blacknet | hxxp://92[.]18[.]218[.]116

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2023 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://92.18.218.116

Score

10^/10

blacknet [id]trojan

Malware Config

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

[ID]

[HOST]

Mutex

[MUTEX]

Attributes

antivm
false
elevate_uac
false
install_name
[Install_Name]
splitter
[Splitter]
start_name
[StartupName]
startup
false
usb_spread
false

aes.plain

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0007000000022d14-381.dat	family_blacknet
behavioral1/files/0x0007000000022d14-395.dat	family_blacknet
behavioral1/files/0x0007000000022d14-396.dat	family_blacknet
behavioral1/memory/1800-397-0x0000000000900000-0x0000000000920000-memory.dmp	family_blacknet
behavioral1/files/0x0007000000022d14-447.dat	family_blacknet
behavioral1/files/0x0007000000022d14-465.dat	family_blacknet
behavioral1/files/0x0007000000022d14-469.dat	family_blacknet
behavioral1/files/0x0007000000022d14-474.dat	family_blacknet
behavioral1/files/0x0007000000022d14-483.dat	family_blacknet
behavioral1/files/0x0007000000022d14-497.dat	family_blacknet
behavioral1/files/0x0007000000022d14-499.dat	family_blacknet
behavioral1/files/0x0007000000022d14-501.dat	family_blacknet
behavioral1/files/0x0007000000022d14-504.dat	family_blacknet
behavioral1/files/0x0007000000022d14-505.dat	family_blacknet
behavioral1/files/0x0007000000022d14-520.dat	family_blacknet
behavioral1/files/0x0007000000022d14-526.dat	family_blacknet
behavioral1/files/0x0007000000022d14-529.dat	family_blacknet
behavioral1/files/0x0007000000022d14-534.dat	family_blacknet
behavioral1/files/0x0007000000022d14-538.dat	family_blacknet
behavioral1/files/0x0007000000022d14-555.dat	family_blacknet
behavioral1/files/0x0007000000022d14-582.dat	family_blacknet
behavioral1/files/0x0007000000022d14-601.dat	family_blacknet
behavioral1/files/0x0007000000022d14-602.dat	family_blacknet
behavioral1/files/0x0007000000022d14-603.dat	family_blacknet
behavioral1/files/0x0007000000022d14-604.dat	family_blacknet
behavioral1/files/0x0007000000022d14-617.dat	family_blacknet
behavioral1/files/0x0007000000022d14-624.dat	family_blacknet
behavioral1/files/0x0007000000022d14-627.dat	family_blacknet
behavioral1/files/0x0007000000022d14-630.dat	family_blacknet
behavioral1/files/0x0007000000022d14-631.dat	family_blacknet
behavioral1/files/0x0007000000022d14-640.dat	family_blacknet
behavioral1/files/0x0007000000022d14-643.dat	family_blacknet
behavioral1/files/0x0007000000022d14-646.dat	family_blacknet
behavioral1/files/0x0007000000022d14-650.dat	family_blacknet
behavioral1/files/0x0007000000022d14-653.dat	family_blacknet

