Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
03-04-2023 17:34
Static task
static1
Behavioral task
behavioral1
Sample
DCRat Crack Test VERSION.exe
Resource
win7-20230220-en
General
-
Target
DCRat Crack Test VERSION.exe
-
Size
3.7MB
-
MD5
0cf54aebcc76f09c147863b916a494fc
-
SHA1
5a41a7060f20f4bc16ba4a60c8f22aa16495cb3e
-
SHA256
0cac16b9e6b85c3415ebc63def32b4bc999182a7a09197afdcf0851f57aae68d
-
SHA512
8dc0c4fe4649523e155bf7c57ceccb70524b27a18374e4e5fa1b991ad322181dca131b99729926f9d54dd3a1c1f86fdb40607a4e9790d0acceef2e116ba4712e
-
SSDEEP
98304:OavNz0cqlVkGIgKuP04hZ9gA2aT3v9f8473v0H:OUNYcqMGIgdrgfaT/p8S3v0H
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 624 1772 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1872 1772 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 616 1772 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2044 1772 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1592 1772 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1480 1772 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1808 1772 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 576 1772 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 276 1772 schtasks.exe -
Processes:
resource yara_rule behavioral1/memory/1864-1648-0x000000001B7A0000-0x000000001B912000-memory.dmp dcrat -
.NET Reactor proctector 36 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral1/memory/1260-54-0x0000000005690000-0x0000000005A56000-memory.dmp net_reactor behavioral1/memory/1260-55-0x00000000052C0000-0x0000000005680000-memory.dmp net_reactor behavioral1/memory/1260-58-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-59-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-61-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-67-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-65-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-63-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-70-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-72-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-76-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-74-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-78-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-82-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-80-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-84-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-88-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-90-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-86-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-94-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-92-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-96-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-102-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-100-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-104-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-106-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-98-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-110-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-108-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-112-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-116-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-114-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-122-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-120-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-118-0x00000000052C0000-0x000000000567A000-memory.dmp net_reactor behavioral1/memory/1260-657-0x0000000005280000-0x00000000052C0000-memory.dmp net_reactor -
Executes dropped EXE 2 IoCs
Processes:
DCRatSupport.exewininit.exepid process 1864 DCRatSupport.exe 2744 wininit.exe -
Loads dropped DLL 1 IoCs
Processes:
DCRat Crack Test VERSION.exepid process 1260 DCRat Crack Test VERSION.exe -
