dcrat | 741f406af0d9813380255250f41bb4b5202575b0a95a5405b67520f5840393b1

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sirius.exe
Size

2.4MB
MD5

e88e9ba128b0f902f05a24fc524b6642
SHA1

aead6538e5762c1dce5aa5a823e6a897395dfab9
SHA256

741f406af0d9813380255250f41bb4b5202575b0a95a5405b67520f5840393b1
SHA512

276a779d33dcd77c6222c98b5cc3fcbd095216213eb77d4d4b898320b0805729561a7f45d279d54bc7abb16f2f816e531e6dbddf3f95401f0f39d9458b4fc942
SSDEEP

24576:zTbBv5rUFz0sjTfN29w3R97qQqGv53D0pOuAw1sNv2pbP6inu0lPP1Y7QzqF:tBeHYiUm53D0mtv2pZFPPqUzs

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\de-DE\\wininit.exe\", \"C:\\ChainBlockportcomnet\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\audiodg.exe\", \"C:\\Windows\\LiveKernelReports\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\cmd.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\de-DE\\wininit.exe\", \"C:\\ChainBlockportcomnet\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\audiodg.exe\", \"C:\\Windows\\LiveKernelReports\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\cmd.exe\", \"C:\\ChainBlockportcomnet\\HyperFontReview.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\de-DE\\wininit.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\de-DE\\wininit.exe\", \"C:\\ChainBlockportcomnet\\csrss.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\de-DE\\wininit.exe\", \"C:\\ChainBlockportcomnet\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\audiodg.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Sidebar\\de-DE\\wininit.exe\", \"C:\\ChainBlockportcomnet\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\audiodg.exe\", \"C:\\Windows\\LiveKernelReports\\OSPPSVC.exe\""	HyperFontReview.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	2548	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2548	schtasks.exe	35

Executes dropped EXE 12 IoCs

pid	Process
2836	HyperFontReview.exe
780	wininit.exe
2164	wininit.exe
2256	wininit.exe
2372	wininit.exe
1460	wininit.exe
1692	wininit.exe
2392	wininit.exe
1784	wininit.exe
1656	wininit.exe
1152	wininit.exe
2156	wininit.exe

Loads dropped DLL 2 IoCs

pid	Process
2780	cmd.exe
2780	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\cmd.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HyperFontReview = "\"C:\\ChainBlockportcomnet\\HyperFontReview.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Windows Sidebar\\de-DE\\wininit.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\ChainBlockportcomnet\\csrss.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\audiodg.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\audiodg.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Windows\\LiveKernelReports\\OSPPSVC.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Windows Sidebar\\de-DE\\wininit.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\ChainBlockportcomnet\\csrss.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Windows\\LiveKernelReports\\OSPPSVC.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\cmd.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\HyperFontReview = "\"C:\\ChainBlockportcomnet\\HyperFontReview.exe\""	HyperFontReview.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC931E71E4A47741DB92AF8949E2F84842.TMP	csc.exe
File created	\??\c:\Windows\System32\byyuy-.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\de-DE\56085415360792	HyperFontReview.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\audiodg.exe	HyperFontReview.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\42af1c969fbb7b	HyperFontReview.exe
File created	C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe	HyperFontReview.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\LiveKernelReports\OSPPSVC.exe	HyperFontReview.exe
File created	C:\Windows\LiveKernelReports\1610b97d3ab4a7	HyperFontReview.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sirius.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1956	PING.EXE
1632	PING.EXE
2224	PING.EXE
1004	PING.EXE
1700	PING.EXE
2696	PING.EXE
2788	PING.EXE

