dcrat | 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

585d78b9ffc988d345e7a2a0ee119111.exe
Size

23.9MB
MD5

585d78b9ffc988d345e7a2a0ee119111
SHA1

65b5c6a6c72a845d5610d82ca2aa9a301a907e43
SHA256

82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661
SHA512

574c1f9ecaaeee0cc7afb989e3c3d309beedf3b114fbbb0aa491a285d94e27b4e87626a109805d06edcace458441189cc2dbcd17588c670ce8788c9e8e3a9772
SSDEEP

393216:849/fUrtpuKs+JINSpjQNjqsVsUzpX/Swl6YdecNbLX3IjD4BzB/RLG0jV7ZIfue:cBZs+JIgpjQosVRlKwlOq/X2EtF9IGe

Score

10^/10

dcrat zgrat discovery evasion execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2716-32-0x0000000000400000-0x0000000001BE6000-memory.dmp	family_zgrat_v1

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection	svchost.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\DCRatBuild.exe	dcrat
behavioral1/memory/2716-32-0x0000000000400000-0x0000000001BE6000-memory.dmp	dcrat
\WindowsUpdate\WindowsUpdate.exe	dcrat
behavioral1/memory/1720-69-0x0000000000E30000-0x00000000010EE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2568 powershell.exe
608 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Drops file in Drivers directory 2 IoCs

Processes:

build.exeWinUpdater.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts build.exe
File created C:\Windows\system32\drivers\etc\hosts WinUpdater.exe

pid	process
2568	powershell.exe
608	powershell.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	build.exe
File created	C:\Windows\system32\drivers\etc\hosts	WinUpdater.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

services.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinUpdater\ImagePath = "C:\\ProgramData\\WindowsUpdate\\WinUpdater.exe"	services.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\323.exe	net_reactor
behavioral1/memory/2716-32-0x0000000000400000-0x0000000001BE6000-memory.dmp	net_reactor
behavioral1/memory/2676-50-0x0000000000FB0000-0x0000000001028000-memory.dmp	net_reactor

Executes dropped EXE 8 IoCs

Processes:

build.exeDCRatBuild.exe323.exeMVPInstaller.exeMVPInstaller.exeWindowsUpdate.exeMVPInstaller.exeWinUpdater.exe

pid	process
3016	build.exe
2616	DCRatBuild.exe
2676	323.exe
2800	MVPInstaller.exe
1652	MVPInstaller.exe
1720	WindowsUpdate.exe
1908	MVPInstaller.exe
1772	WinUpdater.exe

Loads dropped DLL 24 IoCs

Processes:

585d78b9ffc988d345e7a2a0ee119111.exeDCRatBuild.exe323.exeMVPInstaller.execmd.exeMVPInstaller.exeMVPInstaller.exeservices.exe

pid	process
2716	585d78b9ffc988d345e7a2a0ee119111.exe
2716	585d78b9ffc988d345e7a2a0ee119111.exe
2716	585d78b9ffc988d345e7a2a0ee119111.exe
2616	DCRatBuild.exe
2616	DCRatBuild.exe
2716	585d78b9ffc988d345e7a2a0ee119111.exe
2716	585d78b9ffc988d345e7a2a0ee119111.exe
2676	323.exe
2676	323.exe
2800	MVPInstaller.exe
2800	MVPInstaller.exe
2800	MVPInstaller.exe
2800	MVPInstaller.exe
2800	MVPInstaller.exe
2948	cmd.exe
2948	cmd.exe
1652	MVPInstaller.exe
1908	MVPInstaller.exe
1908	MVPInstaller.exe
1908	MVPInstaller.exe
1908	MVPInstaller.exe
1908	MVPInstaller.exe
476	services.exe
476	services.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 22 IoCs

Processes:

WMIADAP.EXEbuild.exepowershell.exesvchost.exeWinUpdater.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\perfh00A.dat	WMIADAP.EXE
File opened for modification	C:\Windows\system32\MRT.exe	build.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\perfc007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh010.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc011.dat	WMIADAP.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe
File opened for modification	C:\Windows\system32\MRT.exe	WinUpdater.exe
File created	C:\Windows\system32\perfc010.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh011.dat	WMIADAP.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx	svchost.exe
File created	C:\Windows\system32\perfh007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh00C.dat	WMIADAP.EXE
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WMIADAP.EXE

Suspicious use of SetThreadContext 4 IoCs

Processes:

build.exeWinUpdater.exe

description	pid	process	target process
PID 3016 set thread context of 1560	3016	build.exe	dialer.exe
PID 1772 set thread context of 2096	1772	WinUpdater.exe	dialer.exe
PID 1772 set thread context of 1748	1772	WinUpdater.exe	dialer.exe
PID 1772 set thread context of 1264	1772	WinUpdater.exe	dialer.exe

