Overview

overview

10

Static

static

10

d9aef85fc0...cf.exe

windows7-x64

10

d9aef85fc0...cf.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2024 03:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe

  • Size

    2.4MB

  • MD5

    16be4b35fbc59aa471fff4ab77f53c5e

  • SHA1

    5d31d96f0562309fc24294ecfdb3d2a26b238764

  • SHA256

    d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf

  • SHA512

    29c902990c748f34c260a08811f1f24956bbc62b7135e58095753ef1f9ad5a094bc560a3dc7aaadb6295eb518b6ad4d645d4775cf11b9a87fd868dc138cf9b45

  • SSDEEP

    49152:pCZ/7MmTJP/uNiZ4qBpWVPW6dKiXGRhuknLwFPy4Eiw7m:aDMmTJXui4qBpWLZgukLwkiA

Score
10/10
dcratevasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 39 IoCs
    evasiontrojan
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 26 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 13 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 39 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
    "C:\Users\Admin\AppData\Local\Temp\d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4544
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\O6aVLURegE.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:228
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:4384
        • C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
          "C:/Users/Admin/AppData/Local/discord/Network\csrss.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4828
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea9996c9-90b3-45dd-817f-3cee33bf4cfd.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3240
            • C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
              C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1148
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\449877e4-0e07-4a00-8e53-9ebec101042d.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4768
                • C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                  C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:2040
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2080c23-bbab-4724-b666-70c7866a0b05.vbs"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1076
                    • C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                      C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                      9⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:3788
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a3b6ebc-3375-4ef2-a2e5-14d25c89a28c.vbs"
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2984
                        • C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                          C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                          11⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:3756
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f71078ae-6273-466b-9ae3-c52ae7e7a1ce.vbs"
                            12⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3416
                            • C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                              C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                              13⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:3056
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6dd61a4c-d1cf-4982-a3d5-c09550bb085b.vbs"
                                14⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3964
                                • C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                                  C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                                  15⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:756
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05fde45f-011f-4500-96fc-58df78f051ab.vbs"
                                    16⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4872
                                    • C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                                      C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                                      17⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:4792
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c971605-c718-4f43-8110-0d9e4b1ed40d.vbs"
                                        18⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:1368
                                        • C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                                          C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                                          19⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          • System policy modification
                                          PID:2544
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ae768e7-0a95-467d-86a8-88433a5e7d68.vbs"
                                            20⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4588
                                            • C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                                              C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                                              21⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:5016
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b3f7a11-6ebc-4ba7-b4bf-0d5fd199db0b.vbs"
                                                22⤵
                                                  PID:4024
                                                  • C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                                                    C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                                                    23⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:3172
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78b65557-8a4d-4f90-bbf7-57264ca30d36.vbs"
                                                      24⤵
                                                        PID:5004
                                                        • C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                                                          C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                                                          25⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:3440
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5861fe1e-7afa-47b3-a6f3-d5995bbe573f.vbs"
                                                            26⤵
                                                              PID:1620
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8354bc4-6a55-42d8-8f9f-5e33266153dc.vbs"
                                                              26⤵
                                                                PID:1940
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80b0bf58-4c93-4a2b-ad0a-7d4f65e55178.vbs"
                                                            24⤵
                                                              PID:560
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28d7c050-d88b-4128-be04-7e1adb3987e7.vbs"
                                                          22⤵
                                                            PID:2272
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f87be056-76ff-42aa-9670-b46c5fde0903.vbs"
                                                        20⤵
                                                          PID:4236
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24bc4d21-0e56-46f9-8e65-44966eedbde8.vbs"
                                                      18⤵
                                                        PID:4396
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1c83897-6d96-48ab-abbc-1b69b55cef2c.vbs"
                                                    16⤵
                                                      PID:2852
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\553d3cef-1a47-4e8e-8eca-701adef7ff70.vbs"
                                                  14⤵
                                                    PID:4380
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aaebdc9d-6326-4138-841a-57f9e14d7075.vbs"
                                                12⤵
                                                  PID:4392
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5cee98e-1d14-4662-9633-c2e0f8225889.vbs"
                                              10⤵
                                                PID:3232
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d83f9b18-835f-4790-acdb-30391c639c9c.vbs"
                                            8⤵
                                              PID:1300
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\99a41f9b-3082-43de-8058-bf54ec8ef93e.vbs"
                                          6⤵
                                            PID:4420
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d530c8e0-5dd1-4d89-a37c-1020d614ed42.vbs"
                                        4⤵
                                          PID:3468
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:/Users/Admin/AppData/Local/discord/Network\csrss.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2656
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/discord/Network\csrss.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3056
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:/Users/Admin/AppData/Local/discord/Network\csrss.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:500