Contains code to disable Windows Defender 35 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/files/0x0007000000022d14-381.dat	disable_win_def
behavioral1/files/0x0007000000022d14-395.dat	disable_win_def
behavioral1/files/0x0007000000022d14-396.dat	disable_win_def
behavioral1/memory/1800-397-0x0000000000900000-0x0000000000920000-memory.dmp	disable_win_def
behavioral1/files/0x0007000000022d14-447.dat	disable_win_def
behavioral1/files/0x0007000000022d14-465.dat	disable_win_def
behavioral1/files/0x0007000000022d14-469.dat	disable_win_def
behavioral1/files/0x0007000000022d14-474.dat	disable_win_def
behavioral1/files/0x0007000000022d14-483.dat	disable_win_def
behavioral1/files/0x0007000000022d14-497.dat	disable_win_def
behavioral1/files/0x0007000000022d14-499.dat	disable_win_def
behavioral1/files/0x0007000000022d14-501.dat	disable_win_def
behavioral1/files/0x0007000000022d14-504.dat	disable_win_def
behavioral1/files/0x0007000000022d14-505.dat	disable_win_def
behavioral1/files/0x0007000000022d14-520.dat	disable_win_def
behavioral1/files/0x0007000000022d14-526.dat	disable_win_def
behavioral1/files/0x0007000000022d14-529.dat	disable_win_def
behavioral1/files/0x0007000000022d14-534.dat	disable_win_def
behavioral1/files/0x0007000000022d14-538.dat	disable_win_def
behavioral1/files/0x0007000000022d14-555.dat	disable_win_def
behavioral1/files/0x0007000000022d14-582.dat	disable_win_def
behavioral1/files/0x0007000000022d14-601.dat	disable_win_def
behavioral1/files/0x0007000000022d14-602.dat	disable_win_def
behavioral1/files/0x0007000000022d14-603.dat	disable_win_def
behavioral1/files/0x0007000000022d14-604.dat	disable_win_def
behavioral1/files/0x0007000000022d14-617.dat	disable_win_def
behavioral1/files/0x0007000000022d14-624.dat	disable_win_def
behavioral1/files/0x0007000000022d14-627.dat	disable_win_def
behavioral1/files/0x0007000000022d14-630.dat	disable_win_def
behavioral1/files/0x0007000000022d14-631.dat	disable_win_def
behavioral1/files/0x0007000000022d14-640.dat	disable_win_def
behavioral1/files/0x0007000000022d14-643.dat	disable_win_def
behavioral1/files/0x0007000000022d14-646.dat	disable_win_def
behavioral1/files/0x0007000000022d14-650.dat	disable_win_def
behavioral1/files/0x0007000000022d14-653.dat	disable_win_def

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

watcher.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	watcher.exe

Executes dropped EXE 36 IoCs

Processes:

BlackNET Builder.exeBlackNET Builder.exestub.exewatcher.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exeLokiRAT_Relapse.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exestub.exe

pid	Process
916	BlackNET Builder.exe
4728	BlackNET Builder.exe
1800	stub.exe
4856	watcher.exe
4792	stub.exe
2192	stub.exe
3504	stub.exe
4176	stub.exe
3204	stub.exe
1064	stub.exe
4692	stub.exe
2476	stub.exe
4816	stub.exe
3240	stub.exe
1404	stub.exe
1100	stub.exe
640	stub.exe
3140	stub.exe
4664	stub.exe
1104	stub.exe
2260	LokiRAT_Relapse.exe
1404	stub.exe
1296	stub.exe
2748	stub.exe
956	stub.exe
1984	stub.exe
3704	stub.exe
4932	stub.exe
4300	stub.exe
1928	stub.exe
4528	stub.exe
3472	stub.exe
2936	stub.exe
4696	stub.exe
1480	stub.exe
1112	stub.exe

Loads dropped DLL 1 IoCs

Processes:

LokiRAT_Relapse.exe

pid	Process
2260	LokiRAT_Relapse.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 34 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
4696	916	WerFault.exe	99
4696	4728	WerFault.exe	105
4176	1800	WerFault.exe	108
4924	4792	WerFault.exe	112
4068	2192	WerFault.exe	115
4660	3504	WerFault.exe	118
4280	4176	WerFault.exe	121
1372	3204	WerFault.exe	124
1476	1064	WerFault.exe	127
640	4692	WerFault.exe	130
856	2476	WerFault.exe	133
2208	4816	WerFault.exe	136
4984	3240	WerFault.exe	139
3156	1404	WerFault.exe	142
4276	1100	WerFault.exe	145
3948	640	WerFault.exe	148
1764	3140	WerFault.exe	151
992	4664	WerFault.exe	154
4928	1104	WerFault.exe	157
1472	1404	WerFault.exe	161
1300	1296	WerFault.exe	165
4512	2748	WerFault.exe	168
4304	956	WerFault.exe	171
4816	1984	WerFault.exe	174
3240	3704	WerFault.exe	177
2192	4932	WerFault.exe	180
732	4300	WerFault.exe	183
3696	1928	WerFault.exe	186
4404	4528	WerFault.exe	189
4512	3472	WerFault.exe	192
3160	2936	WerFault.exe	195
4536	4696	WerFault.exe	198
1664	1480	WerFault.exe	201
3156	1112	WerFault.exe	204

