Overview

overview

10

Static

static

3

04b3d2363a...1c.exe

windows7-x64

10

04b3d2363a...1c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    114s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2024 04:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    04b3d2363abf2b52645bf3ff721920db9ee45fab9333f7ac355d3d4ddbdb811c.exe

  • Size

    1.5MB

  • MD5

    22436f4ee55db2b4a040df3525553d95

  • SHA1

    dc0f625299ad5e1d4aea14d256056b538ca6ee48

  • SHA256

    04b3d2363abf2b52645bf3ff721920db9ee45fab9333f7ac355d3d4ddbdb811c

  • SHA512

    2072d06603fdc7320ae60b67383842a263b319cdbb4ba5dc6e031f3ed3aa9e7d02c50df3321f3c04025e6a9676fb6b3411a1b95fe3b82b83c2a3905ff82d3720

  • SSDEEP

    24576:UNNUtQhWhtqDfDXQdy+N+gfQqRsgFlDRluQ70eJiVbWpRg:kzhWhCXQFN+0IEuQgyiVK4

Score
10/10
dcratevasionexecutioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 45 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 14 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 30 IoCs
    evasiontrojan
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 45 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\04b3d2363abf2b52645bf3ff721920db9ee45fab9333f7ac355d3d4ddbdb811c.exe
    "C:\Users\Admin\AppData\Local\Temp\04b3d2363abf2b52645bf3ff721920db9ee45fab9333f7ac355d3d4ddbdb811c.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2728
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\04b3d2363abf2b52645bf3ff721920db9ee45fab9333f7ac355d3d4ddbdb811c.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2908
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PerfLogs\Admin\Idle.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2260
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2560
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC\OSPPSVC.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\wininit.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1304
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VllHeqZPeA.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:1656
        • C:\PerfLogs\Admin\Idle.exe
          "C:\PerfLogs\Admin\Idle.exe"
          3⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1584
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94fd928f-aa64-46ea-b18b-4194d485ba7b.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2080
            • C:\PerfLogs\Admin\Idle.exe
              C:\PerfLogs\Admin\Idle.exe
              5⤵
              • UAC bypass
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:952
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b67ecc28-0620-4931-b607-5c368f524995.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:2992
                • C:\PerfLogs\Admin\Idle.exe
                  C:\PerfLogs\Admin\Idle.exe
                  7⤵
                  • UAC bypass
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:2940
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bf37a973-fb61-48cc-a445-bf8c8b6c4780.vbs"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:672
                    • C:\PerfLogs\Admin\Idle.exe
                      C:\PerfLogs\Admin\Idle.exe
                      9⤵
                      • UAC bypass
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:2252
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06481193-f536-4f83-b441-e7c6f85a2ddf.vbs"
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2408
                        • C:\PerfLogs\Admin\Idle.exe
                          C:\PerfLogs\Admin\Idle.exe
                          11⤵
                          • UAC bypass
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:560
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4bdd064-3403-422c-b8b4-0210380fa2ec.vbs"
                            12⤵
                              PID:308
                              • C:\PerfLogs\Admin\Idle.exe
                                C:\PerfLogs\Admin\Idle.exe
                                13⤵
                                • UAC bypass
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Suspicious use of AdjustPrivilegeToken
                                • System policy modification
                                PID:3044
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19d0e914-d7e0-4582-8f81-9dd1c5802ff3.vbs"
                                  14⤵
                                    PID:2528
                                    • C:\PerfLogs\Admin\Idle.exe
                                      C:\PerfLogs\Admin\Idle.exe
                                      15⤵
                                      • UAC bypass
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Suspicious use of AdjustPrivilegeToken
                                      • System policy modification
                                      PID:2228
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\004bfe03-9f07-4b23-8349-b34d9e3a7605.vbs"
                                        16⤵
                                          PID:2424
                                          • C:\PerfLogs\Admin\Idle.exe
                                            C:\PerfLogs\Admin\Idle.exe
                                            17⤵
                                            • UAC bypass
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Suspicious use of AdjustPrivilegeToken
                                            • System policy modification
                                            PID:2648
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84d7af22-204d-419b-b808-cd1dbd5b4ccf.vbs"
                                              18⤵
                                                PID:1184
                                                • C:\PerfLogs\Admin\Idle.exe
                                                  C:\PerfLogs\Admin\Idle.exe
                                                  19⤵
                                                  • UAC bypass
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • System policy modification
                                                  PID:1800
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e149bab-337f-46d7-906a-4ff7e5158be5.vbs"
                                                    20⤵
                                                      PID:2760
                                                      • C:\PerfLogs\Admin\Idle.exe
                                                        C:\PerfLogs\Admin\Idle.exe
                                                        21⤵
                                                        • UAC bypass
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • System policy modification
                                                        PID:2604
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4044c4bf-671a-49f8-a5f8-1a671b229ff3.vbs"
                                                          22⤵
                                                            PID:2904
                                                            • C:\PerfLogs\Admin\Idle.exe
                                                              C:\PerfLogs\Admin\Idle.exe
                                                              23⤵
                                                              • UAC bypass