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
1700	PING.EXE
2696	PING.EXE
2788	PING.EXE
1956	PING.EXE
1632	PING.EXE
2224	PING.EXE
1004	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2452	schtasks.exe
2892	schtasks.exe
848	schtasks.exe
1488	schtasks.exe
2904	schtasks.exe
2776	schtasks.exe
2236	schtasks.exe
3044	schtasks.exe
1444	schtasks.exe
2056	schtasks.exe
1460	schtasks.exe
2796	schtasks.exe
1640	schtasks.exe
2944	schtasks.exe
2616	schtasks.exe
2248	schtasks.exe
1612	schtasks.exe
2124	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe
2836	HyperFontReview.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	HyperFontReview.exe
Token: SeDebugPrivilege	780	wininit.exe
Token: SeDebugPrivilege	2164	wininit.exe
Token: SeDebugPrivilege	2256	wininit.exe
Token: SeDebugPrivilege	2372	wininit.exe
Token: SeDebugPrivilege	1460	wininit.exe
Token: SeDebugPrivilege	1692	wininit.exe
Token: SeDebugPrivilege	2392	wininit.exe
Token: SeDebugPrivilege	1784	wininit.exe
Token: SeDebugPrivilege	1656	wininit.exe
Token: SeDebugPrivilege	1152	wininit.exe
Token: SeDebugPrivilege	2156	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1148	2848	Sirius.exe	31
PID 2848 wrote to memory of 1148	2848	Sirius.exe	31
PID 2848 wrote to memory of 1148	2848	Sirius.exe	31
PID 2848 wrote to memory of 1148	2848	Sirius.exe	31
PID 1148 wrote to memory of 2780	1148	WScript.exe	32
PID 1148 wrote to memory of 2780	1148	WScript.exe	32
PID 1148 wrote to memory of 2780	1148	WScript.exe	32
PID 1148 wrote to memory of 2780	1148	WScript.exe	32
PID 2780 wrote to memory of 2836	2780	cmd.exe	34
PID 2780 wrote to memory of 2836	2780	cmd.exe	34
PID 2780 wrote to memory of 2836	2780	cmd.exe	34
PID 2780 wrote to memory of 2836	2780	cmd.exe	34
PID 2836 wrote to memory of 844	2836	HyperFontReview.exe	39
PID 2836 wrote to memory of 844	2836	HyperFontReview.exe	39
PID 2836 wrote to memory of 844	2836	HyperFontReview.exe	39
PID 844 wrote to memory of 2036	844	csc.exe	41
PID 844 wrote to memory of 2036	844	csc.exe	41
PID 844 wrote to memory of 2036	844	csc.exe	41
PID 2836 wrote to memory of 1608	2836	HyperFontReview.exe	57
PID 2836 wrote to memory of 1608	2836	HyperFontReview.exe	57
PID 2836 wrote to memory of 1608	2836	HyperFontReview.exe	57
PID 1608 wrote to memory of 1652	1608	cmd.exe	59
PID 1608 wrote to memory of 1652	1608	cmd.exe	59
PID 1608 wrote to memory of 1652	1608	cmd.exe	59
PID 1608 wrote to memory of 1004	1608	cmd.exe	60
PID 1608 wrote to memory of 1004	1608	cmd.exe	60
PID 1608 wrote to memory of 1004	1608	cmd.exe	60
PID 1608 wrote to memory of 780	1608	cmd.exe	61
PID 1608 wrote to memory of 780	1608	cmd.exe	61
PID 1608 wrote to memory of 780	1608	cmd.exe	61
PID 780 wrote to memory of 2212	780	wininit.exe	62
PID 780 wrote to memory of 2212	780	wininit.exe	62
PID 780 wrote to memory of 2212	780	wininit.exe	62
PID 2212 wrote to memory of 320	2212	cmd.exe	64
PID 2212 wrote to memory of 320	2212	cmd.exe	64
PID 2212 wrote to memory of 320	2212	cmd.exe	64
PID 2212 wrote to memory of 1748	2212	cmd.exe	65
PID 2212 wrote to memory of 1748	2212	cmd.exe	65
PID 2212 wrote to memory of 1748	2212	cmd.exe	65
PID 2212 wrote to memory of 2164	2212	cmd.exe	66
PID 2212 wrote to memory of 2164	2212	cmd.exe	66
PID 2212 wrote to memory of 2164	2212	cmd.exe	66
PID 2164 wrote to memory of 1736	2164	wininit.exe	67
PID 2164 wrote to memory of 1736	2164	wininit.exe	67
PID 2164 wrote to memory of 1736	2164	wininit.exe	67
PID 1736 wrote to memory of 1600	1736	cmd.exe	69
PID 1736 wrote to memory of 1600	1736	cmd.exe	69
PID 1736 wrote to memory of 1600	1736	cmd.exe	69
PID 1736 wrote to memory of 1700	1736	cmd.exe	70
PID 1736 wrote to memory of 1700	1736	cmd.exe	70
PID 1736 wrote to memory of 1700	1736	cmd.exe	70
PID 1736 wrote to memory of 2256	1736	cmd.exe	71
PID 1736 wrote to memory of 2256	1736	cmd.exe	71
PID 1736 wrote to memory of 2256	1736	cmd.exe	71
PID 2256 wrote to memory of 1168	2256	wininit.exe	72
PID 2256 wrote to memory of 1168	2256	wininit.exe	72
PID 2256 wrote to memory of 1168	2256	wininit.exe	72
PID 1168 wrote to memory of 2000	1168	cmd.exe	74
PID 1168 wrote to memory of 2000	1168	cmd.exe	74
PID 1168 wrote to memory of 2000	1168	cmd.exe	74
PID 1168 wrote to memory of 2696	1168	cmd.exe	75
PID 1168 wrote to memory of 2696	1168	cmd.exe	75
PID 1168 wrote to memory of 2696	1168	cmd.exe	75
PID 1168 wrote to memory of 2372	1168	cmd.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Sirius.exe
"C:\Users\Admin\AppData\Local\Temp\Sirius.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ChainBlockportcomnet\NjC268YrIE3.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\ChainBlockportcomnet\cz7Hmt9rVGQXaOiUvs0kcu0Nht.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\ChainBlockportcomnet\HyperFontReview.exe
      "C:\ChainBlockportcomnet/HyperFontReview.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rotsx3hq\rotsx3hq.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:844
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2DE4.tmp" "c:\Windows\System32\CSC931E71E4A47741DB92AF8949E2F84842.TMP"
        6⤵
        