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exedw20.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	firefox.exe

NTFS ADS 5 IoCs

Processes:

firefox.exe

description	ioc	Process
File created	C:\Users\Admin\Downloads\Mono.Cecil.dll:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\stub.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\watcher.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\LokiRAT_Relapse.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\BlackNET Builder.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

watcher.exe

pid	Process
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe
4856	watcher.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

firefox.exewatcher.exedw20.exe

description	pid	Process
Token: SeDebugPrivilege	392	firefox.exe
Token: SeDebugPrivilege	392	firefox.exe
Token: SeDebugPrivilege	392	firefox.exe
Token: SeDebugPrivilege	4856	watcher.exe
Token: SeRestorePrivilege	1100	dw20.exe
Token: SeBackupPrivilege	1100	dw20.exe
Token: SeRestorePrivilege	1100	dw20.exe
Token: SeBackupPrivilege	1100	dw20.exe
Token: SeRestorePrivilege	1100	dw20.exe
Token: SeBackupPrivilege	1100	dw20.exe
Token: SeRestorePrivilege	1100	dw20.exe
Token: SeBackupPrivilege	1100	dw20.exe
Token: SeRestorePrivilege	1100	dw20.exe
Token: SeBackupPrivilege	1100	dw20.exe
Token: SeRestorePrivilege	1100	dw20.exe
Token: SeBackupPrivilege	1100	dw20.exe
Token: SeRestorePrivilege	1100	dw20.exe
Token: SeBackupPrivilege	1100	dw20.exe
Token: SeRestorePrivilege	1100	dw20.exe
Token: SeBackupPrivilege	1100	dw20.exe
Token: SeDebugPrivilege	392	firefox.exe
Token: SeDebugPrivilege	392	firefox.exe
Token: SeDebugPrivilege	392	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid	Process
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid	Process
392	firefox.exe
392	firefox.exe
392	firefox.exe

Suspicious use of SetWindowsHookEx 23 IoCs

Processes:

firefox.exeLokiRAT_Relapse.exe

pid	Process
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
392	firefox.exe
2260	LokiRAT_Relapse.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	Process	procid_target
PID 3832 wrote to memory of 392	3832	firefox.exe	84
PID 3832 wrote to memory of 392	3832	firefox.exe	84
PID 3832 wrote to memory of 392	3832	firefox.exe	84
PID 3832 wrote to memory of 392	3832	firefox.exe	84
PID 3832 wrote to memory of 392	3832	firefox.exe	84
PID 3832 wrote to memory of 392	3832	firefox.exe	84
PID 3832 wrote to memory of 392	3832	firefox.exe	84
PID 3832 wrote to memory of 392	3832	firefox.exe	84
PID 3832 wrote to memory of 392	3832	firefox.exe	84
PID 3832 wrote to memory of 392	3832	firefox.exe	84
PID 3832 wrote to memory of 392	3832	firefox.exe	84
PID 392 wrote to memory of 264	392	firefox.exe	85
PID 392 wrote to memory of 264	392	firefox.exe	85
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 896	392	firefox.exe	86
PID 392 wrote to memory of 1880	392	firefox.exe	87
PID 392 wrote to memory of 1880	392	firefox.exe	87
PID 392 wrote to memory of 1880	392	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" http://92.18.218.116
1⤵
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" http://92.18.218.116
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.0.428078996\859759438" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {747dc739-57a2-4de6-b4e1-74cd456deab8} 392 "\\.\pipe\gecko-crash-server-pipe.392" 1932 14d61916858 gpu
    3⤵
    PID:264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.1.1085699217\516784785" -parentBuildID 20221007134813 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1ba24d1-e394-485d-97a1-63f0ee6fe503} 392 "\\.\pipe\gecko-crash-server-pipe.392" 2440 14d53972258 socket
    3⤵
    PID:896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.2.753690527\1819333783" -childID 1 -isForBrowser -prefsHandle 3336 -prefMapHandle 3332 -prefsLen 21854 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66b7bcd1-04b0-4372-9da8-d6f80713c33f} 392 "\\.\pipe\gecko-crash-server-pipe.392" 3400 14d64710458 tab
    3⤵
    PID:1880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.3.1204220899\2049219622" -childID 2 -isForBrowser -prefsHandle 3916 -prefMapHandle 3912 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb475fde-6d86-4785-bfb4-293dc27a207d} 392 "\\.\pipe\gecko-crash-server-pipe.392" 3924 14d6594ea58 tab
    3⤵
    PID:3456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.6.271826730\1947769007" -childID 5 -isForBrowser -prefsHandle 5152 -prefMapHandle 5156 -prefsLen 26753 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eaa3536b-66d6-48f4-99bc-9169110e44c0} 392 "\\.\pipe\gecko-crash-server-pipe.392" 5144 14d671be158 tab
    3⤵
    PID:4168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.5.666182129\713313656" -childID 4 -isForBrowser -prefsHandle 4948 -prefMapHandle 4952 -prefsLen 26753 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {feb9b632-2536-4dc7-9837-bffdfed50def} 392 "\\.\pipe\gecko-crash-server-pipe.392" 4940 14d66a39258 tab
    3⤵
    PID:4232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="392.4.284126321\1359280679" -childID 3 -isForBrowser -prefsHandle 4892 -prefMapHandle 4888 -prefsLen 26753 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f7f48d2-86ea-4420-8342-925fe8909a88} 392 "\\.\pipe\gecko-crash-server-pipe.392" 4904 14d66a3c258 tab
    3⤵
    PID:3692
- - C:\Users\Admin\Downloads\BlackNET Builder.exe
    "C:\Users\Admin\Downloads\BlackNET Builder.exe"
    3⤵
    - Executes dropped EXE
    PID:916
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 916 -s 976
      4⤵
      Program crash
      PID:4696
- - C:\Users\Admin\Downloads\stub.exe
    "C:\Users\Admin\Downloads\stub.exe"
    3⤵
    - Executes dropped EXE
    PID:1800
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1800 -s 984
      4⤵
      Program crash
      PID:4176
- - C:\Users\Admin\Downloads\watcher.exe
    "C:\Users\Admin\Downloads\watcher.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:4792
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4792 -s 952
        5⤵
        Program crash
        
        PID:4924
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:2192
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2192 -s 952
        5⤵
        Program crash
        
        PID:4068
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:3504
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3504 -s 952
        5⤵
        Program crash
        
        PID:4660
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:4176
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4176 -s 952
        5⤵
        Program crash
        
        PID:4280
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:3204
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3204 -s 952
        5⤵
        Program crash
        
        PID:1372
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:1064
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1064 -s 952
        5⤵
        Program crash
        
        PID:1476
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:4692
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4692 -s 952
        5⤵
        Program crash
        
        PID:640
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:2476
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2476 -s 952
        5⤵
        Program crash
        
        PID:856
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:4816
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4816 -s 952
        5⤵
        Program crash
        
        PID:2208
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:3240
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3240 -s 964
        5⤵
        Program crash
        
        PID:4984
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:1404
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1404 -s 952
        5⤵
        Program crash
        
        PID:3156
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:1100
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1100 -s 952
        5⤵
        Program crash
        
        PID:4276
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:640
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 640 -s 952
        5⤵
        Program crash
        
        PID:3948
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:3140
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3140 -s 952
        5⤵
        Program crash
        
        PID:1764
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:4664
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4664 -s 952
        5⤵
        Program crash
        
        PID:992
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:1104
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1104 -s 952
        5⤵
        Program crash
        
        PID:4928
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:1404
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1404 -s 952
        5⤵
        Program crash
        
        PID:1472
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:1296
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1296 -s 956
        5⤵
        Program crash
        
        PID:1300
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:2748
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2748 -s 952
        5⤵
        Program crash
        
        PID:4512
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:956
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 956 -s 952
        5⤵
        Program crash
        