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • System policy modification
                                                              PID:1868
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb3f1160-d7da-455b-ab3a-e1d886bb3ca0.vbs"
                                                                24⤵
                                                                  PID:2080
                                                                  • C:\PerfLogs\Admin\Idle.exe
                                                                    C:\PerfLogs\Admin\Idle.exe
                                                                    25⤵
                                                                    • UAC bypass
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • System policy modification
                                                                    PID:2472
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a8dad44a-d425-4601-a205-4982ebdf0e51.vbs"
                                                                      26⤵
                                                                        PID:2736
                                                                        • C:\PerfLogs\Admin\Idle.exe
                                                                          C:\PerfLogs\Admin\Idle.exe
                                                                          27⤵
                                                                          • UAC bypass
                                                                          • Executes dropped EXE
                                                                          • Checks whether UAC is enabled
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • System policy modification
                                                                          PID:996
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f6ba45b-f285-4095-97f0-851355af9128.vbs"
                                                                            28⤵
                                                                              PID:1940
                                                                              • C:\PerfLogs\Admin\Idle.exe
                                                                                C:\PerfLogs\Admin\Idle.exe
                                                                                29⤵
                                                                                • UAC bypass
                                                                                • Executes dropped EXE
                                                                                • Checks whether UAC is enabled
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • System policy modification
                                                                                PID:1788
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d245c0e6-e8f9-44c6-8d1c-3a6668bd99e9.vbs"
                                                                                  30⤵
                                                                                    PID:2396
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08a97588-048c-4bea-b510-884fb8c92acc.vbs"
                                                                                    30⤵
                                                                                      PID:3060
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00614298-ad7c-40e0-b5a3-346d4665ca06.vbs"
                                                                                  28⤵
                                                                                    PID:1804
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad51d273-05f2-4ac4-9462-531da0e025f8.vbs"
                                                                                26⤵
                                                                                  PID:2552
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93872544-07cb-402d-8510-e782a6c9518c.vbs"
                                                                              24⤵
                                                                                PID:2984
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac9d2ac8-fce0-4cf7-ae53-5b0b1d2e1998.vbs"
                                                                            22⤵
                                                                              PID:1960
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d7dcc8e-c786-4134-98aa-23f673976324.vbs"
                                                                          20⤵
                                                                            PID:2632
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5923a22d-274b-4a8f-998c-db43650dce8c.vbs"
                                                                        18⤵
                                                                          PID:1084
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2018abb7-3a3c-47c7-a6ba-991d4f4d5b57.vbs"
                                                                      16⤵
                                                                        PID:3004
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80b50ce4-c475-4ecf-a031-8e818d1bc262.vbs"
                                                                    14⤵
                                                                      PID:1616
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9035fa58-e34d-49ac-8566-90bc180da702.vbs"
                                                                  12⤵
                                                                    PID:840
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4017db91-8182-414e-bf16-730f5b61a7d5.vbs"
                                                                10⤵
                                                                  PID:2256
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4815e6a-a9d3-40ca-978c-17b695cbe859.vbs"
                                                              8⤵
                                                                PID:576
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40ccbb19-e857-444f-8612-0a67c3251ec5.vbs"
                                                            6⤵
                                                              PID:1828
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78b4ac70-a73d-4427-8ea6-e06d1d99a29c.vbs"
                                                          4⤵
                                                            PID:1864
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\PerfLogs\Admin\Idle.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:528
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:564
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC\OSPPSVC.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1492
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\wininit.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2748

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Command and Scripting Interpreter