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Scheduled Task

                                  1
                                  T1053.005

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  2
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Winlogon Helper DLL

                                  1
                                  T1547.004

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Scheduled Task

                                  1
                                  T1053.005

                                  Privilege Escalation

                                  Abuse Elevation Control Mechanism

                                  1
                                  T1548

                                  Bypass User Account Control

                                  1
                                  T1548.002

                                  Boot or Logon Autostart Execution

                                  2
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Winlogon Helper DLL

                                  1
                                  T1547.004

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Scheduled Task

                                  1
                                  T1053.005

                                  Defense Evasion

                                  Abuse Elevation Control Mechanism

                                  1
                                  T1548

                                  Bypass User Account Control

                                  1
                                  T1548.002

                                  Impair Defenses

                                  1
                                  T1562

                                  Disable or Modify Tools

                                  1
                                  T1562.001

                                  Modify Registry

                                  4
                                  T1112

                                  Credential Access

                                  Discovery

                                  Query Registry

                                  2
                                  T1012

                                  System Information Discovery

                                  3
                                  T1082

                                  Lateral Movement

                                  Collection

                                  Command and Control

                                  Web Service

                                  1
                                  T1102

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log
                                    Filesize

                                    1KB

                                    MD5

                                    4a667f150a4d1d02f53a9f24d89d53d1

                                    SHA1

                                    306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

                                    SHA256

                                    414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

                                    SHA512

                                    4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\05fde45f-011f-4500-96fc-58df78f051ab.vbs
                                    Filesize

                                    729B

                                    MD5

                                    87e9e92ab04f674bb2ddda0346adcaae

                                    SHA1

                                    b3052e703120ba9ea9136ae92009b503cadec196

                                    SHA256

                                    40e06d16e966ccf47e1dd0413dc83db6d55a6c7a5f0e520f106c5407bb78ada7

                                    SHA512

                                    450a63781bfe798c5a717aff41c36011f2b4c66e090888b4d7ad06414806829cc3b57cd0fcf60ee842969cdaad86049c43c2206d34955740e23b458c1e7280a9

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\1a3b6ebc-3375-4ef2-a2e5-14d25c89a28c.vbs
                                    Filesize

                                    730B

                                    MD5

                                    e932b147a8bf83ff15d703f6a203d6d6

                                    SHA1

                                    b92d1c6172b10f6724b97637eeb6a86d34d3d8f8

                                    SHA256

                                    498a5d0ee6a423cedbdf7e62ee9caf71cf856ea71fbdf67da418fefdd14d14f6

                                    SHA512

                                    a7994a7e5d83e6af56a1a9b8119e788c79316cdee9eee998fccf70feef8ceadb77597029af31793cf37af15b7a19aaf9200fe2db1feb0a10ea83121a90655923

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\3c971605-c718-4f43-8110-0d9e4b1ed40d.vbs
                                    Filesize

                                    730B

                                    MD5

                                    a41618ee628408bdc8269231b00c1bc1

                                    SHA1

                                    4e70cef96d07dc9da2f6eba5d511638b8387321a

                                    SHA256

                                    7b04b9b741e236a7700d09c5debb63b849fdeca3b0ed098aa9caa7f5cfe93066

                                    SHA512

                                    681dc617546dd4a42eec0f7f8ce188cada9080d7f77faa38879767d4bf5bdb90dee5253aba1c96388ef04d433e75d842f54617241ed3bb92b15015e6b1d89433

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\449877e4-0e07-4a00-8e53-9ebec101042d.vbs
                                    Filesize

                                    730B

                                    MD5

                                    9708ace7fd66edbd4a045b57db2ea4c0

                                    SHA1

                                    7783110933886e3ae9e04039ffa23f2a1ad2d598

                                    SHA256

                                    f8add3b93cdec5973d3b01a3b2385c8b740f31afdb1de51a5d586a9e4261a552

                                    SHA512

                                    4b51e2f096c9643c4dd0b02733304eb48b3393db9911a18e925afcc05c797bed05c05048e72da6dc654cd23b01e57dbe5a6065c1f77ec5590e01c7b692635aef

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\4ae768e7-0a95-467d-86a8-88433a5e7d68.vbs
                                    Filesize

                                    730B

                                    MD5

                                    0904ec0f6cc2ccb54184958d08d9e079

                                    SHA1

                                    a8baa8e3af71e43b14c9cae2d3d405d2032323dc

                                    SHA256

                                    7c6f05a053d029c8a0efefa4e7f7016dd26e90abea32bc1aea383de094ad8553

                                    SHA512

                                    7f0fd601ce8aaf1fcbe5b22d933c8006798a76d5850cf9728d163c30bb7cd04811ab05c14f76060cf94ef5ca853cc539d946ed56f02987ad60f34a8f8b2273b5