        PID:4304
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:1984
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1984 -s 952
        5⤵
        Program crash
        
        PID:4816
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:3704
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3704 -s 952
        5⤵
        Program crash
        
        PID:3240
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:4932
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4932 -s 956
        5⤵
        Program crash
        
        PID:2192
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:4300
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4300 -s 952
        5⤵
        Program crash
        
        PID:732
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:1928
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1928 -s 952
        5⤵
        Program crash
        
        PID:3696
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:4528
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4528 -s 952
        5⤵
        Program crash
        
        PID:4404
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:3472
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3472 -s 952
        5⤵
        Program crash
        
        PID:4512
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:2936
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2936 -s 964
        5⤵
        Program crash
        
        PID:3160
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:4696
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4696 -s 952
        5⤵
        Program crash
        
        PID:4536
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:1480
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1480 -s 964
        5⤵
        Program crash
        
        PID:1664
  - - C:\Users\Admin\Downloads\stub.exe
      "C:\Users\Admin\Downloads\stub.exe"
      4⤵
      Executes dropped EXE
      PID:1112
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1112 -s 952
        5⤵
        Program crash
        
        PID:3156
- - C:\Users\Admin\Downloads\LokiRAT_Relapse.exe
    "C:\Users\Admin\Downloads\LokiRAT_Relapse.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2260
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 1228
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:1100

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 436 -p 916 -ip 916
1⤵
PID:864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4700

C:\Users\Admin\Downloads\BlackNET Builder.exe
"C:\Users\Admin\Downloads\BlackNET Builder.exe"
1⤵
- Executes dropped EXE
PID:4728
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4728 -s 960
  2⤵
  - Program crash
  PID:4696

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 4728 -ip 4728
1⤵
PID:2576

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 516 -p 1800 -ip 1800
1⤵
PID:2208

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 536 -p 4792 -ip 4792
1⤵
PID:916

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 2192 -ip 2192
1⤵
PID:4536

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 512 -p 3504 -ip 3504
1⤵
PID:4692

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 4176 -ip 4176
1⤵
PID:4816

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 3204 -ip 3204
1⤵
PID:4236

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 512 -p 1064 -ip 1064
1⤵
PID:1648

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 4692 -ip 4692
1⤵
PID:916

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 2476 -ip 2476
1⤵
PID:3340

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 4816 -ip 4816
1⤵
PID:4208

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 3240 -ip 3240
1⤵
PID:988

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 540 -p 1404 -ip 1404
1⤵
PID:4780

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 1100 -ip 1100
1⤵
PID:3460

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 640 -ip 640
1⤵
PID:1340

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 3140 -ip 3140
1⤵
PID:4336

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 4664 -ip 4664
1⤵
PID:3160

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 616 -p 1104 -ip 1104
1⤵
PID:4536

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 600 -p 1404 -ip 1404
1⤵
PID:3484

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 1296 -ip 1296
1⤵
PID:4296

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 596 -p 2748 -ip 2748
1⤵
PID:340

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 604 -p 956 -ip 956
1⤵
PID:2936

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 512 -p 1984 -ip 1984
1⤵
PID:4204

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 468 -p 3704 -ip 3704
1⤵
PID:1132

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 612 -p 4932 -ip 4932
1⤵
PID:1064

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 556 -p 4300 -ip 4300
1⤵
PID:2324

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 588 -p 1928 -ip 1928
1⤵
PID:1152

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 588 -p 4528 -ip 4528
1⤵
PID:3948

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 3472 -ip 3472
1⤵
PID:2388

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 596 -p 2936 -ip 2936
1⤵
PID:992

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 608 -p 4696 -ip 4696
1⤵
PID:1924

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 512 -p 1480 -ip 1480
1⤵
PID:4236

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 1112 -ip 1112
1⤵
PID:3204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\activity-stream.discovery_stream.json.tmp