                                                    1
                                                    T1059

                                                    PowerShell

                                                    1
                                                    T1059.001

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Persistence

                                                    Boot or Logon Autostart Execution

                                                    2
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Winlogon Helper DLL

                                                    1
                                                    T1547.004

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Privilege Escalation

                                                    Abuse Elevation Control Mechanism

                                                    1
                                                    T1548

                                                    Bypass User Account Control

                                                    1
                                                    T1548.002

                                                    Boot or Logon Autostart Execution

                                                    2
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Winlogon Helper DLL

                                                    1
                                                    T1547.004

                                                    Scheduled Task/Job

                                                    1
                                                    T1053

                                                    Scheduled Task

                                                    1
                                                    T1053.005

                                                    Defense Evasion

                                                    Abuse Elevation Control Mechanism

                                                    1
                                                    T1548

                                                    Bypass User Account Control

                                                    1
                                                    T1548.002

                                                    Impair Defenses

                                                    1
                                                    T1562

                                                    Disable or Modify Tools

                                                    1
                                                    T1562.001

                                                    Modify Registry

                                                    4
                                                    T1112

                                                    Credential Access

                                                    Discovery

                                                    Query Registry

                                                    1
                                                    T1012

                                                    System Information Discovery

                                                    2
                                                    T1082

                                                    Lateral Movement

                                                    Collection

                                                    Command and Control

                                                    Exfiltration

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\PerfLogs\Admin\Idle.exe
                                                      Filesize

                                                      1.5MB

                                                      MD5

                                                      22436f4ee55db2b4a040df3525553d95

                                                      SHA1

                                                      dc0f625299ad5e1d4aea14d256056b538ca6ee48

                                                      SHA256

                                                      04b3d2363abf2b52645bf3ff721920db9ee45fab9333f7ac355d3d4ddbdb811c

                                                      SHA512

                                                      2072d06603fdc7320ae60b67383842a263b319cdbb4ba5dc6e031f3ed3aa9e7d02c50df3321f3c04025e6a9676fb6b3411a1b95fe3b82b83c2a3905ff82d3720

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\004bfe03-9f07-4b23-8349-b34d9e3a7605.vbs
                                                      Filesize

                                                      702B

                                                      MD5

                                                      b637377eb64b3ffc4a193042d7af4496

                                                      SHA1

                                                      574244545cd0b930adbc47dfcb8617ed3ebb70de

                                                      SHA256

                                                      2f07f265a147510b909b40662ae65f4e4c06cc96bc9155b077b195601febdee7

                                                      SHA512

                                                      35ec5487189ed1fb9f63af6dcc46d68d17fcb2b6818f6da0b7c94c7b1175098d91af25e3d5114e15c34b6ee690e01d5dfcdcb041f7814a821ed7a73237bcf319

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\06481193-f536-4f83-b441-e7c6f85a2ddf.vbs
                                                      Filesize

                                                      702B

                                                      MD5

                                                      e8e03df3bffca395840490f7a0a81e85

                                                      SHA1

                                                      1f5f04487efa1d331ee5bf55f07c14d453ff631f

                                                      SHA256

                                                      de8f90765fc37d819b76f771a53220c1d363963e849a6f478a2cbf80c353c7e7

                                                      SHA512

                                                      a3cdab3b8676aaf082652f0e1851e4f8fd1907602254f8daca7b58882f2d6dec652881c48f7dc53f5ab3d1c4eba845caf437a605428f4e6255e523b0c67b63fb

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\19d0e914-d7e0-4582-8f81-9dd1c5802ff3.vbs
                                                      Filesize

                                                      702B

                                                      MD5

                                                      4f9fa8e12b43789cadecc9f96ed4ce0b

                                                      SHA1

                                                      8e0d120cf2d460abc90d039aa433dfdc7725f256

                                                      SHA256

                                                      2ecba08264038ed69f21c66efcbe3aa070c0c6cc5cddae53941241495ea77d1c

                                                      SHA512

                                                      2a88431977ef54406c07190b218c2301aaaebd9efe0e309e16fb82a2eac8d52a535b63872a185bdd5cea9d2dbb3942fdf6a8df7728051f14f6ff92e0f886e71a

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\4044c4bf-671a-49f8-a5f8-1a671b229ff3.vbs
                                                      Filesize

                                                      702B

                                                      MD5

                                                      c65c653af238db7e9a5752b25809fc9a

                                                      SHA1

                                                      a4373cc80443cb7c0eb04249f7d6d9511c5bae67

                                                      SHA256

                                                      03592541c8656f0002ab118329512a41bf9dfba30149930ddcaa2b8fa165a107

                                                      SHA512

                                                      574fd4856ecf950b95bc8407730957965ffa9d6b58875817180f3cb89ae35da9117b3c9804c96593382375a6c2c35255a2c6046faf896a891ab98237dfe4c422

