File name:

physmeme.exe

Full analysis: https://app.any.run/tasks/2f13aca6-9b2a-46d6-b313-a9da2c28c84f
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: April 18, 2025, 18:26:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-sch
dcrat
rat
remote
darkcrystal
netreactor
wmi-base64
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

1D6941FBE47AA24E563EAAD080F6D13A

SHA1:

438D9A13439A4BD5939F0DC7D5A8A252E802236A

SHA256:

CA3EF84162BCBF7D8BA6FBE39AB1B64AC743291C967005AC739F8E6BAEE91E32

SSDEEP:

98304:Oyi35u+k135WoUm6vqqkbxFQ8SVCIKtItQdbNFnJde9Cn0jllOJp8c9Cjl+:L4GR8o

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 7488)

    • DCRAT mutex has been found

      • Winver.exe (PID: 7632)
      • StartMenuExperienceHost.exe (PID: 5720)
      • upfc.exe (PID: 5892)
      • dllhost.exe (PID: 3100)
      • dllhost.exe (PID: 2148)
      • dasHost.exe (PID: 680)
      • Winver.exe (PID: 920)
      • Winver.exe (PID: 6436)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)
      • upfc.exe (PID: 7876)

    • DCRAT has been detected (YARA)

      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)

    • DARKCRYSTAL has been detected (SURICATA)

      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)
      • upfc.exe (PID: 7876)

    • Connects to the CnC server

      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)
      • upfc.exe (PID: 7876)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • physmeme.exe (PID: 7444)
      • Winver.exe (PID: 7632)
      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)
      • upfc.exe (PID: 7876)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 7488)
      • Winver.exe (PID: 7632)
      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 7488)
      • Winver.exe (PID: 7632)
      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7488)

    • Reads security settings of Internet Explorer

      • physmeme.exe (PID: 7444)
      • Winver.exe (PID: 7632)
      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)
      • upfc.exe (PID: 7876)

    • The process creates files with name similar to system file names

      • Winver.exe (PID: 7632)

    • Executed via WMI

      • schtasks.exe (PID: 7772)
      • schtasks.exe (PID: 7804)
      • schtasks.exe (PID: 7832)
      • schtasks.exe (PID: 7924)
      • schtasks.exe (PID: 7256)
      • schtasks.exe (PID: 7988)
      • schtasks.exe (PID: 8136)
      • schtasks.exe (PID: 8052)
      • schtasks.exe (PID: 8108)
      • schtasks.exe (PID: 8160)
      • schtasks.exe (PID: 6148)
      • schtasks.exe (PID: 2392)
      • schtasks.exe (PID: 6264)
      • schtasks.exe (PID: 7868)
      • schtasks.exe (PID: 7896)
      • schtasks.exe (PID: 7956)
      • schtasks.exe (PID: 8016)
      • schtasks.exe (PID: 8084)

    • Reads the date of Windows installation

      • Winver.exe (PID: 7632)
      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)
      • upfc.exe (PID: 7876)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6300)
      • cmd.exe (PID: 7468)
      • cmd.exe (PID: 7544)
      • cmd.exe (PID: 7932)
      • cmd.exe (PID: 4112)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 6300)
      • cmd.exe (PID: 7544)

    • There is functionality for taking screenshot (YARA)

      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 7468)
      • cmd.exe (PID: 7932)
      • cmd.exe (PID: 4112)

  • INFO

    • Reads the computer name

      • physmeme.exe (PID: 7444)
      • Winver.exe (PID: 7632)
      • upfc.exe (PID: 5892)
      • StartMenuExperienceHost.exe (PID: 5720)
      • dllhost.exe (PID: 3100)
      • dllhost.exe (PID: 2148)
      • dasHost.exe (PID: 680)
      • Winver.exe (PID: 6436)
      • Winver.exe (PID: 920)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)
      • upfc.exe (PID: 7876)

    • Checks supported languages

      • physmeme.exe (PID: 7444)
      • chcp.com (PID: 4988)
      • upfc.exe (PID: 5892)
      • StartMenuExperienceHost.exe (PID: 5720)
      • dllhost.exe (PID: 3100)
      • Winver.exe (PID: 7632)
      • dasHost.exe (PID: 680)
      • Winver.exe (PID: 920)
      • dllhost.exe (PID: 2148)
      • Winver.exe (PID: 6436)
      • chcp.com (PID: 6512)
      • upfc.exe (PID: 5964)
      • chcp.com (PID: 2568)
      • upfc.exe (PID: 7792)
      • chcp.com (PID: 8036)
      • upfc.exe (PID: 8016)
      • chcp.com (PID: 7696)
      • upfc.exe (PID: 7876)

    • Process checks computer location settings

      • physmeme.exe (PID: 7444)
      • Winver.exe (PID: 7632)
      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)
      • upfc.exe (PID: 7876)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • physmeme.exe (PID: 7444)