Drops file in Windows directory 6 IoCs

Processes:

WMIADAP.EXEwusa.exesvchost.exewusa.exe

description	ioc	process
File created	C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini	WMIADAP.EXE
File created	C:\Windows\wusa.lock	wusa.exe
File opened for modification	C:\Windows\appcompat\programs\RecentFileCache.bcf	svchost.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

1360 sc.exe
2368 sc.exe
320 sc.exe
2112 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1360	sc.exe
2368	sc.exe
320	sc.exe
2112	sc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

dialer.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 60a9487897a3da01	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2836 PING.EXE

pid	process
2836	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MVPInstaller.exebuild.exe323.exepowershell.exedialer.exeWinUpdater.exepowershell.exedialer.exe

pid	process
2800	MVPInstaller.exe
2800	MVPInstaller.exe
2800	MVPInstaller.exe
3016	build.exe
2676	323.exe
2568	powershell.exe
3016	build.exe
3016	build.exe
3016	build.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
3016	build.exe
3016	build.exe
3016	build.exe
3016	build.exe
1560	dialer.exe
1560	dialer.exe
1772	WinUpdater.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
608	powershell.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1560	dialer.exe
1772	WinUpdater.exe
1772	WinUpdater.exe
1772	WinUpdater.exe
2096	dialer.exe
2096	dialer.exe
2096	dialer.exe
2096	dialer.exe
1772	WinUpdater.exe
2096	dialer.exe
2096	dialer.exe
2096	dialer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

323.exeMVPInstaller.exeWindowsUpdate.exepowershell.exebuild.exedialer.exesvchost.exepowershell.exeWinUpdater.exedialer.exedialer.exe

description	pid	process
Token: SeDebugPrivilege	2676	323.exe
Token: SeDebugPrivilege	2800	MVPInstaller.exe
Token: SeDebugPrivilege	1720	WindowsUpdate.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	3016	build.exe
Token: SeDebugPrivilege	1560	dialer.exe
Token: SeAuditPrivilege	868	svchost.exe
Token: SeDebugPrivilege	608	powershell.exe
Token: SeAuditPrivilege	868	svchost.exe
Token: SeDebugPrivilege	1772	WinUpdater.exe
Token: SeDebugPrivilege	2096	dialer.exe
Token: SeLockMemoryPrivilege	1264	dialer.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeSystemtimePrivilege	868	svchost.exe
Token: SeBackupPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeShutdownPrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeUndockPrivilege	868	svchost.exe
Token: SeManageVolumePrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeSystemtimePrivilege	868	svchost.exe
Token: SeBackupPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeShutdownPrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeUndockPrivilege	868	svchost.exe
Token: SeManageVolumePrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeSystemtimePrivilege	868	svchost.exe
Token: SeBackupPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeShutdownPrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeUndockPrivilege	868	svchost.exe
Token: SeManageVolumePrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeSystemtimePrivilege	868	svchost.exe
Token: SeBackupPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeShutdownPrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeUndockPrivilege	868	svchost.exe
Token: SeManageVolumePrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MVPInstaller.exe

pid process

1908 MVPInstaller.exe

pid	process
1908	MVPInstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

585d78b9ffc988d345e7a2a0ee119111.exeDCRatBuild.exeWScript.exeMVPInstaller.execmd.execmd.exeMVPInstaller.exe