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\6e149bab-337f-46d7-906a-4ff7e5158be5.vbs
                                                      Filesize

                                                      702B

                                                      MD5

                                                      623d593947c6122de0a7fed7772e6799

                                                      SHA1

                                                      2cbe9e1c4e2009ed1e6beb7a51aee3a0b8aa2ba4

                                                      SHA256

                                                      93c6cd3e4059b94e577957dc6b85506a718c244381395a07c7522bc90b47a8ea

                                                      SHA512

                                                      8f9e7b3b8c1fe68a3e6503e66d25afafabac6cdb3f42ccc1446a116b7faa772b33c820b8ce8c02daa50b128cd3d899db4a5507299624bcc59fd5662fb9ef0898

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\6f6ba45b-f285-4095-97f0-851355af9128.vbs
                                                      Filesize

                                                      701B

                                                      MD5

                                                      784e2f88fa5b321d082e8ee5f58d2811

                                                      SHA1

                                                      4a9fb9adea5aa8f3b84c27376b14bd7ecf7425d9

                                                      SHA256

                                                      5ca066731ae6cc62322ef0bb638c0287b714175239af4c409d46815d12134f7e

                                                      SHA512

                                                      28237ea049d5e11c4b147848ec887de4ac8bc1a2056b36148702d1380a30eb25e0ffdb585c97e11348cdbee0a136b90c5f12b00fb20d315d4aefb93c1b780bed

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\78b4ac70-a73d-4427-8ea6-e06d1d99a29c.vbs
                                                      Filesize

                                                      478B

                                                      MD5

                                                      09e37b652276b343a784336738b97205

                                                      SHA1

                                                      31b505c4e28f6ffac019e9ef1150cf418314885a

                                                      SHA256

                                                      3e9d1d8c9c93068116c959697376f718fe58e13f1fe14a76803d5dbbcac04910

                                                      SHA512

                                                      1f9f9bf770220f32eed1645aed7db5289aa5436027e0e51c30fba63b81f0961d2845ee26917b3bf95181107e8fa5c7fd257a40fd0e3f509161a3fb34ae102a2b

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\84d7af22-204d-419b-b808-cd1dbd5b4ccf.vbs
                                                      Filesize

                                                      702B

                                                      MD5

                                                      75c96b4fa561af7b4cac7e06125e296f

                                                      SHA1

                                                      19d5d2aed0096e94a6d20dd25a39becc8b365b13

                                                      SHA256

                                                      8be9cc579567b668d12b9b585674f7423eb1f57a402fb89ae7307589b3576bb1

                                                      SHA512

                                                      6dc86c0a731c4e3c954d46af693173fde412c3d2ce276b5329a642da62d9d03c13bafc9480401a61a4285e2723d2ca053ac31a644b38638971be35606dc847a2

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\94fd928f-aa64-46ea-b18b-4194d485ba7b.vbs
                                                      Filesize

                                                      702B

                                                      MD5

                                                      618c7ab3ccf3fcae1052014c757ec171

                                                      SHA1

                                                      2c8751d2ec48b14831a42fad2b721fe1f57fb38b

                                                      SHA256

                                                      9cf8f4032e1fc07362b480f4e193dc7cc790608104d3a620228318dc30d835b6

                                                      SHA512

                                                      d4c9a91db16a731746a188f757ad4b5295b42bcbcbaedd4bdec4cdc151bbb02a4e3c96d46b5313bfe80cd26f3256d37fa9ba681965f2848c0a197925a716141b

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\RCX6661.tmp
                                                      Filesize

                                                      1.5MB

                                                      MD5

                                                      a5d2ec31d1f755527aa47aaa85f6c126

                                                      SHA1

                                                      6c0cf8cc1826d917ea92958bd6893f987f736d88

                                                      SHA256

                                                      269c948e7e5d195112f6b92000106192d9d64813dbc0a794aced0a6ccb7e0e2d

                                                      SHA512

                                                      ab5a959cca6d02e18123d68a8d99f55d8208a78105e773a782e6ab42744eb2a7c9bfab08868108cd573a0acdbf1f964824707d33e5e510a0c3c34fa3f29ca4b9

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\VllHeqZPeA.bat
                                                      Filesize