Obfuscated with Agile.Net obfuscator 8 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1260-1639-0x0000000006820000-0x0000000006DE6000-memory.dmp agile_net \Users\Admin\AppData\Local\Temp\DCRatSupport.exe agile_net C:\Users\Admin\AppData\Local\Temp\DCRatSupport.exe agile_net C:\Users\Admin\AppData\Local\Temp\DCRatSupport.exe agile_net behavioral1/memory/1864-1646-0x0000000000200000-0x00000000007BA000-memory.dmp agile_net C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe agile_net C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe agile_net C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe agile_net -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 ipinfo.io 12 ipinfo.io 6 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1872 schtasks.exe 616 schtasks.exe 1592 schtasks.exe 576 schtasks.exe 624 schtasks.exe 2044 schtasks.exe 1480 schtasks.exe 1808 schtasks.exe 276 schtasks.exe -
Processes:
wininit.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 wininit.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 wininit.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 wininit.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 wininit.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 wininit.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
DCRatSupport.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewininit.exepid process 1864 DCRatSupport.exe 976 powershell.exe 268 powershell.exe 856 powershell.exe 308 powershell.exe 900 powershell.exe 1500 powershell.exe 1088 powershell.exe 1148 powershell.exe 572 powershell.exe 760 powershell.exe 544 powershell.exe 1860 powershell.exe 2744 wininit.exe 2744 wininit.exe 2744 wininit.exe 2744 wininit.exe 2744 wininit.exe 2744 wininit.exe 2744 wininit.exe 2744 wininit.exe 2744 wininit.exe 2744 wininit.exe 2744 wininit.exe 2744 wininit.exe 2744 wininit.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
DCRat Crack Test VERSION.exeDCRatSupport.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewininit.exedescription pid process Token: SeDebugPrivilege 1260 DCRat Crack Test VERSION.exe Token: SeDebugPrivilege 1864 DCRatSupport.exe Token: SeDebugPrivilege 976 powershell.exe Token: SeDebugPrivilege 268 powershell.exe Token: SeDebugPrivilege 856 powershell.exe Token: SeDebugPrivilege 308 powershell.exe Token: SeDebugPrivilege 900 powershell.exe Token: SeDebugPrivilege 1500 powershell.exe Token: SeDebugPrivilege 1088 powershell.exe Token: SeDebugPrivilege 1148 powershell.exe Token: SeDebugPrivilege 572 powershell.exe Token: SeDebugPrivilege 760 powershell.exe Token: SeDebugPrivilege 544 powershell.exe Token: SeDebugPrivilege 1860 powershell.exe Token: SeDebugPrivilege 2744 wininit.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
DCRat Crack Test VERSION.exeDCRatSupport.execmd.exedescription pid process target process PID 1260 wrote to memory of 1864 1260 DCRat Crack Test VERSION.exe DCRatSupport.exe PID 1260 wrote to memory of 1864 1260 DCRat Crack Test VERSION.exe DCRatSupport.exe PID 1260 wrote to memory of 1864 1260 DCRat Crack Test VERSION.exe DCRatSupport.exe PID 1260 wrote to memory of 1864 1260 DCRat Crack Test VERSION.exe DCRatSupport.exe PID 1864 wrote to memory of 268 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 268 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 268 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 760 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 760 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 760 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 976 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 976 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 976 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 1088 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 1088 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 1088 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 308 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 308 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 308 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 1148 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 1148 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 1148 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 1500 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 1500 