dcrat | bfa0c423e604775804fc07a8da4ca2c01bc2b6be1fc18b9546bcf04b8872cdca

Analysis

max time kernel
20s
max time network
26s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9.exe
Size

2.7MB
MD5

22acd327c5273659a31e56d94cefed20
SHA1

0c3534ab1f3f2fbc3b2410b50c0bd3450e8b7e20
SHA256

b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9
SHA512

046edff80da24dd5a8a4717c8f4059967faea2d82b45270e93c1386ca7ac27031aad61ce7552a26aef1ae1c59afad969602f1f72ae497817500ff6b43f605724
SSDEEP

49152:fcg4fLmoCxQVw7OocLXGQ7xEnei4LnuINVRtEOmksWP1gPJ:fr4fLmdWzxLB7ineruitaRWmPJ

Score

10^/10

dcrat evasion infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	412	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2736	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	2736	schtasks.exe	33

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000018bd4-11.dat	dcrat
behavioral1/memory/1476-15-0x0000000001020000-0x0000000001158000-memory.dmp	dcrat
behavioral1/memory/792-48-0x0000000001300000-0x0000000001438000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
1476	hyperIntoruntime.exe
792	dllhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2236	cmd.exe
2236	cmd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3004	b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\Idle.exe	hyperIntoruntime.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\6ccacd8608530f	hyperIntoruntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2504	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
412	schtasks.exe
2980	schtasks.exe
2660	schtasks.exe
912	schtasks.exe
2592	schtasks.exe
2640	schtasks.exe
2572	schtasks.exe
2120	schtasks.exe
2876	schtasks.exe
1016	schtasks.exe
892	schtasks.exe
804	schtasks.exe
1260	schtasks.exe
2100	schtasks.exe
928	schtasks.exe
976	schtasks.exe
456	schtasks.exe
1156	schtasks.exe
2860	schtasks.exe
1128	schtasks.exe
2104	schtasks.exe
3016	schtasks.exe
836	schtasks.exe
2924	schtasks.exe
2636	schtasks.exe
2000	schtasks.exe
1996	schtasks.exe
2608	schtasks.exe
1688	schtasks.exe
2856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1476	hyperIntoruntime.exe
1476	hyperIntoruntime.exe
1476	hyperIntoruntime.exe
1476	hyperIntoruntime.exe
1476	hyperIntoruntime.exe
792	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	hyperIntoruntime.exe
Token: SeDebugPrivilege	792	dllhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3004	b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2348	3004	b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9.exe	29
PID 3004 wrote to memory of 2348	3004	b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9.exe	29
PID 3004 wrote to memory of 2348	3004	b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9.exe	29
PID 3004 wrote to memory of 2348	3004	b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9.exe	29
PID 2348 wrote to memory of 2236	2348	WScript.exe	30
PID 2348 wrote to memory of 2236	2348	WScript.exe	30
PID 2348 wrote to memory of 2236	2348	WScript.exe	30
PID 2348 wrote to memory of 2236	2348	WScript.exe	30
PID 2236 wrote to memory of 1476	2236	cmd.exe	32
PID 2236 wrote to memory of 1476	2236	cmd.exe	32
PID 2236 wrote to memory of 1476	2236	cmd.exe	32
PID 2236 wrote to memory of 1476	2236	cmd.exe	32
PID 1476 wrote to memory of 2164	1476	hyperIntoruntime.exe	64
PID 1476 wrote to memory of 2164	1476	hyperIntoruntime.exe	64
PID 1476 wrote to memory of 2164	1476	hyperIntoruntime.exe	64
PID 2164 wrote to memory of 236	2164	cmd.exe	66
PID 2164 wrote to memory of 236	2164	cmd.exe	66
PID 2164 wrote to memory of 236	2164	cmd.exe	66
PID 2236 wrote to memory of 2504	2236	cmd.exe	67
PID 2236 wrote to memory of 2504	2236	cmd.exe	67
PID 2236 wrote to memory of 2504	2236	cmd.exe	67
PID 2236 wrote to memory of 2504	2236	cmd.exe	67
PID 2164 wrote to memory of 792	2164	cmd.exe	68
PID 2164 wrote to memory of 792	2164	cmd.exe	68
PID 2164 wrote to memory of 792	2164	cmd.exe	68