Filesize
158KB

MD5
d29c75f07ae8b4d997c259e2a8183882

SHA1
7483d966709e60d37c60cc2b793ecf209440dd8e

SHA256
e5bc45c452a1b2a4a49c57092ec5a47a609a1e4dac8d7ac5d028b6238536915f

SHA512
e9c6b4f4771964880dceb5e742700cc21ca19dd144885561ede49900f6f54ff067ebb1dc0ae5381fa6ea265473c846ce9cb3c077b9816cb84420177db8540c4d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\safebrowsing-updating\ads-track-digest256-1.vlpset

Filesize
54KB

MD5
4f9ef3d3a71d4cb49e623e3f4b7b1162

SHA1
c2d65973b44b051d043475e9387fa7100514acbd

SHA256
48ae004f3c542ac764dd5a1e894918ec4b250b5c1f7209256c191cae13106b1f

SHA512
f7017204ad37ceedbff4e8b58ab4edac75748d2f36693e59ea9d9157f637d29b53c6405d994ac9fc62712f2574013e95c4817ff49229c78dcc23cac805b13ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\cbfcd52f-1b97-4146-a66d-c6959bc65b2b\CliSecureRT.dll

Filesize
109KB

MD5
46092bbddb5bdf775f67a341d2b03ad7

SHA1
5645a2b182986d0278c862390014e20cc501d996

SHA256
a9f6783f2864f4532db011c8fccb41fa3732148a810084c7efa8dddbd5ae6324

SHA512
5b6cdae42a17aad74500a0ec7c1c4c6d6f0a2a28a43e6620eb26bbf2fe0e0f6adf1836317a33e0e720c70909405c74b3e95df1cb7011732a97f723edb5d250d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cbfcd52f-1b97-4146-a66d-c6959bc65b2b\CliSecureRT.dll

Filesize
109KB

MD5
46092bbddb5bdf775f67a341d2b03ad7

SHA1
5645a2b182986d0278c862390014e20cc501d996

SHA256
a9f6783f2864f4532db011c8fccb41fa3732148a810084c7efa8dddbd5ae6324

SHA512
5b6cdae42a17aad74500a0ec7c1c4c6d6f0a2a28a43e6620eb26bbf2fe0e0f6adf1836317a33e0e720c70909405c74b3e95df1cb7011732a97f723edb5d250d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js

Filesize
7KB

MD5
6ff7fe3ef71bd7a9ff679989228db487

SHA1
42ae2cdb16555cecef2aa9f6211dc6671bc08cf2

SHA256
68af51ad7ff350752c62cb61251beb617b8aaf02c9d81115a7cb50d532b9c387

SHA512
58334e6a2e2328c5593a4f8a55254df57ee903ee0e745d6e4e23dd44711b4ba0780979dd8be122801c84846aed1a761266aa4637f4213a9125edcd246be4dc2e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs.js

Filesize
6KB

MD5
31c06df8deda4530b5407ce1f432dc7c

SHA1
2ca1f2e9ee09e9a503ea83878b7f57dce36956ca

SHA256
7f94d2a7deee11a64b8830116619438558848c5bb70a7408a69279af8e359a28

SHA512
de5083b895814defc10a526ea5d36fdafe2fe7092303f94eef81ef2a00c3a3d0bb699f042463307b78aa7285649ad5521b1cad4967fccf3c438e8b18653d1a59

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs.js

Filesize
6KB

MD5
724692ab82b27decab51af58a36101ca

SHA1
a5c34dc923a15c3a1825943728a9b8e30dd855c7

SHA256
38605d6dbd1e2aaf67bdf0b63c1224311bda20082974fd60efb987e5fd81dfa3

SHA512
1ea23952f0cf19989048343753f53d477288234d5ad01f5b710a46adf94628d91366c8f81dfe9a59726d447ba69cfd75d36a8818560dedf3f356338732531f30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
db1c944c96d0e489e950a32a55f66ea2

SHA1
eb149a2c51dc22c804c74e7d53cc9e27e46484c7

SHA256
d8ae3857d0f0b83f881a2a8a8c13d3fb921e67e69e5fbe40dafb9dde5ee01a96

SHA512
190d0718cb65960dbf7e19f06556469768ea5414816fffa1772aa32d14feae4e64b8876030657dfa2afc40c39eda4e418c8c8cc436c3ed1fa381dc96370ff591

