dcrat | 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe
Size

23.9MB
MD5

585d78b9ffc988d345e7a2a0ee119111
SHA1

65b5c6a6c72a845d5610d82ca2aa9a301a907e43
SHA256

82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661
SHA512

574c1f9ecaaeee0cc7afb989e3c3d309beedf3b114fbbb0aa491a285d94e27b4e87626a109805d06edcace458441189cc2dbcd17588c670ce8788c9e8e3a9772
SSDEEP

393216:849/fUrtpuKs+JINSpjQNjqsVsUzpX/Swl6YdecNbLX3IjD4BzB/RLG0jV7ZIfue:cBZs+JIgpjQosVRlKwlOq/X2EtF9IGe

Score

10^/10

dcrat zgrat discovery evasion execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2644-41-0x0000000000400000-0x0000000001BE6000-memory.dmp	family_zgrat_v1

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection	svchost.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0030000000014f57-10.dat	dcrat
behavioral1/memory/2644-41-0x0000000000400000-0x0000000001BE6000-memory.dmp	dcrat
behavioral1/files/0x0007000000015ae3-148.dat	dcrat
behavioral1/memory/668-149-0x0000000000900000-0x0000000000BBE000-memory.dmp	dcrat

Detects executables packed with unregistered version of .NET Reactor 3 IoCs

resource	yara_rule
behavioral1/files/0x00080000000153ee-19.dat	INDICATOR_EXE_Packed_DotNetReactor
behavioral1/memory/2492-35-0x00000000009A0000-0x0000000000A18000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor
behavioral1/memory/2644-41-0x0000000000400000-0x0000000001BE6000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2884	powershell.exe
632	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	build.exe
File created	C:\Windows\system32\drivers\etc\hosts	WinUpdater.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinUpdater\ImagePath = "C:\\ProgramData\\WindowsUpdate\\WinUpdater.exe"	services.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x00080000000153ee-19.dat	net_reactor
behavioral1/memory/2492-35-0x00000000009A0000-0x0000000000A18000-memory.dmp	net_reactor
behavioral1/memory/2644-41-0x0000000000400000-0x0000000001BE6000-memory.dmp	net_reactor

Executes dropped EXE 8 IoCs

pid	Process
2940	build.exe
2572	DCRatBuild.exe
2492	323.exe
2540	MVPInstaller.exe
2812	MVPInstaller.exe
644	MVPInstaller.exe
668	WindowsUpdate.exe
972	WinUpdater.exe

Loads dropped DLL 24 IoCs

pid	Process
2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe
2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe
2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe
2572	DCRatBuild.exe
2572	DCRatBuild.exe
2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe
2492	323.exe
2492	323.exe
2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe
2540	MVPInstaller.exe
2540	MVPInstaller.exe
2540	MVPInstaller.exe
2540	MVPInstaller.exe
2540	MVPInstaller.exe
2812	MVPInstaller.exe
644	MVPInstaller.exe
644	MVPInstaller.exe
644	MVPInstaller.exe
644	MVPInstaller.exe
644	MVPInstaller.exe
1420	cmd.exe
1420	cmd.exe
480	services.exe
480	services.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	build.exe
File created	C:\Windows\system32\perfc010.dat	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WMIADAP.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe
File created	C:\Windows\system32\perfh00C.dat	WMIADAP.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	WinUpdater.exe
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File created	C:\Windows\system32\perfc007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh010.dat	WMIADAP.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx	svchost.exe
File created	C:\Windows\system32\perfc009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc011.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh011.dat	WMIADAP.EXE

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2940 set thread context of 1804	2940	build.exe	46
PID 972 set thread context of 1524	972	WinUpdater.exe	64
PID 972 set thread context of 556	972	WinUpdater.exe	65
PID 972 set thread context of 2160	972	WinUpdater.exe	67