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\5861fe1e-7afa-47b3-a6f3-d5995bbe573f.vbs
                                    Filesize

                                    730B

                                    MD5

                                    0cb4624863706d3e772f301884dc46d7

                                    SHA1

                                    ee7f6b0cf1926c0487bf1e6492e88fea1b9782e6

                                    SHA256

                                    3cb59e4879fea33e388af4e524899e5a3146a5e065e3b810e1204895e4b0a0c2

                                    SHA512

                                    e9f57c2d09c0617b689f60bf8bb36c6d5f3a976704edba4da18fb45c3929ceb1671921d2516251f1d1069ef2759aba15c54e7afc95cfc44f98ebfb00a41e413c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\6dd61a4c-d1cf-4982-a3d5-c09550bb085b.vbs
                                    Filesize

                                    730B

                                    MD5

                                    cc9752a93b312982881b51ed63d1dbc8

                                    SHA1

                                    94908743a8dbfbb98ee6eec7e998555073c87e80

                                    SHA256

                                    708aff3f6b1b0751be031cc67ef630d1637ee24326ef1c858a1fe564abb2a8a6

                                    SHA512

                                    5cd971511a65debd40b96dbf1ed6bdcb8959c7d6bfc56d331fbbafe9cfbe30ac8596e77b486a01f3a343be88ce97ddeb47d2cebd147221af712f466133c279fe

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\78b65557-8a4d-4f90-bbf7-57264ca30d36.vbs
                                    Filesize

                                    730B

                                    MD5

                                    63146615385fa2e7b97d2ce6396512cb

                                    SHA1

                                    9a6cda488600578eda8ac232434e089acb29e4be

                                    SHA256

                                    cc6063944e1a5c5e7de4bec3a90555ad96161318a7c9765df8257e1ff9e61821

                                    SHA512

                                    9ee2f9145a3e8226d0ef51a274a85243d720ca65e5f9df05301b5b6b9221e7736c78037b211bc0ed6f976b6d4c15c8cc73a3fb925dc42a75fc2fabb63b59be6d

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\8b3f7a11-6ebc-4ba7-b4bf-0d5fd199db0b.vbs
                                    Filesize

                                    730B

                                    MD5

                                    7b0a6f5e955443c17fc583cedd1a29df

                                    SHA1

                                    ac08fc0619d50c0216ee0c559b006e714bb00df8

                                    SHA256

                                    0a28d2642fce02a9e2626aabd956c25308fdda87a65f80e7d41f9b94328b0370

                                    SHA512

                                    8941a31aa457c69126f7c68b7582907e775557fa470ef107b994f90ef6bbaf2ac174aa0d92cbd5363239ca546d9239be13b8eca8e232c56c5abe25428e80d245

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\O6aVLURegE.bat
                                    Filesize

                                    219B

                                    MD5

                                    a4261528c07bba516c126907d3b0ccc2

                                    SHA1

                                    b62f8fbda3a2b8d032348efc9b9bd04ae1da89d7

                                    SHA256

                                    bccae1933624f622358ec3aeba16058215ec5427698985bbf36cc1bb1adff93b

                                    SHA512

                                    8d524c99057ccdcba3516ccb3dd03aab5736be2716730b3ace1bc0699b1a6b99be41b64375d5ee7ed6390410e1a20063f04f620cd4d89d754d1bb599422dbd9f

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\b2080c23-bbab-4724-b666-70c7866a0b05.vbs
                                    Filesize

                                    730B

                                    MD5

                                    3c44ed8a9568eaecff9cca7ff7279286

                                    SHA1

                                    1388ed81566b599659ab21787a6c59739cdd2b62

                                    SHA256

                                    081022312e1990eb6e7330c44bc1a709032ecac27b3ecdd2fbf5da569724bdf7

                                    SHA512

                                    885af2f2c18a59f553dfd16999ed5f78fa99d55d0b64649942df0cb6926896563c92bac6f306d2404ae3f1f1d75c492de552ef267a3ab616a067a9962c23f8eb

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\d530c8e0-5dd1-4d89-a37c-1020d614ed42.vbs
                                    Filesize

                                    506B

                                    MD5

                                    5c1399e81fa0c24844e4c03093db9205

                                    SHA1

                                    dfabae59f6e67c7a0ff7aa57aa24f01050ffdc1e

                                    SHA256

                                    016ad0f223548c52c9e3441eddb7027ef98eed13f37fc008537ab16a10e0cfd5

                                    SHA512

                                    583cd79c1b60d26ee6311c89182f5eed71f77537d992f719b088ad99f3ff1c820832232b27f5da047e96d6a6af9c2539931eb36e5cbbe8533e487efe5ec9b5f3