description	pid	process	target process
PID 2716 wrote to memory of 3016	2716	585d78b9ffc988d345e7a2a0ee119111.exe	build.exe
PID 2716 wrote to memory of 3016	2716	585d78b9ffc988d345e7a2a0ee119111.exe	build.exe
PID 2716 wrote to memory of 3016	2716	585d78b9ffc988d345e7a2a0ee119111.exe	build.exe
PID 2716 wrote to memory of 3016	2716	585d78b9ffc988d345e7a2a0ee119111.exe	build.exe
PID 2716 wrote to memory of 2616	2716	585d78b9ffc988d345e7a2a0ee119111.exe	DCRatBuild.exe
PID 2716 wrote to memory of 2616	2716	585d78b9ffc988d345e7a2a0ee119111.exe	DCRatBuild.exe
PID 2716 wrote to memory of 2616	2716	585d78b9ffc988d345e7a2a0ee119111.exe	DCRatBuild.exe
PID 2716 wrote to memory of 2616	2716	585d78b9ffc988d345e7a2a0ee119111.exe	DCRatBuild.exe
PID 2716 wrote to memory of 2616	2716	585d78b9ffc988d345e7a2a0ee119111.exe	DCRatBuild.exe
PID 2716 wrote to memory of 2616	2716	585d78b9ffc988d345e7a2a0ee119111.exe	DCRatBuild.exe
PID 2716 wrote to memory of 2616	2716	585d78b9ffc988d345e7a2a0ee119111.exe	DCRatBuild.exe
PID 2716 wrote to memory of 2676	2716	585d78b9ffc988d345e7a2a0ee119111.exe	323.exe
PID 2716 wrote to memory of 2676	2716	585d78b9ffc988d345e7a2a0ee119111.exe	323.exe
PID 2716 wrote to memory of 2676	2716	585d78b9ffc988d345e7a2a0ee119111.exe	323.exe
PID 2716 wrote to memory of 2676	2716	585d78b9ffc988d345e7a2a0ee119111.exe	323.exe
PID 2716 wrote to memory of 2676	2716	585d78b9ffc988d345e7a2a0ee119111.exe	323.exe
PID 2716 wrote to memory of 2676	2716	585d78b9ffc988d345e7a2a0ee119111.exe	323.exe
PID 2716 wrote to memory of 2676	2716	585d78b9ffc988d345e7a2a0ee119111.exe	323.exe
PID 2716 wrote to memory of 2800	2716	585d78b9ffc988d345e7a2a0ee119111.exe	MVPInstaller.exe
PID 2716 wrote to memory of 2800	2716	585d78b9ffc988d345e7a2a0ee119111.exe	MVPInstaller.exe
PID 2716 wrote to memory of 2800	2716	585d78b9ffc988d345e7a2a0ee119111.exe	MVPInstaller.exe
PID 2716 wrote to memory of 2800	2716	585d78b9ffc988d345e7a2a0ee119111.exe	MVPInstaller.exe
PID 2716 wrote to memory of 2800	2716	585d78b9ffc988d345e7a2a0ee119111.exe	MVPInstaller.exe
PID 2716 wrote to memory of 2800	2716	585d78b9ffc988d345e7a2a0ee119111.exe	MVPInstaller.exe
PID 2716 wrote to memory of 2800	2716	585d78b9ffc988d345e7a2a0ee119111.exe	MVPInstaller.exe
PID 2616 wrote to memory of 2824	2616	DCRatBuild.exe	WScript.exe
PID 2616 wrote to memory of 2824	2616	DCRatBuild.exe	WScript.exe
PID 2616 wrote to memory of 2824	2616	DCRatBuild.exe	WScript.exe
PID 2616 wrote to memory of 2824	2616	DCRatBuild.exe	WScript.exe
PID 2616 wrote to memory of 2824	2616	DCRatBuild.exe	WScript.exe
PID 2616 wrote to memory of 2824	2616	DCRatBuild.exe	WScript.exe
PID 2616 wrote to memory of 2824	2616	DCRatBuild.exe	WScript.exe
PID 2824 wrote to memory of 2948	2824	WScript.exe	cmd.exe
PID 2824 wrote to memory of 2948	2824	WScript.exe	cmd.exe
PID 2824 wrote to memory of 2948	2824	WScript.exe	cmd.exe
PID 2824 wrote to memory of 2948	2824	WScript.exe	cmd.exe
PID 2824 wrote to memory of 2948	2824	WScript.exe	cmd.exe
PID 2824 wrote to memory of 2948	2824	WScript.exe	cmd.exe
PID 2824 wrote to memory of 2948	2824	WScript.exe	cmd.exe
PID 2800 wrote to memory of 1652	2800	MVPInstaller.exe	MVPInstaller.exe
PID 2800 wrote to memory of 1652	2800	MVPInstaller.exe	MVPInstaller.exe
PID 2800 wrote to memory of 1652	2800	MVPInstaller.exe	MVPInstaller.exe
PID 2800 wrote to memory of 1652	2800	MVPInstaller.exe	MVPInstaller.exe
PID 2800 wrote to memory of 1396	2800	MVPInstaller.exe	cmd.exe
PID 2800 wrote to memory of 1396	2800	MVPInstaller.exe	cmd.exe
PID 2800 wrote to memory of 1396	2800	MVPInstaller.exe	cmd.exe
PID 2800 wrote to memory of 1396	2800	MVPInstaller.exe	cmd.exe
PID 2800 wrote to memory of 1396	2800	MVPInstaller.exe	cmd.exe
PID 2800 wrote to memory of 1396	2800	MVPInstaller.exe	cmd.exe
PID 2800 wrote to memory of 1396	2800	MVPInstaller.exe	cmd.exe
PID 1396 wrote to memory of 2836	1396	cmd.exe	PING.EXE
PID 1396 wrote to memory of 2836	1396	cmd.exe	PING.EXE
PID 1396 wrote to memory of 2836	1396	cmd.exe	PING.EXE
PID 1396 wrote to memory of 2836	1396	cmd.exe	PING.EXE
PID 1396 wrote to memory of 2836	1396	cmd.exe	PING.EXE
PID 1396 wrote to memory of 2836	1396	cmd.exe	PING.EXE
PID 1396 wrote to memory of 2836	1396	cmd.exe	PING.EXE
PID 2948 wrote to memory of 1720	2948	cmd.exe	WindowsUpdate.exe
PID 2948 wrote to memory of 1720	2948	cmd.exe	WindowsUpdate.exe
PID 2948 wrote to memory of 1720	2948	cmd.exe	WindowsUpdate.exe
PID 2948 wrote to memory of 1720	2948	cmd.exe	WindowsUpdate.exe
PID 1652 wrote to memory of 1908	1652	MVPInstaller.exe	MVPInstaller.exe
PID 1652 wrote to memory of 1908	1652	MVPInstaller.exe	MVPInstaller.exe
PID 1652 wrote to memory of 1908	1652	MVPInstaller.exe	MVPInstaller.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Sets service image path in registry
- Loads dropped DLL
PID:476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:600