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\appcompat\programs\RecentFileCache.bcf	svchost.exe
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File created	C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini	WMIADAP.EXE
File created	C:\Windows\wusa.lock	wusa.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2480	sc.exe
1692	sc.exe
3068	sc.exe
1320	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 507aedf30aa4da01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	dialer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2632	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2540	MVPInstaller.exe
2540	MVPInstaller.exe
2540	MVPInstaller.exe
2492	323.exe
2940	build.exe
2884	powershell.exe
2940	build.exe
2940	build.exe
2940	build.exe
1804	dialer.exe
1804	dialer.exe
1804	dialer.exe
1804	dialer.exe
2940	build.exe
1804	dialer.exe
1804	dialer.exe
2940	build.exe
2940	build.exe
2940	build.exe
1804	dialer.exe
1804	dialer.exe
972	WinUpdater.exe
1804	dialer.exe
1804	dialer.exe
1804	dialer.exe
1804	dialer.exe
632	powershell.exe
1804	dialer.exe
1804	dialer.exe
1804	dialer.exe
1804	dialer.exe
972	WinUpdater.exe
972	WinUpdater.exe
972	WinUpdater.exe
1804	dialer.exe
1804	dialer.exe
972	WinUpdater.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe
1524	dialer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2492	323.exe
Token: SeDebugPrivilege	2540	MVPInstaller.exe
Token: SeDebugPrivilege	668	WindowsUpdate.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	2940	build.exe
Token: SeDebugPrivilege	1804	dialer.exe
Token: SeAuditPrivilege	876	svchost.exe
Token: SeDebugPrivilege	632	powershell.exe
Token: SeDebugPrivilege	972	WinUpdater.exe
Token: SeDebugPrivilege	1524	dialer.exe
Token: SeLockMemoryPrivilege	2160	dialer.exe
Token: SeAssignPrimaryTokenPrivilege	876	svchost.exe
Token: SeIncreaseQuotaPrivilege	876	svchost.exe
Token: SeSecurityPrivilege	876	svchost.exe
Token: SeTakeOwnershipPrivilege	876	svchost.exe
Token: SeLoadDriverPrivilege	876	svchost.exe
Token: SeSystemtimePrivilege	876	svchost.exe
Token: SeBackupPrivilege	876	svchost.exe
Token: SeRestorePrivilege	876	svchost.exe
Token: SeShutdownPrivilege	876	svchost.exe
Token: SeSystemEnvironmentPrivilege	876	svchost.exe
Token: SeUndockPrivilege	876	svchost.exe
Token: SeManageVolumePrivilege	876	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	876	svchost.exe
Token: SeIncreaseQuotaPrivilege	876	svchost.exe
Token: SeSecurityPrivilege	876	svchost.exe
Token: SeTakeOwnershipPrivilege	876	svchost.exe
Token: SeLoadDriverPrivilege	876	svchost.exe
Token: SeSystemtimePrivilege	876	svchost.exe
Token: SeBackupPrivilege	876	svchost.exe
Token: SeRestorePrivilege	876	svchost.exe
Token: SeShutdownPrivilege	876	svchost.exe
Token: SeSystemEnvironmentPrivilege	876	svchost.exe
Token: SeUndockPrivilege	876	svchost.exe
Token: SeManageVolumePrivilege	876	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	876	svchost.exe
Token: SeIncreaseQuotaPrivilege	876	svchost.exe
Token: SeSecurityPrivilege	876	svchost.exe
Token: SeTakeOwnershipPrivilege	876	svchost.exe
Token: SeLoadDriverPrivilege	876	svchost.exe
Token: SeSystemtimePrivilege	876	svchost.exe
Token: SeBackupPrivilege	876	svchost.exe
Token: SeRestorePrivilege	876	svchost.exe
Token: SeShutdownPrivilege	876	svchost.exe
Token: SeSystemEnvironmentPrivilege	876	svchost.exe
Token: SeUndockPrivilege	876	svchost.exe
Token: SeManageVolumePrivilege	876	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	876	svchost.exe
Token: SeIncreaseQuotaPrivilege	876	svchost.exe
Token: SeSecurityPrivilege	876	svchost.exe
Token: SeTakeOwnershipPrivilege	876	svchost.exe
Token: SeLoadDriverPrivilege	876	svchost.exe
Token: SeSystemtimePrivilege	876	svchost.exe
Token: SeBackupPrivilege	876	svchost.exe
Token: SeRestorePrivilege	876	svchost.exe
Token: SeShutdownPrivilege	876	svchost.exe
Token: SeSystemEnvironmentPrivilege	876	svchost.exe
Token: SeUndockPrivilege	876	svchost.exe
Token: SeManageVolumePrivilege	876	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	876	svchost.exe
Token: SeIncreaseQuotaPrivilege	876	svchost.exe
Token: SeSecurityPrivilege	876	svchost.exe
Token: SeTakeOwnershipPrivilege	876	svchost.exe
Token: SeLoadDriverPrivilege	876	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
644	MVPInstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2940	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	28