    • Reads Environment values

      • Winver.exe (PID: 7632)
      • upfc.exe (PID: 5892)
      • StartMenuExperienceHost.exe (PID: 5720)
      • dllhost.exe (PID: 3100)
      • dllhost.exe (PID: 2148)
      • dasHost.exe (PID: 680)
      • Winver.exe (PID: 920)
      • Winver.exe (PID: 6436)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)
      • upfc.exe (PID: 7876)

    • Reads the machine GUID from the registry

      • Winver.exe (PID: 7632)
      • upfc.exe (PID: 5892)
      • StartMenuExperienceHost.exe (PID: 5720)
      • dllhost.exe (PID: 3100)
      • dllhost.exe (PID: 2148)
      • dasHost.exe (PID: 680)
      • Winver.exe (PID: 920)
      • Winver.exe (PID: 6436)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)
      • upfc.exe (PID: 7876)

    • Creates files in the program directory

      • Winver.exe (PID: 7632)

    • Failed to create an executable file in Windows directory

      • Winver.exe (PID: 7632)

    • Create files in a temporary directory

      • Winver.exe (PID: 7632)
      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)
      • upfc.exe (PID: 7876)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6300)
      • cmd.exe (PID: 7468)
      • cmd.exe (PID: 7544)
      • cmd.exe (PID: 7932)
      • cmd.exe (PID: 4112)

    • Manual execution by a user

      • upfc.exe (PID: 5892)
      • StartMenuExperienceHost.exe (PID: 5720)
      • dllhost.exe (PID: 3100)
      • dasHost.exe (PID: 680)
      • Winver.exe (PID: 920)
      • dllhost.exe (PID: 2148)

    • Disables trace logs

      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)
      • upfc.exe (PID: 7876)

    • Checks proxy server information

      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • slui.exe (PID: 2040)
      • upfc.exe (PID: 8016)
      • upfc.exe (PID: 7876)

    • .NET Reactor protector has been detected

      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)

    • Found Base64 encoded reference to WMI classes (YARA)

      • upfc.exe (PID: 5892)
      • upfc.exe (PID: 5964)
      • upfc.exe (PID: 7792)
      • upfc.exe (PID: 8016)

    • Reads the software policy settings

      • slui.exe (PID: 2040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(5892) upfc.exe
C2 (1)http://bobaprog.ru/cpuserversqlTrafficUniversalUploads
Options
Plugins (2)TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAKX/2QAAAAAAAAAAOAAIiALAQgAAEYBAAAGAAAAAAAA7mUBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAm0ACAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
C2 (1)http://bobaprog.ru/cpuserversqlTrafficUniversalUploads
(PID) Process(5964) upfc.exe
C2 (1)http://bobaprog.ru/cpuserversqlTrafficUniversalUploads
Options
Plugins (2)TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAKX/2QAAAAAAAAAAOAAIiALAQgAAEYBAAAGAAAAAAAA7mUBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAm0ACAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
C2 (1)http://bobaprog.ru/cpuserversqlTrafficUniversalUploads
(PID) Process(7792) upfc.exe
C2 (1)http://bobaprog.ru/cpuserversqlTrafficUniversalUploads
Options
Plugins (2)TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAKX/2QAAAAAAAAAAOAAIiALAQgAAEYBAAAGAAAAAAAA7mUBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAm0ACAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
C2 (1)http://bobaprog.ru/cpuserversqlTrafficUniversalUploads
(PID) Process(8016) upfc.exe
C2 (1)http://bobaprog.ru/cpuserversqlTrafficUniversalUploads
Options
Plugins (2)TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAKX/2QAAAAAAAAAAOAAIiALAQgAAEYBAAAGAAAAAAAA7mUBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAm0ACAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
C2 (1)http://bobaprog.ru/cpuserversqlTrafficUniversalUploads
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 13:15:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 261632
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
175
Monitored processes
56
Malicious processes
20
Suspicious processes
1

Behavior graph

Click at the process to see the details
start physmeme.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs #DCRAT winver.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT upfc.exe #DCRAT startmenuexperiencehost.exe no specs #DCRAT dllhost.exe no specs #DCRAT dllhost.exe no specs #DCRAT dashost.exe no specs #DCRAT winver.exe no specs #DCRAT winver.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT upfc.exe slui.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT upfc.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT upfc.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT upfc.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
680C:\Users\Default\Videos\dasHost.exeC:\Users\Default\Videos\dasHost.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\users\default\videos\dashost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
920C:\ESD\Winver.exeC:\ESD\Winver.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\esd\winver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1116ping -n 10 localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\dnsapi.dll
1188ping -n 10 localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\dnsapi.dll
2040C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2148"C:\Users\All Users\Adobe\ARM\S\dllhost.exe"C:\ProgramData\Adobe\ARM\S\dllhost.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\programdata\adobe\arm\s\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2392schtasks.exe /create /tn "Winver" /sc ONLOGON /tr "'C:\ESD\Winver.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2420w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Time Service Diagnostic Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\w32tm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
2568chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
Total events
15 714
Read events
15 697
Write events
17
Delete events
0