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\ea9996c9-90b3-45dd-817f-3cee33bf4cfd.vbs
                                    Filesize

                                    730B

                                    MD5

                                    186891fc2aae57a711b4bef6e472a153

                                    SHA1

                                    e6fba0a98523961b262b0c07780b0baa2876a52a

                                    SHA256

                                    03bf35683e661e7bacb302819f242a164e773a6abff98b3ca978ec4cd1b35af2

                                    SHA512

                                    2ef4cfe8a2bb404c6293b9f0e741643f5843d3f6e84f660c2ff033a0426d1bfc681cfd033776b2967d5438fe49c144fe9f6e9bfca2bf0996cf731f1e5e74d1c2

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\f71078ae-6273-466b-9ae3-c52ae7e7a1ce.vbs
                                    Filesize

                                    730B

                                    MD5

                                    edbe5278c7420b7ebe41e15796437001

                                    SHA1

                                    ce0cde2ae372155fd650bdec2d058f5e693d1cbc

                                    SHA256

                                    adf37644a142d42d2c7d3ef63c687a3c07c3d004987e576d53ac9ef877d272ba

                                    SHA512

                                    fc8d02bfa35d0682758edc89394e9c123a0744e0969aa10208ed96e61461926625fb51327013662a19a36b60f3becd57f6ea9533c342bd7d1cfc213c7c6667cd

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
                                    Filesize

                                    2.4MB

                                    MD5

                                    16be4b35fbc59aa471fff4ab77f53c5e

                                    SHA1

                                    5d31d96f0562309fc24294ecfdb3d2a26b238764

                                    SHA256

                                    d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf

                                    SHA512

                                    29c902990c748f34c260a08811f1f24956bbc62b7135e58095753ef1f9ad5a094bc560a3dc7aaadb6295eb518b6ad4d645d4775cf11b9a87fd868dc138cf9b45

                                    Download Submit

                                  • memory/3788-63-0x000000001BBF0000-0x000000001BC02000-memory.dmp

                                    Filesize

                                    72KB

                                    Download

                                  • memory/4544-9-0x000000001C700000-0x000000001CC28000-memory.dmp

                                    Filesize

                                    5.2MB

                                    Download

                                  • memory/4544-11-0x000000001BDE0000-0x000000001BDEE000-memory.dmp

                                    Filesize

                                    56KB

                                    Download

                                  • memory/4544-1-0x0000000000930000-0x0000000000B9E000-memory.dmp

                                    Filesize

                                    2.4MB

                                    Download

                                  • memory/4544-10-0x000000001BDD0000-0x000000001BDDA000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/4544-8-0x0000000002F10000-0x0000000002F22000-memory.dmp

                                    Filesize

                                    72KB

                                    Download

                                  • memory/4544-13-0x000000001BF00000-0x000000001BF0C000-memory.dmp

                                    Filesize

                                    48KB

                                    Download

                                  • memory/4544-12-0x000000001BDF0000-0x000000001BDF8000-memory.dmp

                                    Filesize

                                    32KB

                                    Download

                                  • memory/4544-7-0x000000001B820000-0x000000001B876000-memory.dmp

                                    Filesize

                                    344KB

                                    Download

                                  • memory/4544-22-0x00007FFD82370000-0x00007FFD82E31000-memory.dmp

                                    Filesize

                                    10.8MB

                                    Download

                                  • memory/4544-2-0x00007FFD82370000-0x00007FFD82E31000-memory.dmp

                                    Filesize

                                    10.8MB

                                    Download

                                  • memory/4544-0-0x00007FFD82373000-0x00007FFD82375000-memory.dmp

                                    Filesize

                                    8KB

                                    Download

                                  • memory/4544-5-0x0000000002EE0000-0x0000000002EF6000-memory.dmp

                                    Filesize

                                    88KB

                                    Download

                                  • memory/4544-6-0x0000000002F00000-0x0000000002F0A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/4544-4-0x000000001BD80000-0x000000001BDD0000-memory.dmp

                                    Filesize

                                    320KB

                                    Download

                                  • memory/4544-3-0x0000000002EC0000-0x0000000002EDC000-memory.dmp

                                    Filesize

                                    112KB

                                    Download

                                  • memory/4828-28-0x000000001D140000-0x000000001D152000-memory.dmp

                                    Filesize

                                    72KB

                                    Download

                                  • memory/4828-27-0x000000001D1C0000-0x000000001D216000-memory.dmp

                                    Filesize

                                    344KB

                                    Download