PID 2644 wrote to memory of 2940	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	28
PID 2644 wrote to memory of 2940	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	28
PID 2644 wrote to memory of 2940	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	28
PID 2644 wrote to memory of 2572	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	29
PID 2644 wrote to memory of 2572	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	29
PID 2644 wrote to memory of 2572	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	29
PID 2644 wrote to memory of 2572	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	29
PID 2644 wrote to memory of 2572	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	29
PID 2644 wrote to memory of 2572	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	29
PID 2644 wrote to memory of 2572	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	29
PID 2644 wrote to memory of 2492	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	30
PID 2644 wrote to memory of 2492	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	30
PID 2644 wrote to memory of 2492	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	30
PID 2644 wrote to memory of 2492	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	30
PID 2644 wrote to memory of 2492	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	30
PID 2644 wrote to memory of 2492	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	30
PID 2644 wrote to memory of 2492	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	30
PID 2572 wrote to memory of 2408	2572	DCRatBuild.exe	31
PID 2572 wrote to memory of 2408	2572	DCRatBuild.exe	31
PID 2572 wrote to memory of 2408	2572	DCRatBuild.exe	31
PID 2572 wrote to memory of 2408	2572	DCRatBuild.exe	31
PID 2572 wrote to memory of 2408	2572	DCRatBuild.exe	31
PID 2572 wrote to memory of 2408	2572	DCRatBuild.exe	31
PID 2572 wrote to memory of 2408	2572	DCRatBuild.exe	31
PID 2644 wrote to memory of 2540	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	32
PID 2644 wrote to memory of 2540	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	32
PID 2644 wrote to memory of 2540	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	32
PID 2644 wrote to memory of 2540	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	32
PID 2644 wrote to memory of 2540	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	32
PID 2644 wrote to memory of 2540	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	32
PID 2644 wrote to memory of 2540	2644	82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe	32
PID 2540 wrote to memory of 2812	2540	MVPInstaller.exe	33
PID 2540 wrote to memory of 2812	2540	MVPInstaller.exe	33
PID 2540 wrote to memory of 2812	2540	MVPInstaller.exe	33
PID 2540 wrote to memory of 2812	2540	MVPInstaller.exe	33
PID 2540 wrote to memory of 1800	2540	MVPInstaller.exe	34
PID 2540 wrote to memory of 1800	2540	MVPInstaller.exe	34
PID 2540 wrote to memory of 1800	2540	MVPInstaller.exe	34
PID 2540 wrote to memory of 1800	2540	MVPInstaller.exe	34
PID 2540 wrote to memory of 1800	2540	MVPInstaller.exe	34
PID 2540 wrote to memory of 1800	2540	MVPInstaller.exe	34
PID 2540 wrote to memory of 1800	2540	MVPInstaller.exe	34
PID 1800 wrote to memory of 2632	1800	cmd.exe	36
PID 1800 wrote to memory of 2632	1800	cmd.exe	36
PID 1800 wrote to memory of 2632	1800	cmd.exe	36
PID 1800 wrote to memory of 2632	1800	cmd.exe	36
PID 1800 wrote to memory of 2632	1800	cmd.exe	36
PID 1800 wrote to memory of 2632	1800	cmd.exe	36
PID 1800 wrote to memory of 2632	1800	cmd.exe	36
PID 2812 wrote to memory of 644	2812	MVPInstaller.exe	37
PID 2812 wrote to memory of 644	2812	MVPInstaller.exe	37
PID 2812 wrote to memory of 644	2812	MVPInstaller.exe	37
PID 2408 wrote to memory of 1420	2408	WScript.exe	39
PID 2408 wrote to memory of 1420	2408	WScript.exe	39
PID 2408 wrote to memory of 1420	2408	WScript.exe	39
PID 2408 wrote to memory of 1420	2408	WScript.exe	39
PID 2408 wrote to memory of 1420	2408	WScript.exe	39
PID 2408 wrote to memory of 1420	2408	WScript.exe	39
PID 2408 wrote to memory of 1420	2408	WScript.exe	39
PID 1420 wrote to memory of 668	1420	cmd.exe	41
PID 1420 wrote to memory of 668	1420	cmd.exe	41
PID 1420 wrote to memory of 668	1420	cmd.exe	41
PID 1420 wrote to memory of 668	1420	cmd.exe	41