Modification events

(PID) Process:(7444) physmeme.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(7632) Winver.exeKey:HKEY_CURRENT_USER\SOFTWARE\666d515c947e33fc2a0cd2f5d3765fadfd5063e9
Operation:writeName:eb9647df1c0248051947eebe2bc18e2a4e9612b4
Value:
H4sIAAAAAAAEAItWcraKiXENdomJScnJycgvLtFLrUhV0kEIlxakJSOJhRanFhXHxLikpiWW5pTExIRlpqTmAwVSEos9UHVDVTrm5CjAmCn5SalAKsg3JiYYp4XBJYlFJb6peaWuFQWpRZmpecmpHliUhWfmlaUWgUVjAfvYai3GAAAA
(PID) Process:(5892) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5892) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5892) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5892) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5892) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5892) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5892) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5892) upfc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\upfc_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
24
Suspicious files
1
Text files
19
Unknown types
0

Dropped files

PID
Process
Filename
Type
7632Winver.exeC:\Users\admin\Desktop\SdIcizfU.logexecutable
MD5:E9CE850DB4350471A62CC24ACB83E859
SHA256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
7632Winver.exeC:\Users\admin\Desktop\JzznyGPn.logexecutable
MD5:F4B38D0F95B7E844DD288B441EBC9AAF
SHA256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
7632Winver.exeC:\Users\Default\Videos\21b1a557fd31cctext
MD5:EBAC7510F344A06A8F440942572BBF16
SHA256:7ABAA376C06982C0291AEEE70A90B2F945AD180C3BF7AB49797F192E3ADF8BEA
7632Winver.exeC:\ESD\55b276f4edf653text
MD5:3F3C02AAB58565ED61D940CCC2853208
SHA256:D8551DF2B1F5DD366F01AFBFBC5BD1E0195E3B0DB3E4FD54A5FA6ACD1AABA77B
7632Winver.exeC:\Users\admin\Desktop\GsCedoVr.logexecutable
MD5:D8BF2A0481C0A17A634D066A711C12E9
SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
7632Winver.exeC:\ProgramData\Adobe\ARM\S\5940a34987c991text
MD5:8203B12C0A91FF5D8A3B0EAA36C41DFA
SHA256:9DA0130D7BAF0113818EABB98A1F7D31B7FFF720FBE478149FA331D96DE5EEC6
7632Winver.exeC:\ESD\StartMenuExperienceHost.exeexecutable
MD5:B5C4FA68D74AB47092A46241D6B10A16
SHA256:20E9DAFAA42A6B6122ECC150622CF8AABE7A324527DF144561DE5BA0B486AB2A
7632Winver.exeC:\ProgramData\Adobe\ARM\S\dllhost.exeexecutable
MD5:B5C4FA68D74AB47092A46241D6B10A16
SHA256:20E9DAFAA42A6B6122ECC150622CF8AABE7A324527DF144561DE5BA0B486AB2A
7632Winver.exeC:\Users\Default\Videos\dasHost.exeexecutable
MD5:B5C4FA68D74AB47092A46241D6B10A16
SHA256:20E9DAFAA42A6B6122ECC150622CF8AABE7A324527DF144561DE5BA0B486AB2A
7632Winver.exeC:\ESD\upfc.exeexecutable
MD5:B5C4FA68D74AB47092A46241D6B10A16
SHA256:20E9DAFAA42A6B6122ECC150622CF8AABE7A324527DF144561DE5BA0B486AB2A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
51
DNS requests
15
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5892
upfc.exe
POST
—
188.130.90.166:80
http://bobaprog.ru/cpuserversqlTrafficUniversalUploads.php
unknown
—
—
malicious
—
—
GET
304
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7192
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
20.3.187.198:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
7192
SIHClient.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7192
SIHClient.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
7192
SIHClient.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7192
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7192
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7192
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5892
upfc.exe
188.130.90.166:80
bobaprog.ru
CTS Computers and Telecommunications Systems SAS
FR
malicious
7192
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7192
SIHClient.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7192
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7192
SIHClient.exe
20.3.187.198:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
bobaprog.ru
  • 188.130.90.166
malicious
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.166
  • 23.48.23.173
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.30
whitelisted

Threats

PID
Process
Class
Message
5892
upfc.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
5892
upfc.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
5964
upfc.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
5964
upfc.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
7792
upfc.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
7792
upfc.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
8016
upfc.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
8016
upfc.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
7876
upfc.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
7876
upfc.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
physmeme.exe