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
0682bff9d85c3547dfc9df741d6eba6f

SHA1
05739e9b73ebbc9ee4f02a6bc6af224599f23fbe

SHA256
f82161a98236bbe99217c087750811ac60448c72d6c54ddf29b4b45130e97d81

SHA512
cd1bcba0fc1d1095ff2faa2f42c8240e7ef2bf2fb8fd0cffa3be1fdc2c0d92aaf357dea5714b20ffb27e5172a229383f4133525d2f4621c2c04f94b0d9702c68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
cecc8f7c765f67ea7f44191827205d3c

SHA1
13801216411ed35a7b6e730b77086ae07b88d1eb

SHA256
b80a7a7d7ebf46fbd15ad0e90d6e80e3f3656eaced6760e941ef1f6525046fbb

SHA512
27bc1f952f48bc88d334e84ddde70cc01158872b76e3c49317c4ecb82d5b96d7bf51480ff4137edf50add75cc2d0d465eb079e1bc07a1d6a4f2b6c6cf24f8df9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a83f9ea5965bcc10832b428c00ac70dd

SHA1
e1e24f75d05346eff49642facb3953028ffdfdb2

SHA256
2c51c4fedbfda4a514d9766108ab82a8ed3b8c03a59a65ad63af68b7fc641813

SHA512
d657109a62fc5b2217fde23328ee721d7417c5e526895747fbd18779c0bf1e08506ae579192406d48d84e0dad1bfbd074c24479735a2ea96e5819abf0aba15c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
2ed78bd8a208bdc08f15726609bc4e9b

SHA1
ac8656c55300635b77eeae8570154cf2ddc9f2e5

SHA256
93b98bf2c5510488e4d09446a1043f4b146240207da9dabf70466d2dd52f0c97

SHA512
87e8586b40b7532d2f9b50bfa7c2732983dd3773123ef6f83199b356e92877cabd13712d6d8f1a1e0df708676f34e45a39666660c7c73971bc1fc575a3468cb2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
acd22f8c76b2dce48f06e122bd24cca1

SHA1
50c4fdfaeba013dc870d9cd4b621d0436e6d6149

SHA256
e748120eea1aae0deebae18d522dd26fd5bd310c10e20bbced82a1a1042f0486

SHA512
47e363daa6b9285cd2add6e332237f295fc7c5723269ee87ae0f8e1528cd2e57dfe8b7ba702e89346f485d59d04fd5ce6aa3baf5b99a424c5403c391b2d7ca99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
70d96ae4695d1014370b9842363c618c

SHA1
74bcf741ca2fe8bac7b466e72ce3465ff727ba15

SHA256
fdd52f885db852f2732650fda9416e47e8071a2c6a416b520b38dcf702e8ab84

SHA512
ccf8de887ce224dae18792f90406cf588a42d5c537efb41672fbcd38de9c979ea5c9d2abf353e49dd40c36ab5887c2050c4ea6d420c6a1ad38e02b912535f810

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
4e5d1a0052e86806769179b60aa740d1

SHA1
ff319dcb6b5db36e297972e078e66b31200ffb86

SHA256
ccd049737f9b9e011ab015a6acecedfb17fd5f45df9730ad360b7baa9f8a25e0

SHA512
a190c257d201c9def66bec48b1403c3bbec3459b05bcb688fa26a119a2bc5d83a2ab5313990d1cd411ade98cc675084e387c40f46a466aa20d448e9de2e38e31

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
1e640256e1858d55060a99658b98571a

SHA1
46918fa4f79a9420a45dc629abf295a9c7258908

SHA256
cf2e469999a7288fb9e13a47859cd4e7a4819e93bd8f1e3e904dcbd1c922cca5

SHA512
e04cb4a3b55d66ca9f7948cd1d5190fe93263e9a2a2f7831c598c530ef8974b005c6d985817b10c4448216d6a3973ad85cefc1e887c822dc93c6c09bb16ce4fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a4492487c209404b3c29ec7c87ff3e1f