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Sets service image path in registry
- Loads dropped DLL
PID:480
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:612
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
    3⤵
    - Checks processor information in registry
    PID:2736
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe -Embedding
    3⤵
    PID:1580
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:696
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  - Modifies security service
  - Drops file in System32 directory
  PID:768
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:840
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1064
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:876
- - C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:632
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:992
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:296
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1124
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1132
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1184
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:2716
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:2744
- C:\ProgramData\WindowsUpdate\WinUpdater.exe
  C:\ProgramData\WindowsUpdate\WinUpdater.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:972
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2232
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Drops file in Windows directory
      PID:2636
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    PID:556
- - C:\Windows\system32\dialer.exe
    dialer.exe
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:2160

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:496

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:504

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1092
- C:\Users\Admin\AppData\Local\Temp\82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe
  "C:\Users\Admin\AppData\Local\Temp\82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:1900
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        Drops file in Windows directory
        
        PID:2856
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1804
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "WinUpdater"
      4⤵
      Launches sc.exe
      PID:1692
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "WinUpdater" binpath= "C:\ProgramData\WindowsUpdate\WinUpdater.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:2480
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:1320
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "WinUpdater"
      4⤵
      Launches sc.exe
      PID:3068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\build.exe"
      4⤵
      PID:2332
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:1164
- - C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\WindowsUpdate\TEUXpnVW2Rogcdt2Uv.vbe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2408
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\WindowsUpdate\2UpMr4oh.bat" "
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1420
      - C:\WindowsUpdate\WindowsUpdate.exe
        
        "C:\WindowsUpdate\WindowsUpdate.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:668
- - C:\Users\Admin\AppData\Local\Temp\323.exe
    "C:\Users\Admin\AppData\Local\Temp\323.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Users\Admin\AppData\Roaming\MVPInstaller\MVPInstaller.exe
      "C:\Users\Admin\AppData\Roaming\MVPInstaller\MVPInstaller.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\MVPInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\MVPInstaller.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:644
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c deldll.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1800
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 -w 1000 127.0.0.1
        5⤵
        Runs ping.exe
        
        PID:2632

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "3643561331701271465-31643907567132824-2117045662-2045248216343988225775743261"
1⤵
PID:1308

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-18737440631787145022-5444072432076163712032642476702949286-1475166623-639709575"
1⤵
PID:2364

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1003671455-188623811019287292701487675901-1770786046286860807-324086160-993486807"
1⤵
PID:1976

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "13630426682003697140-18657866362138406575-13807342651735906021560847598-1735966710"
1⤵
PID:1760

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-11763966081481150489178289313011854198726737363951185951063555247648-61343579"
1⤵
PID:1892

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-3970453181546426011-760925900-567316082046510191-2920985211706301538-1579281749"
1⤵
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\MVPInstaller.exe

Filesize
340KB

MD5
3fb5bd0f25e277240fbad5b91a73c71b

SHA1
28614ac9c8c81e6c86895c834897d9401a7bb14d

SHA256
7dee5d5355599fd25903306b4868e5ad9f0c825e4d9589bc3ebf16020ee140f4

SHA512
94e1cbd82be09ea4316e5a4eaf7b3c439b811e1b8748dfc93a4165915d6b46fd076d15e641b19f27b6ca2f8fbe9257eec889b202ad367fe21b3086fc4e613031

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\app.so

Filesize
4.4MB

MD5
14d0a013e4ba7e748c77d14771f01120

SHA1
fbda934ba5e9864bd6625786b124df624972676b

SHA256
327c7235ddad44cb53f3387948a21a8ada6c776060e512f0d48a704920b1004c

SHA512
7e99c55e0210bd855db91883c74329f78c0bb20c55c80b088a03167670ae56258caf24d5373c896d2ca7120a1b8c174da36436b4aef0df14d8e57ca893bf867d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\AssetManifest.bin

Filesize
751B

MD5
f0ab28955a65dda7ec0745733b8d5704

SHA1
f1323494b94cea4017b553a78c045c19ffd6606f

SHA256
07c3ef8bcee38f84a1e57005a864a4404111fc96195aba4d630c8be969772310

SHA512
82b1be0370788065534d642dc43c01a248fa2cfaa97b4a7db60dda9cdf94d8f3c38f614fb54eef0bcbc332714c05ad4002baed903a826f529c2add1847d70a2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\FontManifest.json

Filesize
499B

MD5
b2f01a90f24be87c4f4ae98e79090bf5

SHA1
ae7107f7e0d5fae6288e8a82cb1c0f67efbc0b3d

SHA256
eb4549732cd13d6c3874351c182ea15850fbf71f219fe1efe9a1cac19b6c9087

SHA512
422af00f1d8835598586687bec6162c52f6eb0234222f855301bceba8dd71a2bc0e720fa4148c360e77a44be97efc587dd3e2bef5c3cdece1a925f7cf93046ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\assets\fonts\Montserrat-Bold.ttf

Filesize
255KB

MD5
88932dadc42e1bba93b21a76de60ef7a

SHA1
3320ff5514b32565b0396de4f2064ce17ec9eea4

SHA256
c4c8cb572a5a2c43d78b3701f4b2349684e6ca4d1557e469af6065b1e099c26c

SHA512
298e1e171dbbe386e1abe153446b883c40910819099f64f54dc9faa95d739be56839537342bbe8dd8408545cb1f8c98878a3524d91af1f11a112d1bfc202657a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\assets\fonts\gothampro_black.ttf