        PID:2036
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l20ZFicoO9.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1608
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1652
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1004
      - C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe
        
        "C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\daekv7QIWo.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:320
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1748
        
        C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe
        
        "C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sJRdaZOVrD.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1600
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1700
        
        C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe
        
        "C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RXbe2nqO2a.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2000
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2696
        
        C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe
        
        "C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tuGXyMaJvX.bat"
        13⤵
        
        PID:1676
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2248
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2788
        
        C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe
        
        "C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3WpfbLnk5C.bat"
        15⤵
        
        PID:2228
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2776
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1956
        
        C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe
        
        "C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fn6aS0VTUV.bat"
        17⤵
        
        PID:2716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2536
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1632
        
        C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe
        
        "C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dV69F4sOEJ.bat"
        19⤵
        
        PID:1740
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1092
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2204
        
        C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe
        
        "C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lOMsQrAcGI.bat"
        21⤵
        
        PID:320
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2212
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2432
        
        C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe
        
        "C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\inbPLpLC2K.bat"
        23⤵
        
        PID:1604
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2348
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1192
        
        C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe
        
        "C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1152
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q4KhmYWH96.bat"
        25⤵
        
        PID:828
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:936
        
        C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe
        
        "C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DNHOnF8KXH.bat"
        27⤵
        
        PID:2584
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2424
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\de-DE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\ChainBlockportcomnet\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\ChainBlockportcomnet\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\ChainBlockportcomnet\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Windows\LiveKernelReports\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Windows\LiveKernelReports\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperFontReviewH" /sc MINUTE /mo 7 /tr "'C:\ChainBlockportcomnet\HyperFontReview.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperFontReview" /sc ONLOGON /tr "'C:\ChainBlockportcomnet\HyperFontReview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperFontReviewH" /sc MINUTE /mo 6 /tr "'C:\ChainBlockportcomnet\HyperFontReview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ChainBlockportcomnet\NjC268YrIE3.vbe