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
3⤵
- Checks processor information in registry
PID:1556

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
3⤵
PID:352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
- Modifies security service
- Drops file in System32 directory
PID:752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:820

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
3⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
3⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:276

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1064

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:2388

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:2984

C:\ProgramData\WindowsUpdate\WinUpdater.exe
C:\ProgramData\WindowsUpdate\WinUpdater.exe
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:1796

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
- Drops file in Windows directory
PID:2240

C:\Windows\system32\dialer.exe
C:\Windows\system32\dialer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\system32\dialer.exe
C:\Windows\system32\dialer.exe
3⤵
PID:1748

C:\Windows\system32\dialer.exe
dialer.exe
3⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1264

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:492

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:500

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188

C:\Users\Admin\AppData\Local\Temp\585d78b9ffc988d345e7a2a0ee119111.exe
"C:\Users\Admin\AppData\Local\Temp\585d78b9ffc988d345e7a2a0ee119111.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:708

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
5⤵
- Drops file in Windows directory
PID:2060

C:\Windows\system32\dialer.exe
C:\Windows\system32\dialer.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "WinUpdater"
4⤵
- Launches sc.exe
PID:1360

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "WinUpdater" binpath= "C:\ProgramData\WindowsUpdate\WinUpdater.exe" start= "auto"
4⤵
- Launches sc.exe
PID:2368

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
4⤵
- Launches sc.exe
PID:2112

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WinUpdater"
4⤵
- Launches sc.exe
PID:320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\build.exe"
4⤵
PID:2376

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:2200

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\WindowsUpdate\TEUXpnVW2Rogcdt2Uv.vbe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2824

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\WindowsUpdate\2UpMr4oh.bat" "
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948

C:\WindowsUpdate\WindowsUpdate.exe
"C:\WindowsUpdate\WindowsUpdate.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Users\Admin\AppData\Local\Temp\323.exe
"C:\Users\Admin\AppData\Local\Temp\323.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800

C:\Users\Admin\AppData\Roaming\MVPInstaller\MVPInstaller.exe
"C:\Users\Admin\AppData\Roaming\MVPInstaller\MVPInstaller.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\RarSFX0\MVPInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\MVPInstaller.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1908

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c deldll.bat
4⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\PING.EXE
ping -n 2 -w 1000 127.0.0.1
5⤵
- Runs ping.exe
PID:2836

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "271708703713649611-27678846-750645344-958501179-475764692-657193717-144902231"
1⤵
PID:1928

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1255964061-544150849-16573972111863020607-1660537181-13153820881570418774660387703"
1⤵
PID:1100

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1067057285519091552-1121599432-734774711-867550962-1318149076-752662081281232597"
1⤵
PID:484

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1889276485-103030438-401072860-20624988211378103747-1903931485957987872-1652367385"
1⤵
PID:596

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1692200850-1954276261-741340716-2145277770225004831859018120-77461875-2099568902"
1⤵
PID:1252

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-150338161173863589496437212189335745112518943711009947911389567840850826920"
1⤵
PID:2636

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "10513568711805736785173928266-449670938-406808149-172121422988308434329983353"
1⤵
PID:2964

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe
Filesize
15.1MB

MD5
85059372ceca7eff4ac1642bd631b93e

SHA1
f59d24530e896d688792fa022fda50417722ebd8

SHA256
6e4c820de03c72d71c43d24885b7e1f2462bcced03114b31eac8bccc9ec924c9

SHA512
bfd54c1c39658f97a10b8baf75a83a658e7d7e66afeaf291df6eb77fc0f4b4173850b336d6af1f4992f6918049acf5f747383deecc63b914562bf83cb9f11e5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\MSVCP140.dll
Filesize
558KB

MD5
bf78c15068d6671693dfcdfa5770d705

SHA1
4418c03c3161706a4349dfe3f97278e7a5d8962a

SHA256
a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb

SHA512
5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140.dll
Filesize
94KB

MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140_1.dll
Filesize
36KB

MD5
7667b0883de4667ec87c3b75bed84d84

SHA1
e6f6df83e813ed8252614a46a5892c4856df1f58

SHA256
04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d

SHA512
968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\api-ms-win-crt-runtime-l1-1-0.dll
Filesize
24KB

MD5
c95635d7b2004d521a004cc73ddc6883

SHA1
7871333c1430cf4fe7ed47038383053c7a832c01

SHA256
ffadbed3c8c4a7bc6bd2f888e14830cc515db1c9b68046d5fd43d32e016a540e

SHA512
475b8de45109c931a38e7ec192e1682c2324e0f4522ce543311ef1965e0819e3bd2fd85dcb7d21547061a656e1ce4d56a328cf4a6735cd3643eaff43810731fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\app.so
Filesize
4.4MB

MD5
14d0a013e4ba7e748c77d14771f01120

SHA1
fbda934ba5e9864bd6625786b124df624972676b

SHA256
327c7235ddad44cb53f3387948a21a8ada6c776060e512f0d48a704920b1004c

SHA512
7e99c55e0210bd855db91883c74329f78c0bb20c55c80b088a03167670ae56258caf24d5373c896d2ca7120a1b8c174da36436b4aef0df14d8e57ca893bf867d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\AssetManifest.bin
Filesize
751B

MD5
f0ab28955a65dda7ec0745733b8d5704

SHA1
f1323494b94cea4017b553a78c045c19ffd6606f

SHA256
07c3ef8bcee38f84a1e57005a864a4404111fc96195aba4d630c8be969772310

SHA512
82b1be0370788065534d642dc43c01a248fa2cfaa97b4a7db60dda9cdf94d8f3c38f614fb54eef0bcbc332714c05ad4002baed903a826f529c2add1847d70a2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\FontManifest.json
Filesize
499B

MD5
b2f01a90f24be87c4f4ae98e79090bf5

SHA1
ae7107f7e0d5fae6288e8a82cb1c0f67efbc0b3d

SHA256
eb4549732cd13d6c3874351c182ea15850fbf71f219fe1efe9a1cac19b6c9087

SHA512
422af00f1d8835598586687bec6162c52f6eb0234222f855301bceba8dd71a2bc0e720fa4148c360e77a44be97efc587dd3e2bef5c3cdece1a925f7cf93046ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\assets\fonts\Montserrat-Bold.ttf
Filesize
255KB

MD5
88932dadc42e1bba93b21a76de60ef7a

SHA1
3320ff5514b32565b0396de4f2064ce17ec9eea4

SHA256
c4c8cb572a5a2c43d78b3701f4b2349684e6ca4d1557e469af6065b1e099c26c

SHA512
298e1e171dbbe386e1abe153446b883c40910819099f64f54dc9faa95d739be56839537342bbe8dd8408545cb1f8c98878a3524d91af1f11a112d1bfc202657a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\assets\fonts\gothampro_black.ttf
Filesize
39KB

MD5
efb0c02a5dbe65a7115b477e74c7a661

SHA1
e30324f4074bcc522a393cecaa62aa4b0e9205cc

SHA256
270d30776b7e5ccf0560b08e0db009f4b1d9753d43689d1e20bb1065e2a3c157

SHA512
0095fb9b0cd508c996cfdc11374a040ef064a22f188d7fbeb21f23c5f7f06aa2bce75e9ae22ec1c0e0f1b8e23003f67c8e8b5962c224c1295fb311e63a9b91f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\assets\skeleton.gif
Filesize
776KB

MD5
a1f94e106f73bd7ff5d3d36d2eef917d

SHA1
549aa1d500f3754026c2cfd336351802126907ea

SHA256
d400caf56eec5bf44bdbfa754bb7bcb84651293497a59b45b1796df202ab9bfe

SHA512
f65e38fdf3a6215b6de29dd284a1dfb19fc1a6a9e5d8f7c7b47deeafe3d1c3d4e83dce6c9cecf0f004d78e04829d46d1451c857adaa47a983c99ec22f55314be

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Filesize
1.6MB

MD5
e7069dfd19b331be16bed984668fe080

SHA1
fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4

SHA256
d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453

SHA512
27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\icudtl.dat
Filesize
798KB

MD5
cf772cf9f6ca67f592fe47da2a15adb1

SHA1
9cc4d99249bdba8a030daf00d98252c8aef7a0ff

SHA256
ac44ccc3f61bf630bb20fb8043d86cfe4c8995d06b460084400db45d70497b30

SHA512
0bec0d3a34a4ac1cc2ed81dba3bc52981c5dd391a68fe21132dfadb70e42ffbe8f3ba798185733d64a900fd2bb2403f9a8558e6666f2c1e2c0e818d8e3f154fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\flutter_windows.dll
Filesize
17.0MB