Filesize
39KB

MD5
efb0c02a5dbe65a7115b477e74c7a661

SHA1
e30324f4074bcc522a393cecaa62aa4b0e9205cc

SHA256
270d30776b7e5ccf0560b08e0db009f4b1d9753d43689d1e20bb1065e2a3c157

SHA512
0095fb9b0cd508c996cfdc11374a040ef064a22f188d7fbeb21f23c5f7f06aa2bce75e9ae22ec1c0e0f1b8e23003f67c8e8b5962c224c1295fb311e63a9b91f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\assets\skeleton.gif

Filesize
776KB

MD5
a1f94e106f73bd7ff5d3d36d2eef917d

SHA1
549aa1d500f3754026c2cfd336351802126907ea

SHA256
d400caf56eec5bf44bdbfa754bb7bcb84651293497a59b45b1796df202ab9bfe

SHA512
f65e38fdf3a6215b6de29dd284a1dfb19fc1a6a9e5d8f7c7b47deeafe3d1c3d4e83dce6c9cecf0f004d78e04829d46d1451c857adaa47a983c99ec22f55314be

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\fonts\MaterialIcons-Regular.otf

Filesize
1.6MB

MD5
e7069dfd19b331be16bed984668fe080

SHA1
fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4

SHA256
d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453

SHA512
27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\icudtl.dat

Filesize
798KB

MD5
cf772cf9f6ca67f592fe47da2a15adb1

SHA1
9cc4d99249bdba8a030daf00d98252c8aef7a0ff

SHA256
ac44ccc3f61bf630bb20fb8043d86cfe4c8995d06b460084400db45d70497b30

SHA512
0bec0d3a34a4ac1cc2ed81dba3bc52981c5dd391a68fe21132dfadb70e42ffbe8f3ba798185733d64a900fd2bb2403f9a8558e6666f2c1e2c0e818d8e3f154fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\flutter_windows.dll

Filesize
17.0MB

MD5
2eb35e2372de5fc7fde925c96de61d48

SHA1
a9eedd7cf44a6eab4e08df9ab0b33fd95ceb48fd

SHA256
80efad451cd0b674b9974ef286d29ef72f219999dd8f993585f9168d97895e6f

SHA512
18a03d297770707709fcada8dd0741bd39057d54b49125119ba8b7d21aa67284dece89947dc14721fe3084e69f03e816a2ed9ad79e82ffe279d7fd0a318ff029

Download Submit
C:\Users\Admin\AppData\Local\Temp\deldll.bat

Filesize
200B

MD5
ea190ef9b139757a890cd48bdd44b0ee

SHA1
95c684e41bf7919408816aafab881621fface202

SHA256
9131de0fcaaf968896af9d58b6f37b4aa443455bb97c97bc142f295cee577bc4

SHA512
22802ffc1965c8e27f799ee88e3fa46debb316c27507a570b0812bc5de0d59a9c2a2105b8cc204851b3c29984ef1dfb7842131819952b185b7e4325a032fb6ad

Download Submit
C:\Users\Admin\AppData\Roaming\MVPInstaller\MVPInstaller.exe

Filesize
15.3MB

MD5
91a99c76150f66c4d582ce98f3e3b2c3

SHA1
983fed8f09fe95fb3ca67e884f2f824f0e3a72be

SHA256
61217d7e2be6784784aa6b3b3a23a2777a6eee79be4e6f8d6e3f6b0f10032920

SHA512
2562b594ff224d36d6f7c147326cc929e9790bf75632c4f7e3589dbb58498159a4978f5e48751d13ae5d62f354d541a3156d4f901e6f1983fb9b1f3e3638cf8b

Download Submit
C:\WindowsUpdate\2UpMr4oh.bat

Filesize
36B

MD5
ececcb4dab2899a896f6727230ddb26a

SHA1
7f629cd32f92dc6a8da7142f7de397b08ced0974

SHA256
f7f7150ae59104004cc4bdd36110807333ef0a27c0ce0a08fd0ae2646159f73c

SHA512
10f74f3b64ace8002270e27a450cc26a25502d9c98f8dd23cfa22886368be1d7d7c46cd153fbac88b07bcf0ea401549a5927a8583b612a0e5e2b5aa9162ee592

Download Submit
C:\WindowsUpdate\TEUXpnVW2Rogcdt2Uv.vbe

Filesize
198B

MD5
ea0cabd5fc14e86870ef589016ad6400

SHA1
ebbb0646d34c4973021d08ad37276f54036d1658

SHA256
3f5a8ef3d4412432127feab5637a18b59cb06ec47faefae6f54dfcde27a5cbf7

SHA512
200623fc8cdcbb6acbefcb04334f84453162188cc00d846046ea54db3168a470d8263bce12524809864bdad1d1438890783afac6440670931ea59d1a97fc6a57