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 1500 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 544 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 544 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 544 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 856 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 856 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 856 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 572 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 572 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 572 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 1860 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 1860 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 1860 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 900 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 900 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 900 1864 DCRatSupport.exe powershell.exe PID 1864 wrote to memory of 792 1864 DCRatSupport.exe cmd.exe PID 1864 wrote to memory of 792 1864 DCRatSupport.exe cmd.exe PID 1864 wrote to memory of 792 1864 DCRatSupport.exe cmd.exe PID 792 wrote to memory of 2372 792 cmd.exe w32tm.exe PID 792 wrote to memory of 2372 792 cmd.exe w32tm.exe PID 792 wrote to memory of 2372 792 cmd.exe w32tm.exe PID 792 wrote to memory of 2744 792 cmd.exe wininit.exe PID 792 wrote to memory of 2744 792 cmd.exe wininit.exe PID 792 wrote to memory of 2744 792 cmd.exe wininit.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\DCRat Crack Test VERSION.exe"C:\Users\Admin\AppData\Local\Temp\DCRat Crack Test VERSION.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DCRatSupport.exe"C:\Users\Admin\AppData\Local\Temp\DCRatSupport.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kcDIWAC5CG.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵
-
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe"C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Documents\My Music\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Music\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Documents\My Music\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exeFilesize
5.7MB
MD54bf0c454f9ec3e15308e5f2e362f9e87
SHA10ba55233e7510c060fc1f62d2a760096fb1b1136
SHA25643f1c47730d2764a0954a14e733605b8d9115bd3d77edfc2652fbdba12c71f6f
SHA512c0eb34ec3cb65c2ae75d99befa1dac84babc9e7c944f46a1650430bcc5935d3aad83b96cf5ab1b0f026de44d10f409fd9498762a53d41737ef3fba1a3c8b077b
-
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exeFilesize
5.7MB
MD54bf0c454f9ec3e15308e5f2e362f9e87
SHA10ba55233e7510c060fc1f62d2a760096fb1b1136
SHA25643f1c47730d2764a0954a14e733605b8d9115bd3d77edfc2652fbdba12c71f6f
SHA512c0eb34ec3cb65c2ae75d99befa1dac84babc9e7c944f46a1650430bcc5935d3aad83b96cf5ab1b0f026de44d10f409fd9498762a53d41737ef3fba1a3c8b077b
-
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\wininit.exeFilesize
5.7MB
MD54bf0c454f9ec3e15308e5f2e362f9e87
SHA10ba55233e7510c060fc1f62d2a760096fb1b1136
SHA25643f1c47730d2764a0954a14e733605b8d9115bd3d77edfc2652fbdba12c71f6f
SHA512c0eb34ec3cb65c2ae75d99befa1dac84babc9e7c944f46a1650430bcc5935d3aad83b96cf5ab1b0f026de44d10f409fd9498762a53d41737ef3fba1a3c8b077b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD5b3db050760208687fddc9f883532901a
SHA1b7106f7884e8a151a4650c5596b51e6af67b637e
SHA256d70e7bd6dac974f644c42dcf463fe7a92a50bdf1d5b5d0809ec9e8b426113632
SHA512e4d32c95f7465d1604a945cd114e8acdbd699efc09400ea2dd1505348326f43145198dae4f11374903632fcea755c73777714af15ac47e8e59c5324d8730d509
-
C:\Users\Admin\AppData\Local\Temp\Cab209E.tmpFilesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\Local\Temp\DCRatSupport.exeFilesize
5.7MB
MD54bf0c454f9ec3e15308e5f2e362f9e87
SHA10ba55233e7510c060fc1f62d2a760096fb1b1136
SHA25643f1c47730d2764a0954a14e733605b8d9115bd3d77edfc2652fbdba12c71f6f
SHA512c0eb34ec3cb65c2ae75d99befa1dac84babc9e7c944f46a1650430bcc5935d3aad83b96cf5ab1b0f026de44d10f409fd9498762a53d41737ef3fba1a3c8b077b
-
C:\Users\Admin\AppData\Local\Temp\DCRatSupport.exeFilesize
5.7MB
MD54bf0c454f9ec3e15308e5f2e362f9e87