                                                      190B

                                                      MD5

                                                      efbb6f5088d332ecdd20b8c70824a6c4

                                                      SHA1

                                                      624da9f4829b93e452d2d910b5f31b5e47866208

                                                      SHA256

                                                      4bbbf7586bb97a877138341e5923ae7810c1ac88776cd8c52a03b895d7faf1dc

                                                      SHA512

                                                      962bfbb527869bb6f0604d5a643a55cb71b48a85e06bdf87ed6ddfab84bba0e1522fd1c6f78694ac23ade4d821e82e82ac57969b9e2f2035c44a9f4455434f04

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\a8dad44a-d425-4601-a205-4982ebdf0e51.vbs
                                                      Filesize

                                                      702B

                                                      MD5

                                                      a4903f0af5d6b42b5c80c42ef1573d25

                                                      SHA1

                                                      b0cef4d5b1d9a940f22c8a9a93e9381038d7b72f

                                                      SHA256

                                                      c7c8e6d854f5d7abcbbf4674cd829c6bb181dbbfb8a7123f4ffc6939498eb6e5

                                                      SHA512

                                                      dd89768a97b829307b31af8c65e68c8cb62b24f6b1bf38e7c7ea2c69c44bbac70ce0c04ee8af756d3a54c4c6399672bac461111688ef9eb65f0dbe3dd0df8924

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\b67ecc28-0620-4931-b607-5c368f524995.vbs
                                                      Filesize

                                                      701B

                                                      MD5

                                                      458983bd8ed1e6e1b8cea4fdf3e80e76

                                                      SHA1

                                                      d73314f1283eb21699e3dcf5eb66b9ccee88c830

                                                      SHA256

                                                      c48ebcb8ce965c1831af3853c6f61112de504ff00e6be455c6fb536ee3d610de

                                                      SHA512

                                                      0d31c216f9670148cefd7eb3ab4702ab7428f770a9ab23698e311d2519f9f6e603d944e565b2b607d21610dc079c729856a1e87475bd6065fe3c891a727afa82

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\bb3f1160-d7da-455b-ab3a-e1d886bb3ca0.vbs
                                                      Filesize

                                                      702B

                                                      MD5

                                                      9277c7ba86c767490e90263c8c7f629b

                                                      SHA1

                                                      e7c28b32597e6589788bdaf9f5de2a48004a951d

                                                      SHA256

                                                      b277758e2c92cd115d72c8ad0cebc951fd943f06c5879fd046c735d04d1cba82

                                                      SHA512

                                                      3d03537fd9081637e2a658b78c32d9adc03fcc90ff460c57a0fe9b4d2de1d9b955ad6712583587d74d68b5523d3df9ed15002c2dc95b2744078913fd21782d57

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\bf37a973-fb61-48cc-a445-bf8c8b6c4780.vbs
                                                      Filesize

                                                      702B

                                                      MD5

                                                      a81955fba0c550b143cb7aa199479317

                                                      SHA1

                                                      623a22124bb8ea969e470756830225c2dce1c763

                                                      SHA256

                                                      f5734acf8b1df2f6be0104c7022f53935d53a626a853a34c7a0605fa2d84e639

                                                      SHA512

                                                      5042359f63f593d33084425f8515c6b4a9ff061131d3cac8345645bd886c4a597c57811fd8970ba99fe0f7f2c4d22800aa60c3209fdeb158790c98043287d410

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\d245c0e6-e8f9-44c6-8d1c-3a6668bd99e9.vbs
                                                      Filesize

                                                      702B

                                                      MD5

                                                      f9a5f166b27f445b7616491bb32100a4

                                                      SHA1

                                                      07b705e47591755fc836e834474b1562c71d856e

                                                      SHA256

                                                      f21b76003dac149dd97b6ee3456716365659834a58c727f8f82e5a9d781ded3a

                                                      SHA512

                                                      a78b2a3ab901cde8cb771a7a43d3e44e3b406284405c3e757868bfb05d9d80914860ff616e52faaa5b8a2e61f0a35be08635ba41689c063d2984bb226546f686

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Temp\f4bdd064-3403-422c-b8b4-0210380fa2ec.vbs
                                                      Filesize

                                                      701B

                                                      MD5

                                                      3eec474c1baab4436072aaeee53b7b12

                                                      SHA1

                                                      dfe42770139f2c66da35f1f4ab40c858f935cf1d

                                                      SHA256

                                                      a0ffdb4917bf7a61842c82dc386caacb6d34a818fc5bf7adc0aa9a6b34096b7d

                                                      SHA512

                                                      38616fe4aab561727638b53141865ff603cddde62418553271cad8c392eac07631dcb1966bbee20e0c7d09378c83053d2cb277de1a4f2e19ee363936ac7b2600