Download Submit
C:\WindowsUpdate\WindowsUpdate.exe

Filesize
2.7MB

MD5
0b87d00f10456b51ada70c1b7807338a

SHA1
f55e241151a8c6c2efc69f4e7632b6c5fadc0029

SHA256
4e4816037287d21798d7b3d11a3c32bc6b32db6c07ca9af6d3f603b6e77111fa

SHA512
288bb96b3ebfa562cb5907eabb2c3200804286b8b8055a36cfab2f08403e4655125a593455f2d8c13ee486c4ef035ce49b3df8e6c42d52ee98d072a27266c8d8

Download Submit
C:\Windows\System32\perfc007.dat

Filesize
141KB

MD5
0f3d76321f0a7986b42b25a3aa554f82

SHA1
7036bba62109cc25da5d6a84d22b6edb954987c0

SHA256
dfad62e3372760d303f7337fe290e4cb28e714caadd3c59294b77968d81fe460

SHA512
bb02a3f14d47d233fbda046f61bbf5612ebc6213b156af9c47f56733a03df1bb484d1c3576569eb4499d7b378eb01f4d6e906c36c6f71738482584c2e84b47d0

Download Submit
C:\Windows\System32\perfc00A.dat

Filesize
150KB

MD5
540138285295c68de32a419b7d9de687

SHA1
1cf6a2a0f53f0516ff9fe5ac733dbb5a9255ae56

SHA256
33867c52f756f2b0f645f4bd503c65969d73676dcb14e6a6fdb2ffb11c7562eb

SHA512
7c17c10d4b6165aa0c208811dc6d98e2f4e75e3da1cc2313cc7da9d657626beb3e4ec00b07b71376a7c549725d40db20d8952753e70acc86e87a8390e224a64a

Download Submit
C:\Windows\System32\perfc00C.dat

Filesize
141KB

MD5
831dbe568992299e589143ee8898e131

SHA1
737726173aab8b76fe1f98104d72bb91abd273bf

SHA256
4f22ef1625fb2a2370779d0992f80b8e5e5da8dc727aa99ade152044d28e9405

SHA512
39015d29d593c9df59cdafbff95a6ddc000a5dbf767665b65f8ec65751e70315918c93d3583b922d32e9b6261b8c07023da660098ca79c5420b782c150b5c139

Download Submit
C:\Windows\System32\perfc010.dat

Filesize
142KB

MD5
d73172c6cb697755f87cd047c474cf91

SHA1
abc5c7194abe32885a170ca666b7cce8251ac1d6

SHA256
9de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57

SHA512
7c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6

Download Submit
C:\Windows\System32\perfc011.dat

Filesize
114KB

MD5
1f998386566e5f9b7f11cc79254d1820

SHA1
e1da5fe1f305099b94de565d06bc6f36c6794481

SHA256
1665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea

SHA512
a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f

Download Submit
C:\Windows\System32\perfh007.dat

Filesize
680KB

MD5
b69ab3aeddb720d6ef8c05ff88c23b38

SHA1
d830c2155159656ed1806c7c66cae2a54a2441fa

SHA256
24c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625

SHA512
4c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d

Download Submit
C:\Windows\System32\perfh009.dat

Filesize
634KB

MD5
1c678ee06bd02b5d9e4d51c3a4ec2d2b

SHA1
90aa7fdfaaa37fb4f2edfc8efc3994871087dedb

SHA256
2d168ab31836a08d8ca00aab9685f040aac4052a7f10fbbf0c28e9f880a79dd3

SHA512
ec665d7a20f27b2a0fe2475883009c6d34615cc2046d096de447ef57bcac9da0ae842be0556f5736f42d9c1c601fb8629896a2444990e508f7c573165088ab32

Download Submit
C:\Windows\System32\perfh00A.dat

Filesize
715KB

MD5
340af83514a525c50ffbbf8475ed62b7

SHA1
e2f382ae75afe7df8a323320bbb2aafa1ff6e407

SHA256
fb298e9a90476b4698def395a8ee1974c1cee3959b658662c730da915caea417

SHA512
8236aab579456ef4614ddd5fbfe72d0b0b26617c43a9cd53c3de56d3ac052eee8ca7d70749aaca0692855ecd4fd5f1460ac0b1dd30481dee519b910755c1cc2d

Download Submit
C:\Windows\System32\perfh00C.dat

Filesize
715KB

MD5
718bb9564980029a2e3341093a4bb082

SHA1
8953d96e47b65c2c70f2bcc3d9e2e7c55d41ee61

SHA256
ad7b5314ef00ce846ae2c91a32dd1c1f2b4905cf182005e251ad6d4af66cc977

SHA512
3f22961d108271dc098ae2c75d217991da38c18a587b44abd74da853ea26d171ca1a507c3200f3b7c2a8175bfff5a8b968a551a4804082064dc6f2ef98b5432d