SHA10ba55233e7510c060fc1f62d2a760096fb1b1136
SHA25643f1c47730d2764a0954a14e733605b8d9115bd3d77edfc2652fbdba12c71f6f
SHA512c0eb34ec3cb65c2ae75d99befa1dac84babc9e7c944f46a1650430bcc5935d3aad83b96cf5ab1b0f026de44d10f409fd9498762a53d41737ef3fba1a3c8b077b
-
C:\Users\Admin\AppData\Local\Temp\Tar225A.tmpFilesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
C:\Users\Admin\AppData\Local\Temp\kcDIWAC5CG.batFilesize
239B
MD5eb67ca93d41226a9e25eb9f8f6fb5e75
SHA14e8c9f62aed9a8d456836a1a82cd4a429555a81d
SHA2564160be3eab6b566bbfc55be7be6315a205dc9b1d2180bf1dadf14bef61ae78db
SHA512412074b9ab2895cc4b0705f444be9da543d9ee1284bdc9a531997146e8decbeda00b3e6837995a2fdaa5cfa5cbc36360b8a53e9b75b7b5ea778136ba19541b42
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5e2c8bc305c19a1535e8bbec03e422b71
SHA15864a56242e931bb42249b9f31b996ae83df66e7
SHA256995b6d837ded1c9f3794664c2d079140c3c4021429dd550a22dc6df5f7d8c617
SHA512a7fcd2fff2819ebdad5596af5ee6ed6ab23e148f34fbf196aa42074aba98397e6cdca9ce18f6d06cc9c5f6c8450f6e7f75cd0dd685dac6fc3a451b116ac4a641
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5e2c8bc305c19a1535e8bbec03e422b71
SHA15864a56242e931bb42249b9f31b996ae83df66e7
SHA256995b6d837ded1c9f3794664c2d079140c3c4021429dd550a22dc6df5f7d8c617
SHA512a7fcd2fff2819ebdad5596af5ee6ed6ab23e148f34fbf196aa42074aba98397e6cdca9ce18f6d06cc9c5f6c8450f6e7f75cd0dd685dac6fc3a451b116ac4a641
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5e2c8bc305c19a1535e8bbec03e422b71
SHA15864a56242e931bb42249b9f31b996ae83df66e7
SHA256995b6d837ded1c9f3794664c2d079140c3c4021429dd550a22dc6df5f7d8c617
SHA512a7fcd2fff2819ebdad5596af5ee6ed6ab23e148f34fbf196aa42074aba98397e6cdca9ce18f6d06cc9c5f6c8450f6e7f75cd0dd685dac6fc3a451b116ac4a641
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5e2c8bc305c19a1535e8bbec03e422b71
SHA15864a56242e931bb42249b9f31b996ae83df66e7
SHA256995b6d837ded1c9f3794664c2d079140c3c4021429dd550a22dc6df5f7d8c617
SHA512a7fcd2fff2819ebdad5596af5ee6ed6ab23e148f34fbf196aa42074aba98397e6cdca9ce18f6d06cc9c5f6c8450f6e7f75cd0dd685dac6fc3a451b116ac4a641
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5e2c8bc305c19a1535e8bbec03e422b71
SHA15864a56242e931bb42249b9f31b996ae83df66e7
SHA256995b6d837ded1c9f3794664c2d079140c3c4021429dd550a22dc6df5f7d8c617
SHA512a7fcd2fff2819ebdad5596af5ee6ed6ab23e148f34fbf196aa42074aba98397e6cdca9ce18f6d06cc9c5f6c8450f6e7f75cd0dd685dac6fc3a451b116ac4a641
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5e2c8bc305c19a1535e8bbec03e422b71
SHA15864a56242e931bb42249b9f31b996ae83df66e7
SHA256995b6d837ded1c9f3794664c2d079140c3c4021429dd550a22dc6df5f7d8c617
SHA512a7fcd2fff2819ebdad5596af5ee6ed6ab23e148f34fbf196aa42074aba98397e6cdca9ce18f6d06cc9c5f6c8450f6e7f75cd0dd685dac6fc3a451b116ac4a641
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5e2c8bc305c19a1535e8bbec03e422b71
SHA15864a56242e931bb42249b9f31b996ae83df66e7
SHA256995b6d837ded1c9f3794664c2d079140c3c4021429dd550a22dc6df5f7d8c617
SHA512a7fcd2fff2819ebdad5596af5ee6ed6ab23e148f34fbf196aa42074aba98397e6cdca9ce18f6d06cc9c5f6c8450f6e7f75cd0dd685dac6fc3a451b116ac4a641
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5e2c8bc305c19a1535e8bbec03e422b71
SHA15864a56242e931bb42249b9f31b996ae83df66e7
SHA256995b6d837ded1c9f3794664c2d079140c3c4021429dd550a22dc6df5f7d8c617
SHA512a7fcd2fff2819ebdad5596af5ee6ed6ab23e148f34fbf196aa42074aba98397e6cdca9ce18f6d06cc9c5f6c8450f6e7f75cd0dd685dac6fc3a451b116ac4a641
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5e2c8bc305c19a1535e8bbec03e422b71
SHA15864a56242e931bb42249b9f31b996ae83df66e7
SHA256995b6d837ded1c9f3794664c2d079140c3c4021429dd550a22dc6df5f7d8c617
SHA512a7fcd2fff2819ebdad5596af5ee6ed6ab23e148f34fbf196aa42074aba98397e6cdca9ce18f6d06cc9c5f6c8450f6e7f75cd0dd685dac6fc3a451b116ac4a641
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5e2c8bc305c19a1535e8bbec03e422b71
SHA15864a56242e931bb42249b9f31b996ae83df66e7
SHA256995b6d837ded1c9f3794664c2d079140c3c4021429dd550a22dc6df5f7d8c617
SHA512a7fcd2fff2819ebdad5596af5ee6ed6ab23e148f34fbf196aa42074aba98397e6cdca9ce18f6d06cc9c5f6c8450f6e7f75cd0dd685dac6fc3a451b116ac4a641