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                      Filesize

                                                      7KB

                                                      MD5

                                                      f92c5ae2234941500e88c2e838506dd5

                                                      SHA1

                                                      2f109ce94dfc700d04361a99749595d298cbbf20

                                                      SHA256

                                                      ee046d3196ff41f29c97c9712fcf28c5672580eeb541ee0429b58db83627e65b

                                                      SHA512

                                                      8de14e5950cdb756da1905bd2ebb6378f023e0870eb6fed4c53458a9f272580e36283185ea5f693358ad9660fce4e3f02974a3e6b52d67084dde973731d18191

                                                      Download Submit

                                                    • memory/560-146-0x0000000001200000-0x000000000137E000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                      Download

                                                    • memory/1584-99-0x0000000000450000-0x0000000000462000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/1584-98-0x0000000000F80000-0x00000000010FE000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                      Download

                                                    • memory/1800-195-0x00000000003D0000-0x00000000003E2000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/1800-194-0x00000000009B0000-0x0000000000B2E000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                      Download

                                                    • memory/1868-220-0x0000000000F00000-0x000000000107E000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                      Download

                                                    • memory/2228-170-0x00000000003D0000-0x000000000054E000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                      Download

                                                    • memory/2252-134-0x0000000000200000-0x000000000037E000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                      Download

                                                    • memory/2472-232-0x00000000011F0000-0x000000000136E000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                      Download

                                                    • memory/2604-208-0x0000000000480000-0x0000000000492000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/2604-207-0x0000000000EF0000-0x000000000106E000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                      Download

                                                    • memory/2648-182-0x00000000008D0000-0x0000000000A4E000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                      Download

                                                    • memory/2728-6-0x0000000002130000-0x000000000213A000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/2728-24-0x000007FEF4E80000-0x000007FEF586C000-memory.dmp

                                                      Filesize

                                                      9.9MB

                                                      Download

                                                    • memory/2728-18-0x0000000002270000-0x0000000002278000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/2728-17-0x0000000002260000-0x000000000226C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/2728-1-0x0000000000860000-0x00000000009DE000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                      Download

                                                    • memory/2728-2-0x000007FEF4E80000-0x000007FEF586C000-memory.dmp

                                                      Filesize

                                                      9.9MB

                                                      Download

                                                    • memory/2728-16-0x0000000002250000-0x0000000002258000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/2728-21-0x000000001A800000-0x000000001A808000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/2728-15-0x00000000021C0000-0x00000000021CA000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/2728-14-0x00000000021B0000-0x00000000021BC000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/2728-13-0x00000000021A0000-0x00000000021AA000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/2728-3-0x0000000002100000-0x0000000002108000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/2728-12-0x0000000002190000-0x0000000002198000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/2728-0-0x000007FEF4E83000-0x000007FEF4E84000-memory.dmp

                                                      Filesize

                                                      4KB

                                                      Download

                                                    • memory/2728-11-0x0000000002180000-0x0000000002190000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/2728-20-0x0000000002280000-0x000000000228C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/2728-9-0x0000000002160000-0x000000000216C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/2728-10-0x0000000002170000-0x0000000002180000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/2728-8-0x0000000002150000-0x0000000002158000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/2728-80-0x000007FEF4E80000-0x000007FEF586C000-memory.dmp

                                                      Filesize

                                                      9.9MB

                                                      Download

                                                    • memory/2728-41-0x000007FEF4E80000-0x000007FEF586C000-memory.dmp

                                                      Filesize

                                                      9.9MB

                                                      Download

                                                    • memory/2728-4-0x0000000002110000-0x0000000002122000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/2728-7-0x0000000002140000-0x000000000214C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/2728-5-0x0000000002120000-0x000000000212C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/2908-73-0x000000001B560000-0x000000001B842000-memory.dmp

                                                      Filesize

                                                      2.9MB

                                                      Download

                                                    • memory/2908-78-0x0000000002790000-0x0000000002798000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/2940-122-0x0000000000330000-0x0000000000342000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/2940-121-0x0000000000340000-0x00000000004BE000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                      Download

                                                    • memory/3044-158-0x00000000000D0000-0x000000000024E000-memory.dmp

                                                      Filesize

                                                      1.5MB

                                                      Download