Filesize
225B

MD5
c116b7f56f9a648b221b2eb1738cc725

SHA1
fa990cef96e5a8566e0ebec696b30ef06beb96b0

SHA256
b3fe07c8d460ec9392585cabac43a635c5022cc58cc805b46ce66fed18736571

SHA512
68f07f604a0cea97cedaac041c61aa4eabf4f41b5901a3affc2a94c1678bc11cc4c6115d7afe3c31cc821053ef0d65562760c0214e720c7ad0f6ec6461673a1e

Download Submit
C:\ChainBlockportcomnet\cz7Hmt9rVGQXaOiUvs0kcu0Nht.bat

Filesize
77B

MD5
2ed11b1529600db8518888a8d4f1990e

SHA1
21961a59c7f22c04d0704f1a29c1e7720156f942

SHA256
eb402b7e0d0145ca49d3c43df2b134fd9a8f2ae3a07319a9cb0e70fba6e7d06b

SHA512
e40fa81fceb25ff396fb6bcdba1a15f3ce437ed4fda6754f4ff41d60a852cdc6aa25ab622652ccb0ab94e14ab9e56829cdfc4aaec233ca2307efa142ed34ce5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3WpfbLnk5C.bat

Filesize
184B

MD5
2a3a69e6dd81322601bb667e22b456b7

SHA1
266f3d630074ab398e016bff9830da04196c2098

SHA256
6c4015ceab9f63b0d708abd97363dd86096fa268cc45c2f9a797faa5d47ee3d9

SHA512
2bd12d5f5d3adf55df52f40f380d5f9f68248be869447464e039689556ec4292a1bc5abd579bfffda70ad7fb2b4f5efc23b8210b5027366cc946986fdf99a628

Download Submit
C:\Users\Admin\AppData\Local\Temp\DNHOnF8KXH.bat

Filesize
184B

MD5
05a24610e593129bc077771d7087165b

SHA1
6936dd99b260ad16359e17c5c9a9344c0bf92a2e

SHA256
a8d305d029a029dc3e5d428d154a195942a5e2b8ef23053ed4c1d465f55254e9

SHA512
a317842b7e41e63e08ddd98b4e667c05eabdf6b8f810b099da61a824a883a5766100526cbeba618aa79140381dcefa66eec34f984244e978e83bd6088e9819d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q4KhmYWH96.bat

Filesize
232B

MD5
37336dc58ba34670a58fd95d51b55419

SHA1
00fcac38bc4c70e0bc6787c0b67bcd51004b5768

SHA256
0e1b4bf40035891a26f769b0c8c665366965d25dece567b620696f1a61ad2572

SHA512
42461a7c74e73c467566ebed032871dd8a1dff68c4644028451b217acd6a4e16fc2e2a3ee665f0ab08e505f98da01c96b06085761e153ba9ff99712b2d1ced60

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2DE4.tmp

Filesize
1KB

MD5
bc31b894b43e61aac50dcd23e0aaafcc

SHA1
7b24264f8c7791897c86ab67a92ecef6c775af84

SHA256
78c1e77597e71dd55e2e72752b93c4fff564eb89032ee240084942e491ba548c

SHA512
5adb2fd8833799bd32b2ae485972c1682ff678d94ef7a89fb356b830566e1bcbbe519afa5f56f19d979c250f123c2ec07579bcf8b424d67dc066ca689e790b0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RXbe2nqO2a.bat

Filesize
184B

MD5
b65a3358150d05ccb7b1b778da9288d0

SHA1
a6fde73d063f0f93c82b94fd30e1a397ec9ea646

SHA256
e6efd7adbbb11b3d10a18b26fcfa2a4a1182772aa2548f4989068435d810ac5c

SHA512
60f375bede0f335c4f652a33aa3653610eb8db1b011d6aad3a4bf211477f9d1e6d8ac948c5a802e53bb318671dbdac0da5635626592e102dde226f9ea00910b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dV69F4sOEJ.bat