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5e2c8bc305c19a1535e8bbec03e422b71
SHA15864a56242e931bb42249b9f31b996ae83df66e7
SHA256995b6d837ded1c9f3794664c2d079140c3c4021429dd550a22dc6df5f7d8c617
SHA512a7fcd2fff2819ebdad5596af5ee6ed6ab23e148f34fbf196aa42074aba98397e6cdca9ce18f6d06cc9c5f6c8450f6e7f75cd0dd685dac6fc3a451b116ac4a641
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OK8H1GWMDH1445PJLG7Z.tempFilesize
7KB
MD5e2c8bc305c19a1535e8bbec03e422b71
SHA15864a56242e931bb42249b9f31b996ae83df66e7
SHA256995b6d837ded1c9f3794664c2d079140c3c4021429dd550a22dc6df5f7d8c617
SHA512a7fcd2fff2819ebdad5596af5ee6ed6ab23e148f34fbf196aa42074aba98397e6cdca9ce18f6d06cc9c5f6c8450f6e7f75cd0dd685dac6fc3a451b116ac4a641
-
\Users\Admin\AppData\Local\Temp\DCRatSupport.exeFilesize
5.7MB
MD54bf0c454f9ec3e15308e5f2e362f9e87
SHA10ba55233e7510c060fc1f62d2a760096fb1b1136
SHA25643f1c47730d2764a0954a14e733605b8d9115bd3d77edfc2652fbdba12c71f6f
SHA512c0eb34ec3cb65c2ae75d99befa1dac84babc9e7c944f46a1650430bcc5935d3aad83b96cf5ab1b0f026de44d10f409fd9498762a53d41737ef3fba1a3c8b077b
-
memory/268-1730-0x0000000002460000-0x00000000024E0000-memory.dmpFilesize
512KB
-
memory/268-1726-0x0000000002460000-0x00000000024E0000-memory.dmpFilesize
512KB
-
memory/268-1732-0x0000000002460000-0x00000000024E0000-memory.dmpFilesize
512KB
-
memory/268-1684-0x000000001B2B0000-0x000000001B592000-memory.dmpFilesize
2.9MB
-
memory/268-1755-0x000000000246B000-0x00000000024A2000-memory.dmpFilesize
220KB
-
memory/308-1757-0x000000000279B000-0x00000000027D2000-memory.dmpFilesize
220KB
-
memory/308-1742-0x0000000002790000-0x0000000002810000-memory.dmpFilesize
512KB
-
memory/308-1743-0x0000000002790000-0x0000000002810000-memory.dmpFilesize
512KB
-
memory/544-1772-0x000000000294B000-0x0000000002982000-memory.dmpFilesize
220KB
-
memory/544-1760-0x0000000002940000-0x00000000029C0000-memory.dmpFilesize
512KB
-
memory/544-1762-0x0000000002940000-0x00000000029C0000-memory.dmpFilesize
512KB
-
memory/544-1763-0x0000000002940000-0x00000000029C0000-memory.dmpFilesize
512KB
-
memory/572-1749-0x00000000028D0000-0x0000000002950000-memory.dmpFilesize
512KB
-
memory/572-1769-0x00000000028DB000-0x0000000002912000-memory.dmpFilesize
220KB
-
memory/572-1750-0x00000000028D0000-0x0000000002950000-memory.dmpFilesize
512KB
-
memory/572-1753-0x00000000028D0000-0x0000000002950000-memory.dmpFilesize
512KB
-
memory/760-1751-0x0000000002340000-0x00000000023C0000-memory.dmpFilesize
512KB
-
memory/760-1770-0x000000000234B000-0x0000000002382000-memory.dmpFilesize
220KB
-
memory/760-1754-0x0000000002340000-0x00000000023C0000-memory.dmpFilesize
512KB
-
memory/760-1759-0x0000000002340000-0x00000000023C0000-memory.dmpFilesize
512KB
-
memory/856-1738-0x0000000002660000-0x00000000026E0000-memory.dmpFilesize
512KB
-
memory/856-1739-0x0000000002660000-0x00000000026E0000-memory.dmpFilesize
512KB
-
memory/856-1758-0x000000000266B000-0x00000000026A2000-memory.dmpFilesize
220KB
-
memory/900-1767-0x000000000283B000-0x0000000002872000-memory.dmpFilesize
220KB
-
memory/900-1745-0x0000000002830000-0x00000000028B0000-memory.dmpFilesize
512KB
-
memory/900-1744-0x0000000002830000-0x00000000028B0000-memory.dmpFilesize
512KB
-
memory/900-1746-0x0000000002830000-0x00000000028B0000-memory.dmpFilesize
512KB
-
memory/976-1728-0x0000000002740000-0x00000000027C0000-memory.dmpFilesize
512KB
-
memory/976-1766-0x000000000274B000-0x0000000002782000-memory.dmpFilesize
220KB
-
memory/976-1690-0x0000000001F90000-0x0000000001F98000-memory.dmpFilesize
32KB
-
memory/976-1729-0x0000000002740000-0x00000000027C0000-memory.dmpFilesize
512KB
-
memory/976-1737-0x0000000002740000-0x00000000027C0000-memory.dmpFilesize
512KB
-
memory/1088-1748-0x00000000023A0000-0x0000000002420000-memory.dmpFilesize
512KB
-
memory/1088-1747-0x00000000023A0000-0x0000000002420000-memory.dmpFilesize
512KB
-
memory/1088-1768-0x00000000023AB000-0x00000000023E2000-memory.dmpFilesize
220KB
-
memory/1148-1771-0x00000000026CB000-0x0000000002702000-memory.dmpFilesize
220KB
-
memory/1148-1756-0x00000000026C0000-0x0000000002740000-memory.dmpFilesize
512KB
-