MD5
2eb35e2372de5fc7fde925c96de61d48

SHA1
a9eedd7cf44a6eab4e08df9ab0b33fd95ceb48fd

SHA256
80efad451cd0b674b9974ef286d29ef72f219999dd8f993585f9168d97895e6f

SHA512
18a03d297770707709fcada8dd0741bd39057d54b49125119ba8b7d21aa67284dece89947dc14721fe3084e69f03e816a2ed9ad79e82ffe279d7fd0a318ff029

Download Submit
C:\Users\Admin\AppData\Local\Temp\deldll.bat
Filesize
200B

MD5
ea190ef9b139757a890cd48bdd44b0ee

SHA1
95c684e41bf7919408816aafab881621fface202

SHA256
9131de0fcaaf968896af9d58b6f37b4aa443455bb97c97bc142f295cee577bc4

SHA512
22802ffc1965c8e27f799ee88e3fa46debb316c27507a570b0812bc5de0d59a9c2a2105b8cc204851b3c29984ef1dfb7842131819952b185b7e4325a032fb6ad

Download Submit
C:\Users\Admin\AppData\Roaming\MVPInstaller\MVPInstaller.exe
Filesize
15.3MB

MD5
91a99c76150f66c4d582ce98f3e3b2c3

SHA1
983fed8f09fe95fb3ca67e884f2f824f0e3a72be

SHA256
61217d7e2be6784784aa6b3b3a23a2777a6eee79be4e6f8d6e3f6b0f10032920

SHA512
2562b594ff224d36d6f7c147326cc929e9790bf75632c4f7e3589dbb58498159a4978f5e48751d13ae5d62f354d541a3156d4f901e6f1983fb9b1f3e3638cf8b

Download Submit
C:\WindowsUpdate\2UpMr4oh.bat
Filesize
36B

MD5
ececcb4dab2899a896f6727230ddb26a

SHA1
7f629cd32f92dc6a8da7142f7de397b08ced0974

SHA256
f7f7150ae59104004cc4bdd36110807333ef0a27c0ce0a08fd0ae2646159f73c

SHA512
10f74f3b64ace8002270e27a450cc26a25502d9c98f8dd23cfa22886368be1d7d7c46cd153fbac88b07bcf0ea401549a5927a8583b612a0e5e2b5aa9162ee592

Download Submit
C:\WindowsUpdate\TEUXpnVW2Rogcdt2Uv.vbe
Filesize
198B

MD5
ea0cabd5fc14e86870ef589016ad6400

SHA1
ebbb0646d34c4973021d08ad37276f54036d1658

SHA256
3f5a8ef3d4412432127feab5637a18b59cb06ec47faefae6f54dfcde27a5cbf7

SHA512
200623fc8cdcbb6acbefcb04334f84453162188cc00d846046ea54db3168a470d8263bce12524809864bdad1d1438890783afac6440670931ea59d1a97fc6a57

Download Submit
C:\Windows\System32\perfc007.dat
Filesize
145KB

MD5
19c7052de3b7281b4c1c6bfbb543c5dc

SHA1
d2e12081a14c1069c89f2cee7357a559c27786e7

SHA256
14ed6cb3198e80964cbc687a60aed24fb68d1bbd7588f983dc1fc6ae63514b4a

SHA512
289ca791909882c857014bd24e777fa84b533896508b562051b529d4c27e0d98bc41c801c6384b382f5dc0fa584dc8f713939c636543b0a5cf5ea2b396300f83

Download Submit
C:\Windows\System32\perfc00A.dat
Filesize
154KB

MD5
f0ecfbfa3e3e59fd02197018f7e9cb84

SHA1
961e9367a4ef3a189466c0a0a186faf8958bdbc4

SHA256
cfa293532a1b865b95093437d82bf8b682132aa335957f0c6d95edfbcc372324

SHA512
116e648cb3b591a6a94da5ef11234778924a2ff9e0b3d7f6f00310d8a58914d12f5ee1b63c2f88701bb00538ad0e42ae2561575333c5a1d63bb8c86863ac6294

