x0000000000680000-memory.dmp

                                Filesize

                                64KB

                              • memory/272-1-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/272-6-0x0000000000620000-0x0000000000628000-memory.dmp

                                Filesize

                                32KB

                              • memory/272-5-0x00000000002E0000-0x00000000002E8000-memory.dmp

                                Filesize

                                32KB

                              • memory/272-4-0x00000000002D0000-0x00000000002DE000-memory.dmp

                                Filesize

                                56KB

                              • memory/272-3-0x0000000000150000-0x000000000015E000-memory.dmp

                                Filesize

                                56KB

                              • memory/272-2-0x000000001B360000-0x000000001B3E0000-memory.dmp

                                Filesize

                                512KB

                              • memory/704-123-0x000000001B2D0000-0x000000001B350000-memory.dmp

                                Filesize

                                512KB

                              • memory/704-122-0x000007FEF5000000-0x000007FEF59EC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/704-121-0x00000000008B0000-0x0000000000BE0000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/704-124-0x0000000002430000-0x0000000002442000-memory.dmp

                                Filesize

                                72KB

                              • memory/704-135-0x000007FEF5000000-0x000007FEF59EC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/2100-61-0x000007FEF5000000-0x000007FEF59EC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/2100-62-0x0000000000E20000-0x0000000001150000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/2100-63-0x0000000000E10000-0x0000000000E22000-memory.dmp

                                Filesize

                                72KB

                              • memory/2100-73-0x000007FEF5000000-0x000007FEF59EC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/2352-88-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/2352-75-0x00000000010A0000-0x00000000013D0000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/2352-76-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/2352-77-0x00000000004C0000-0x0000000000540000-memory.dmp

                                Filesize

                                512KB

                              • memory/2512-139-0x000000001AFC0000-0x000000001B040000-memory.dmp

                                Filesize

                                512KB

                              • memory/2512-150-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/2512-137-0x0000000000910000-0x0000000000C40000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/2512-138-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/2580-103-0x000007FEF5000000-0x000007FEF59EC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/2580-92-0x000000001B1E0000-0x000000001B260000-memory.dmp

                                Filesize

                                512KB

                              • memory/2580-91-0x000007FEF5000000-0x000007FEF59EC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/2580-90-0x0000000000370000-0x00000000006A0000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/2648-152-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/2648-153-0x0000000000DE0000-0x0000000001110000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/2676-119-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/2676-106-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/2676-105-0x00000000003C0000-0x00000000006F0000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/2676-108-0x00000000009E0000-0x00000000009F2000-memory.dmp

                                Filesize

                                72KB

                              • memory/2676-107-0x000000001B150000-0x000000001B1D0000-memory.dmp

                                Filesize

                                512KB