memory/1148-1761-0x00000000026C0000-0x0000000002740000-memory.dmpFilesize
512KB
-
memory/1148-1752-0x00000000026C0000-0x0000000002740000-memory.dmpFilesize
512KB
-
memory/1260-96-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-69-0x0000000005280000-0x00000000052C0000-memory.dmpFilesize
256KB
-
memory/1260-55-0x00000000052C0000-0x0000000005680000-memory.dmpFilesize
3.8MB
-
memory/1260-56-0x0000000005280000-0x00000000052C0000-memory.dmpFilesize
256KB
-
memory/1260-92-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-1639-0x0000000006820000-0x0000000006DE6000-memory.dmpFilesize
5.8MB
-
memory/1260-657-0x0000000005280000-0x00000000052C0000-memory.dmpFilesize
256KB
-
memory/1260-563-0x0000000005280000-0x00000000052C0000-memory.dmpFilesize
256KB
-
memory/1260-561-0x0000000005280000-0x00000000052C0000-memory.dmpFilesize
256KB
-
memory/1260-559-0x0000000005280000-0x00000000052C0000-memory.dmpFilesize
256KB
-
memory/1260-118-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-120-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-122-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-114-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-116-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-112-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-108-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-110-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-98-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-57-0x0000000005280000-0x00000000052C0000-memory.dmpFilesize
256KB
-
memory/1260-58-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-106-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-104-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-100-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-94-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-59-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-61-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-54-0x0000000005690000-0x0000000005A56000-memory.dmpFilesize
3.8MB
-
memory/1260-67-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-65-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-102-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-86-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-90-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-88-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-63-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-70-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-84-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-80-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-72-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-82-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-78-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-74-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1260-76-0x00000000052C0000-0x000000000567A000-memory.dmpFilesize
3.7MB
-
memory/1500-1765-0x00000000028F0000-0x0000000002970000-memory.dmpFilesize
512KB
-
memory/1500-1740-0x00000000028F0000-0x0000000002970000-memory.dmpFilesize
512KB
-
memory/1500-1741-0x00000000028F0000-0x0000000002970000-memory.dmpFilesize
512KB
-
memory/1860-1764-0x0000000002620000-0x00000000026A0000-memory.dmpFilesize
512KB
-
memory/1864-1654-0x0000000000BB0000-0x0000000000BBE000-memory.dmpFilesize
56KB
-
memory/1864-1653-0x0000000000BA0000-0x0000000000BA8000-memory.dmpFilesize
32KB
-
memory/1864-1646-0x0000000000200000-0x00000000007BA000-memory.dmpFilesize
5.7MB
-
memory/1864-1655-0x0000000000C40000-0x0000000000C4C000-memory.dmpFilesize
48KB
-
memory/1864-1648-0x000000001B7A0000-0x000000001B912000-memory.dmpFilesize
1.4MB
-
memory/1864-1650-0x00000000001F0000-0x0000000000200000-memory.dmpFilesize
64KB
-
memory/1864-1656-0x0000000000C50000-0x0000000000C5C000-memory.dmpFilesize
48KB
-
memory/1864-1652-0x0000000000B90000-0x0000000000B9C000-memory.dmpFilesize
48KB
-
memory/1864-1649-0x00000000007C0000-0x00000000007DC000-memory.dmpFilesize
112KB
-
memory/1864-1647-0x000000001B440000-0x000000001B4C0000-memory.dmpFilesize
512KB
-
memory/1864-1651-0x00000000007E0000-0x00000000007F6000-memory.dmpFilesize
88KB