Download Submit
C:\Windows\System32\perfc00C.dat
Filesize
145KB

MD5
ce233fa5dc5adcb87a5185617a0ff6ac

SHA1
2e2747284b1204d3ab08733a29fdbabdf8dc55b9

SHA256
68d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31

SHA512
1e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2

Download Submit
C:\Windows\System32\perfc010.dat
Filesize
142KB

MD5
d73172c6cb697755f87cd047c474cf91

SHA1
abc5c7194abe32885a170ca666b7cce8251ac1d6

SHA256
9de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57

SHA512
7c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6

Download Submit
C:\Windows\System32\perfc011.dat
Filesize
114KB

MD5
1f998386566e5f9b7f11cc79254d1820

SHA1
e1da5fe1f305099b94de565d06bc6f36c6794481

SHA256
1665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea

SHA512
a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f

Download Submit
C:\Windows\System32\perfh007.dat
Filesize
680KB

MD5
b69ab3aeddb720d6ef8c05ff88c23b38

SHA1
d830c2155159656ed1806c7c66cae2a54a2441fa

SHA256
24c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625

SHA512
4c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d

Download Submit
C:\Windows\System32\perfh009.dat
Filesize
646KB

MD5
aecab86cc5c705d7a036cba758c1d7b0

SHA1
e88cf81fd282d91c7fc0efae13c13c55f4857b5e

SHA256
9bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066

SHA512
e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8

Download Submit
C:\Windows\System32\perfh00A.dat
Filesize
727KB

MD5
7d0bac4e796872daa3f6dc82c57f4ca8

SHA1
b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a

SHA256
ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879

SHA512
145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e

Download Submit
C:\Windows\System32\perfh00C.dat
Filesize
727KB

MD5
5f684ce126de17a7d4433ed2494c5ca9

SHA1
ce1a30a477daa1bac2ec358ce58731429eafe911

SHA256
2e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c

SHA512
4d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b

Download Submit
C:\Windows\System32\perfh010.dat
Filesize
722KB

MD5
4623482c106cf6cc1bac198f31787b65

SHA1
5abb0decf7b42ef5daf7db012a742311932f6dad

SHA256
eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349

SHA512
afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f

Download Submit
C:\Windows\System32\perfh011.dat
Filesize
406KB

MD5
54c674d19c0ff72816402f66f6c3d37c

SHA1
2dcc0269545a213648d59dc84916d9ec2d62a138

SHA256
646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5

SHA512
4d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f

Download Submit
C:\Windows\System32\wbem\Performance\WmiApRpl.h
Filesize
3KB

MD5
b133a676d139032a27de3d9619e70091

SHA1
1248aa89938a13640252a79113930ede2f26f1fa

SHA256
ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15

SHA512
c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5

Download Submit
C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Filesize
27KB

MD5
46d08e3a55f007c523ac64dce6dcf478

SHA1
62edf88697e98d43f32090a2197bead7e7244245

SHA256
5b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614

SHA512
b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
2KB

MD5
2b19df2da3af86adf584efbddd0d31c0

SHA1
f1738910789e169213611c033d83bc9577373686

SHA256
58868a299c5cf1167ed3fbc570a449ecd696406410b24913ddbd0f06a32595bd

SHA512
4a1831f42a486a0ad2deef3d348e7220209214699504e29fdfeb2a6f7f25ad1d353158cd05778f76ef755e77ccd94ce9b4a7504039e439e4e90fa7cde589daa6

Download Submit
\Users\Admin\AppData\Local\Temp\323.exe
Filesize
457KB

MD5
53c1d38049f4318e577c3ab1bcc6e38f

SHA1
0bd051e27c86ef4858c94f2398d64958e130c448

SHA256
ad6baed534549a8eb75f44c05807581e0eb5fde56a8b3a64a741853bcb19a863

SHA512
938bcdfefc9a28bc9d6918db1df487d78c218e2f15e86cbab69f773eb366b1e822d65c2e82c05ff623f3a69981735badc182d67062cd2f7506ccc017ab7fc42d

Download Submit
\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
Filesize
3.0MB

MD5
caddb11f9014c4b6bd7f79306211899f

SHA1
1cef789bb00aa2bf87ce0b1dc612b577e05f6e7a

SHA256
5be33a975fb052c1a4338ed8deca2641f5a9fa52f2cf3c6fd71b420fff462440

SHA512
fa5c582eb75c6d8dd03f455f328b9ceb5b509f9d0fd659cd7521771940105e9e108c900edbaf685c0b5090825df46cc8c98fd383ce2f08bf74edcdc3546110ea

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\MVPInstaller.exe
Filesize
340KB

MD5
3fb5bd0f25e277240fbad5b91a73c71b

SHA1
28614ac9c8c81e6c86895c834897d9401a7bb14d

SHA256
7dee5d5355599fd25903306b4868e5ad9f0c825e4d9589bc3ebf16020ee140f4

SHA512
94e1cbd82be09ea4316e5a4eaf7b3c439b811e1b8748dfc93a4165915d6b46fd076d15e641b19f27b6ca2f8fbe9257eec889b202ad367fe21b3086fc4e613031

Download Submit
\Users\Admin\AppData\Local\Temp\build.exe
Filesize
5.3MB

MD5
b069f6439d9d415ed13122529479bfca

SHA1
0ed5485647d52ce4160737244d15d1beade0fa87

SHA256
c207aec56d9b2369dbf6d6d6d585ac6006937002b4d9791d675a04bb7b4b5af4

SHA512
d75bfd3d873f2af8cb80f97a3b9583a7750515a11f31ce6ae477e8a526aa6c9db191ae08a100c16b6c1ab8d01661275c62732df13eb65c4dc5b1700a5110572a