Download Submit
C:\Windows\System32\perfh010.dat

Filesize
722KB

MD5
4623482c106cf6cc1bac198f31787b65

SHA1
5abb0decf7b42ef5daf7db012a742311932f6dad

SHA256
eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349

SHA512
afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f

Download Submit
C:\Windows\System32\perfh011.dat

Filesize
406KB

MD5
54c674d19c0ff72816402f66f6c3d37c

SHA1
2dcc0269545a213648d59dc84916d9ec2d62a138

SHA256
646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5

SHA512
4d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f

Download Submit
C:\Windows\System32\wbem\Performance\WmiApRpl.h

Filesize
3KB

MD5
b133a676d139032a27de3d9619e70091

SHA1
1248aa89938a13640252a79113930ede2f26f1fa

SHA256
ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15

SHA512
c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5

Download Submit
C:\Windows\System32\wbem\Performance\WmiApRpl.ini

Filesize
27KB

MD5
46d08e3a55f007c523ac64dce6dcf478

SHA1
62edf88697e98d43f32090a2197bead7e7244245

SHA256
5b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614

SHA512
b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
2b19df2da3af86adf584efbddd0d31c0

SHA1
f1738910789e169213611c033d83bc9577373686

SHA256
58868a299c5cf1167ed3fbc570a449ecd696406410b24913ddbd0f06a32595bd

SHA512
4a1831f42a486a0ad2deef3d348e7220209214699504e29fdfeb2a6f7f25ad1d353158cd05778f76ef755e77ccd94ce9b4a7504039e439e4e90fa7cde589daa6

Download Submit
\Users\Admin\AppData\Local\Temp\323.exe

Filesize
457KB

MD5
53c1d38049f4318e577c3ab1bcc6e38f

SHA1
0bd051e27c86ef4858c94f2398d64958e130c448

SHA256
ad6baed534549a8eb75f44c05807581e0eb5fde56a8b3a64a741853bcb19a863

SHA512
938bcdfefc9a28bc9d6918db1df487d78c218e2f15e86cbab69f773eb366b1e822d65c2e82c05ff623f3a69981735badc182d67062cd2f7506ccc017ab7fc42d

Download Submit
\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
3.0MB

MD5
caddb11f9014c4b6bd7f79306211899f

SHA1
1cef789bb00aa2bf87ce0b1dc612b577e05f6e7a

SHA256
5be33a975fb052c1a4338ed8deca2641f5a9fa52f2cf3c6fd71b420fff462440

SHA512
fa5c582eb75c6d8dd03f455f328b9ceb5b509f9d0fd659cd7521771940105e9e108c900edbaf685c0b5090825df46cc8c98fd383ce2f08bf74edcdc3546110ea

Download Submit
\Users\Admin\AppData\Local\Temp\MVPInstaller.exe

Filesize
15.1MB

MD5
85059372ceca7eff4ac1642bd631b93e

SHA1
f59d24530e896d688792fa022fda50417722ebd8

SHA256
6e4c820de03c72d71c43d24885b7e1f2462bcced03114b31eac8bccc9ec924c9

SHA512
bfd54c1c39658f97a10b8baf75a83a658e7d7e66afeaf291df6eb77fc0f4b4173850b336d6af1f4992f6918049acf5f747383deecc63b914562bf83cb9f11e5e

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
24KB

MD5
c95635d7b2004d521a004cc73ddc6883

SHA1
7871333c1430cf4fe7ed47038383053c7a832c01

SHA256
ffadbed3c8c4a7bc6bd2f888e14830cc515db1c9b68046d5fd43d32e016a540e

SHA512
475b8de45109c931a38e7ec192e1682c2324e0f4522ce543311ef1965e0819e3bd2fd85dcb7d21547061a656e1ce4d56a328cf4a6735cd3643eaff43810731fc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\msvcp140.dll

Filesize
558KB

MD5
bf78c15068d6671693dfcdfa5770d705

SHA1
4418c03c3161706a4349dfe3f97278e7a5d8962a

SHA256
a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb

SHA512
5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\vcruntime140.dll

Filesize
94KB

MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\vcruntime140_1.dll

Filesize
36KB

MD5
7667b0883de4667ec87c3b75bed84d84

SHA1
e6f6df83e813ed8252614a46a5892c4856df1f58

SHA256
04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d

SHA512
968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

Download Submit
\Users\Admin\AppData\Local\Temp\build.exe

Filesize
5.3MB

MD5
b069f6439d9d415ed13122529479bfca

SHA1
0ed5485647d52ce4160737244d15d1beade0fa87

SHA256
c207aec56d9b2369dbf6d6d6d585ac6006937002b4d9791d675a04bb7b4b5af4

SHA512
d75bfd3d873f2af8cb80f97a3b9583a7750515a11f31ce6ae477e8a526aa6c9db191ae08a100c16b6c1ab8d01661275c62732df13eb65c4dc5b1700a5110572a