Filesize
232B

MD5
82197b7903186a7a9ddf482d1ce98e00

SHA1
a6e43e602126e45835306c2ed95f9abbf83518bb

SHA256
22a135dcc2175ce3590473244f45aa9dc8adcb329c4a06c4b4f8cb65c42a7f87

SHA512
9fcbb8b730104fd1d36fbba648a91162041e20d777f2d2fa625c9fb43552d747b7a37f4056f44d2799911dc951088479d1c7e5c1b344282e93cedb364dac354f

Download Submit
C:\Users\Admin\AppData\Local\Temp\daekv7QIWo.bat

Filesize
232B

MD5
b887eddc532a691c3957782cf27fe5ac

SHA1
110bf9d47f0cbe6e08d49cd61cba58b6d0cef8ce

SHA256
33a1cc82cf165fde23bca5955e0a6f5318993faafdc4dadc037753548daf564d

SHA512
b40a82c0fcc33e9019941f789aee1cf01a8b696ef4b5f374b85402f7b606aed3b19c3d793ef6f268f7bb600cfb0afd2a96803486f2d366ba9cd9110e16759ad8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fn6aS0VTUV.bat

Filesize
184B

MD5
539be6d33ea9e64fc27a8c43841ea38b

SHA1
5abdf2b4d6b2b4595e1d5b90b9a6fb213b582e2a

SHA256
bd349d5f4c69f75051f32b35fb31734fb37336a35272f4367ea883c04d0679f4

SHA512
b2e512a43434c4606c6f22fe9b8ed18c5f89ba841c7ff61591ebb4b2901970ae6ed9860cfbf09465e98067e05415dc48fbb85252b710fa9b35de0f3959b9f4d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\inbPLpLC2K.bat

Filesize
232B

MD5
f6411067c3d7f218d9755a9a9bf48496

SHA1
e908b56f54a9b69034b10554245c7fa2eeca29e9

SHA256
d40d99288e47161c19f6dc7d111fbcf19300bbbcb09d8a806161ed8008f9186e

SHA512
fef669b8a0b9d89cf4e223b452b22dfc502ab8f30c853fa0f3786d500f8d3ee5c638efe5c9f72492a1762b5365c89e541085df2c93bdc68bb99835185eaeb364

Download Submit
C:\Users\Admin\AppData\Local\Temp\l20ZFicoO9.bat

Filesize
184B

MD5
9de820382dea9a7b7eabe4d81dd01ca0

SHA1
6bb740bcb245f5ef61bb607a210e4535b23d6ed4

SHA256
6c9cbd732ce2c4033aafec7ead489f7ab2333edb7a420341eac98f576c6c39a6

SHA512
d02726da8a4d038472d66bb1bbbb9c02d33a73401ec5bba532bb99594ae707357095bee6ce0a66cdb05bebf14bd0b758524501c7204cb024c513c77b480ee3d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\lOMsQrAcGI.bat

Filesize
232B

MD5
f1468becb5c52cf8c4c32da03ca9f3ee

SHA1
b1f582bf169d50b16820c783a0cdbb4e22052ff4

SHA256
fdadfd4596bd6a125376571e6cb48609a6ebd475dedaa6e5b3ea0143a5989875

SHA512
0fd1e8a9f711928d0c4a0341f6dbc216a7d88abbc0a68f76c92278b457a04b165faccb88533b32722cd6e7e5e4e0a2e69cb514a512074a75f96b7db4e6a0e09e

Download Submit
C:\Users\Admin\AppData\Local\Temp\sJRdaZOVrD.bat

Filesize
184B

MD5
9f310c03e260557eddee11917fb724ca

SHA1
55bf1d80b319dde639a0abb2bbb05e8d3bb4167e

SHA256
1f367e80838bd8a2717b763d418a6c104e9e6b90579a1d3bd6cdaeeb513d2d21

SHA512
36ba43ab8cd8ab797ce5dbede416193093fd5c3796664e887bc8e138f86a0febd40457a7554512b8bfa2c7af80f8886b38e7b92a24d7faebe9044eef789603ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\tuGXyMaJvX.bat