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9.exe
"C:\Users\Admin\AppData\Local\Temp\b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providerReviewperfsvc\82mN47a0TiFi3a9eGnk.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providerReviewperfsvc\jW8bFRH7MHNFa6gk2NSgaGKIpk.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\providerReviewperfsvc\hyperIntoruntime.exe
      "C:\providerReviewperfsvc\hyperIntoruntime.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\deoo4TtbGV.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2164
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:236
      - C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\dllhost.exe
        
        "C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\dllhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:792
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\providerReviewperfsvc\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providerReviewperfsvc\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\providerReviewperfsvc\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Application Data\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Application Data\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\providerReviewperfsvc\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providerReviewperfsvc\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\providerReviewperfsvc\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\deoo4TtbGV.bat

Filesize
225B

MD5
26d32bedefd61759ae2f18e6b6b4ad17

SHA1
736b917362d6c586848bf263202e251311580fe4

SHA256
6afd59baf02b49fe25d45fc93e6aea091ce09d813196fc1c07355a2ff8ccba56

SHA512
2b1b4291e9cd47db6b3a0db08d0e3352658d6820203b1519d63543c65c248b71f773765d4352a5bbe0f8eea67f0c014b18c787ef62fab5387afe146d3d99e2e6

Download Submit
C:\providerReviewperfsvc\82mN47a0TiFi3a9eGnk.vbe

Filesize
235B

MD5
fb11cc210ba0447a34647e724e8ab39d

SHA1
8d99ce75967a91b93d50d1125c2688aae2831318

SHA256
577cbff67180bfc384ac423878600c776a62e2c17d0a54bb5d84fb3f242eff7d

SHA512
5b920ec51d114db6ff6fec4893c438d26fc29d3f785a8976377ebdd2d6106ea3f114fbbc5ef1488baaefc202eb23c0c3c2bec2fa4a45439fb98d85e79be38046

Download Submit
C:\providerReviewperfsvc\jW8bFRH7MHNFa6gk2NSgaGKIpk.bat

Filesize
170B

MD5
4745423eb28e951e9b234c245830068f

SHA1
87240696a0553cb46197011e6b734cd21710691a

SHA256
f8fcb0384e78f0368c59200e3be9101a7eaafb5091db0a624d26b67d5d096b84

SHA512
ec7cfc4d61c2b054af2cd2156d18ad8dd0f682911a200284aa077d84cf9c9f050fda75f5cbc6e88273bc9b3e3f1c0cb85b52bb96ee5e8278a2781989808d2213

Download Submit
\providerReviewperfsvc\hyperIntoruntime.exe

Filesize
1.2MB

MD5
ca3ae9ae64643d74d4eaf06f154f272a

SHA1
e0eaf5cb4e0281d0cd0efc33e5fad25c2449442d

SHA256
81c54e77b089f4e527ae6d671b3790721c9aa1984a79d9608032d33036727392

SHA512
5580a4329ca2eba7016f601ff39e0f76167c4baa09ce5c42d5e6f0d494629ce73e91d540b1e78dbb905bb7e71afd61612d64f3bba35461d91ab947568376e95a

Download Submit
memory/792-48-0x0000000001300000-0x0000000001438000-memory.dmp

Filesize
1.2MB

Download
memory/1476-15-0x0000000001020000-0x0000000001158000-memory.dmp

Filesize
1.2MB

Download
memory/1476-16-0x0000000000810000-0x000000000082C000-memory.dmp

Filesize
112KB

Download
memory/1476-17-0x0000000000BB0000-0x0000000000BC6000-memory.dmp

Filesize
88KB

Download
memory/1476-18-0x0000000000660000-0x000000000066E000-memory.dmp

Filesize
56KB

Download
memory/1476-19-0x0000000000D30000-0x0000000000D38000-memory.dmp

Filesize
32KB

Download
memory/3004-0-0x0000000000E80000-0x00000000012D6000-memory.dmp

Filesize
4.3MB

Download
memory/3004-8-0x0000000000E80000-0x00000000012D6000-memory.dmp

Filesize
4.3MB

Download