Download Submit
\Users\Admin\AppData\Local\Temp\gentee77\guig.dll

Filesize
20KB

MD5
d3f8c0334c19198a109e44d074dac5fd

SHA1
167716989a62b25e9fcf8e20d78e390a52e12077

SHA256
005c251c21d6a5ba1c3281e7b9f3b4f684d007e0c3486b34a545bb370d8420aa

SHA512
9c890e0af5b20ce9db4284e726ec0b05b2a9f18b909fb8e595edf3348a8f0d07d5238d85446a09e72e4faa2e2875beb52742d312e5163f48df4072b982801b51

Download Submit
\Users\Admin\AppData\Local\Temp\genteert.dll

Filesize
60KB

MD5
6ce814fd1ad7ae07a9e462c26b3a0f69

SHA1
15f440c2a8498a4efe2d9ba0c6268fab4fb8e0a7

SHA256
54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831

SHA512
e5cff6bcb063635e5193209b94a9b2f5465f1c82394f23f50bd30bf0a2b117b209f5fca5aa10a7912a94ad88711dcd490aa528a7202f09490acd96cd640a3556

Download Submit
memory/436-171-0x0000000000B70000-0x0000000000B94000-memory.dmp

Filesize
144KB

Download
memory/436-169-0x0000000000B70000-0x0000000000B94000-memory.dmp

Filesize
144KB

Download
memory/436-179-0x0000000000C40000-0x0000000000C6B000-memory.dmp

Filesize
172KB

Download
memory/436-181-0x000007FEBDF60000-0x000007FEBDF70000-memory.dmp

Filesize
64KB

Download
memory/436-183-0x0000000037BC0000-0x0000000037BD0000-memory.dmp

Filesize
64KB

Download
memory/480-196-0x000007FEBDF60000-0x000007FEBDF70000-memory.dmp

Filesize
64KB

Download
memory/480-195-0x0000000000220000-0x000000000024B000-memory.dmp

Filesize
172KB

Download
memory/480-197-0x0000000037BC0000-0x0000000037BD0000-memory.dmp

Filesize
64KB

Download
memory/496-201-0x0000000037BC0000-0x0000000037BD0000-memory.dmp

Filesize
64KB

Download
memory/496-200-0x000007FEBDF60000-0x000007FEBDF70000-memory.dmp

Filesize
64KB

Download
memory/496-199-0x0000000000240000-0x000000000026B000-memory.dmp

Filesize
172KB

Download
memory/632-429-0x0000000001560000-0x0000000001568000-memory.dmp

Filesize
32KB

Download
memory/632-428-0x0000000019F30000-0x000000001A212000-memory.dmp

Filesize
2.9MB

Download
memory/644-131-0x00000000030F0000-0x0000000003561000-memory.dmp

Filesize
4.4MB

Download
memory/644-132-0x00000000030F0000-0x0000000003561000-memory.dmp

Filesize
4.4MB

Download
memory/644-133-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/644-130-0x00000000030F0000-0x0000000003561000-memory.dmp

Filesize
4.4MB

Download
memory/644-129-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/668-150-0x0000000000340000-0x000000000034E000-memory.dmp

Filesize
56KB

Download
memory/668-149-0x0000000000900000-0x0000000000BBE000-memory.dmp

Filesize
2.7MB

Download
memory/696-214-0x00000000003E0000-0x000000000040B000-memory.dmp

Filesize
172KB

Download
memory/1804-163-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1804-160-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1804-165-0x0000000077960000-0x0000000077A7F000-memory.dmp

Filesize
1.1MB

Download
memory/1804-166-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1804-161-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1804-164-0x0000000077B80000-0x0000000077D29000-memory.dmp

Filesize
1.7MB

Download
memory/1804-159-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1804-158-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2492-35-0x00000000009A0000-0x0000000000A18000-memory.dmp

Filesize
480KB

Download
memory/2644-41-0x0000000000400000-0x0000000001BE6000-memory.dmp

Filesize
23.9MB

Download
memory/2884-156-0x0000000002080000-0x0000000002088000-memory.dmp

Filesize
32KB

Download
memory/2884-155-0x000000001B4A0000-0x000000001B782000-memory.dmp

Filesize
2.9MB

Download