Filesize
184B

MD5
cdfa73dee414deb6fab29b30d2befd51

SHA1
6cc687c0caf787ac6f3d40782ac52f2ab4ae7fac

SHA256
4df3d41033538e59a70be56307fed5f11df3c264ab036ae45f11012e2fc5e544

SHA512
4731662a05f2c5be6d41df545e28b395d79b1cc2a03711bc6f85efc7869602c538f928d358a919d5b1fb0e22f080a9899956776f5dc018b3874090fd787f6cf5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rotsx3hq\rotsx3hq.0.cs

Filesize
388B

MD5
3c08c2f9ca666e692675fc4e833a3e4c

SHA1
f7a8ffd6b271c5bc1db9a4bbb2475b1be5dd4db0

SHA256
72d3e263a0c42744e4dfae54f0f45343b3d2b16fe5c763650fea8603b2ae44da

SHA512
74c55ccd56fb934adb0a754753c5a3fef866eb8d63ac60ae026b4af85b934ecd0c4453285b603462d5355f3d7ace0f81ddf8e0af2b99e5e19c9393efc9b43912

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rotsx3hq\rotsx3hq.cmdline

Filesize
235B

MD5
81760ff641332a1a92d1d075c5b4535c

SHA1
08fa58544308c9ffeef25abdae340890486a46ce

SHA256
68769b7415be746bba1571c5a6238f540cb81d30f3bcb2e7fff735fb969a7c5c

SHA512
ce0e1365ef3356166102cb7763617cdd015662f18394acefaf8707f377e195325bcc18baff58f5ccee8cdbc483cf8420b90b769ce02a66efa00e0d394f60902e

Download Submit
\??\c:\Windows\System32\CSC931E71E4A47741DB92AF8949E2F84842.TMP

Filesize
1KB

MD5
078586b266e519b5c113064d7a0bf45c

SHA1
a9395c0ef35add5c75591ebb94c85c1f33f408bf

SHA256
ccf292ff9f142b204ad4f4481a044ba8f9ab274305dcb604bf0b8ae91819ab1e

SHA512
5b8eb6aad62657309088c4668d633c2aa6324d4824ec32c3c5e133df0a5493a4342c980e077ba565f3aab29c58f95c8db7195415a1e554384405c1457730f959

Download Submit
\ChainBlockportcomnet\HyperFontReview.exe

Filesize
1.8MB

MD5
567cd508bc0600d5b2e390422d5801b7

SHA1
093d100e41e9d24b6b72e0f3d8b00ab7efcdb201

SHA256
4e180cc9f48bcc3ab5532dbc7b0a6ce389d5dda4c6a91aa078fc717ff9bddfef

SHA512
eb8ceabbf6c7518c76c2027533fea4c4a405c5f106edffea228e16e9fd0fa5d0365f5b480cb16f10129cf022ca1fdf1e102bb99c3e1fc8805f4a7a00bd57613e

Download Submit
memory/780-52-0x00000000013E0000-0x00000000015BA000-memory.dmp

Filesize
1.9MB

Download
memory/1152-150-0x0000000000150000-0x000000000032A000-memory.dmp

Filesize
1.9MB

Download
memory/1460-95-0x0000000000050000-0x000000000022A000-memory.dmp

Filesize
1.9MB

Download
memory/1692-106-0x0000000000B40000-0x0000000000D1A000-memory.dmp

Filesize
1.9MB

Download
memory/2156-161-0x0000000000370000-0x000000000054A000-memory.dmp

Filesize
1.9MB

Download
memory/2392-118-0x0000000000BF0000-0x0000000000DCA000-memory.dmp

Filesize
1.9MB

Download
memory/2836-21-0x0000000000420000-0x000000000042C000-memory.dmp

Filesize
48KB

Download
memory/2836-19-0x0000000000B80000-0x0000000000B98000-memory.dmp

Filesize
96KB

Download
memory/2836-17-0x0000000000460000-0x000000000047C000-memory.dmp

Filesize
112KB

Download
memory/2836-15-0x0000000000410000-0x000000000041E000-memory.dmp

Filesize
56KB

Download
memory/2836-13-0x0000000000D00000-0x0000000000EDA000-memory.dmp

Filesize
1.9MB

Download