Download Submit
\Users\Admin\AppData\Local\Temp\gentee0E\guig.dll
Filesize
20KB

MD5
d3f8c0334c19198a109e44d074dac5fd

SHA1
167716989a62b25e9fcf8e20d78e390a52e12077

SHA256
005c251c21d6a5ba1c3281e7b9f3b4f684d007e0c3486b34a545bb370d8420aa

SHA512
9c890e0af5b20ce9db4284e726ec0b05b2a9f18b909fb8e595edf3348a8f0d07d5238d85446a09e72e4faa2e2875beb52742d312e5163f48df4072b982801b51

Download Submit
\Users\Admin\AppData\Local\Temp\genteert.dll
Filesize
60KB

MD5
6ce814fd1ad7ae07a9e462c26b3a0f69

SHA1
15f440c2a8498a4efe2d9ba0c6268fab4fb8e0a7

SHA256
54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831

SHA512
e5cff6bcb063635e5193209b94a9b2f5465f1c82394f23f50bd30bf0a2b117b209f5fca5aa10a7912a94ad88711dcd490aa528a7202f09490acd96cd640a3556

Download Submit
\WindowsUpdate\WindowsUpdate.exe
Filesize
2.7MB

MD5
0b87d00f10456b51ada70c1b7807338a

SHA1
f55e241151a8c6c2efc69f4e7632b6c5fadc0029

SHA256
4e4816037287d21798d7b3d11a3c32bc6b32db6c07ca9af6d3f603b6e77111fa

SHA512
288bb96b3ebfa562cb5907eabb2c3200804286b8b8055a36cfab2f08403e4655125a593455f2d8c13ee486c4ef035ce49b3df8e6c42d52ee98d072a27266c8d8

Download Submit
memory/432-173-0x000007FEBEDF0000-0x000007FEBEE00000-memory.dmp

Filesize
64KB

Download
memory/432-169-0x0000000000BF0000-0x0000000000C14000-memory.dmp

Filesize
144KB

Download
memory/432-171-0x0000000000BF0000-0x0000000000C14000-memory.dmp

Filesize
144KB

Download
memory/432-172-0x0000000000D30000-0x0000000000D5B000-memory.dmp

Filesize
172KB

Download
memory/432-174-0x0000000037A70000-0x0000000037A80000-memory.dmp

Filesize
64KB

Download
memory/476-181-0x0000000037A70000-0x0000000037A80000-memory.dmp

Filesize
64KB

Download
memory/476-180-0x000007FEBEDF0000-0x000007FEBEE00000-memory.dmp

Filesize
64KB

Download
memory/476-179-0x0000000000220000-0x000000000024B000-memory.dmp

Filesize
172KB

Download
memory/492-186-0x00000000000C0000-0x00000000000EB000-memory.dmp

Filesize
172KB

Download
memory/492-190-0x000007FEBEDF0000-0x000007FEBEE00000-memory.dmp

Filesize
64KB

Download
memory/492-191-0x0000000037A70000-0x0000000037A80000-memory.dmp

Filesize
64KB

Download
memory/608-432-0x000000001A1E0000-0x000000001A4C2000-memory.dmp

Filesize
2.9MB

Download
memory/608-433-0x0000000000410000-0x0000000000418000-memory.dmp

Filesize
32KB

Download
memory/1560-160-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1560-165-0x0000000077810000-0x000000007792F000-memory.dmp

Filesize
1.1MB

Download
memory/1560-166-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1560-159-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1560-163-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1560-158-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1560-162-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1560-164-0x0000000077A30000-0x0000000077BD9000-memory.dmp

Filesize
1.7MB

Download
memory/1720-141-0x0000000000240000-0x000000000024E000-memory.dmp

Filesize
56KB

Download
memory/1720-69-0x0000000000E30000-0x00000000010EE000-memory.dmp

Filesize
2.7MB

Download
memory/1908-139-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/1908-138-0x0000000003110000-0x0000000003581000-memory.dmp

Filesize
4.4MB

Download
memory/1908-137-0x0000000003110000-0x0000000003581000-memory.dmp

Filesize
4.4MB

Download
memory/1908-136-0x0000000003110000-0x0000000003581000-memory.dmp

Filesize
4.4MB

Download
memory/1908-135-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/2568-155-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2568-156-0x0000000002250000-0x0000000002258000-memory.dmp

Filesize
32KB

Download
memory/2676-50-0x0000000000FB0000-0x0000000001028000-memory.dmp

Filesize
480KB

Download
memory/2716-32-0x0000000000400000-0x0000000001BE6000-memory.dmp

Filesize
23.9MB

Download