SHA1
30175e48f763abf9440f8f65d4641e2ee9e6cb5e

SHA256
4f8379044e370ea3c79ded54ec5c5aee83309d765cc536724396866248469efe

SHA512
6bc8c7726572a03c54e7a16d9e8e2bef26d249bc0298bdadb8936e3811a5de7d0dcffbdc2de417f0d08cd608fc045f4b4e94eee08aadcd445fc05caa4700a51e

Download Submit
C:\Users\Admin\Downloads\BlackNET Builder.0z9NZ3bC.exe.part

Filesize
367KB

MD5
e426c21445dae36d36bb5d1cfe9d383b

SHA1
bfc79210d073fdb6511bdf6a0b519cc29cebbc3b

SHA256
f4461e8b0f3831b6ee77d57f52dd74f28e79114bc5bb29d6b7ab5ca3adbf27f6

SHA512
096d36231581a894d5e9a07bb8fbe6ba483b92545a32040d448519c7b0de417bce836a1c817dd0ddf5bb98483a4c17dd3013674b6275ffacdfa2155ab32ef3a0

Download Submit
C:\Users\Admin\Downloads\BlackNET Builder.exe

Filesize
367KB

MD5
e426c21445dae36d36bb5d1cfe9d383b

SHA1
bfc79210d073fdb6511bdf6a0b519cc29cebbc3b

SHA256
f4461e8b0f3831b6ee77d57f52dd74f28e79114bc5bb29d6b7ab5ca3adbf27f6

SHA512
096d36231581a894d5e9a07bb8fbe6ba483b92545a32040d448519c7b0de417bce836a1c817dd0ddf5bb98483a4c17dd3013674b6275ffacdfa2155ab32ef3a0

Download Submit
C:\Users\Admin\Downloads\BlackNET Builder.exe

Filesize
367KB

MD5
e426c21445dae36d36bb5d1cfe9d383b

SHA1
bfc79210d073fdb6511bdf6a0b519cc29cebbc3b

SHA256
f4461e8b0f3831b6ee77d57f52dd74f28e79114bc5bb29d6b7ab5ca3adbf27f6

SHA512
096d36231581a894d5e9a07bb8fbe6ba483b92545a32040d448519c7b0de417bce836a1c817dd0ddf5bb98483a4c17dd3013674b6275ffacdfa2155ab32ef3a0

Download Submit
C:\Users\Admin\Downloads\BlackNET Builder.exe

Filesize
367KB

MD5
e426c21445dae36d36bb5d1cfe9d383b

SHA1
bfc79210d073fdb6511bdf6a0b519cc29cebbc3b

SHA256
f4461e8b0f3831b6ee77d57f52dd74f28e79114bc5bb29d6b7ab5ca3adbf27f6

SHA512
096d36231581a894d5e9a07bb8fbe6ba483b92545a32040d448519c7b0de417bce836a1c817dd0ddf5bb98483a4c17dd3013674b6275ffacdfa2155ab32ef3a0

Download Submit
C:\Users\Admin\Downloads\LokiRAT_Relapse.exe

Filesize
1.1MB

MD5
aabb54951546132e70a8e9f02bf8b5ba

SHA1
29df820f6a1ba8225ecb5628b6f3d1ec71bc3cdd

SHA256
1cc4fab54263dfa842c80a72b78a9c223894264b9b4f25263d8fdc2f69def8a1

SHA512
5049fe5833af239207d4c7b8cca5715b4c363a372b39b76450dd1ef866e5a83201646ab6e97bcca9e4be7cf2461096b45777d29d645920b8f367d8d5e66422dd

Download Submit
C:\Users\Admin\Downloads\LokiRAT_Relapse.exe

Filesize
1.1MB

MD5
aabb54951546132e70a8e9f02bf8b5ba

SHA1
29df820f6a1ba8225ecb5628b6f3d1ec71bc3cdd

SHA256
1cc4fab54263dfa842c80a72b78a9c223894264b9b4f25263d8fdc2f69def8a1

SHA512
5049fe5833af239207d4c7b8cca5715b4c363a372b39b76450dd1ef866e5a83201646ab6e97bcca9e4be7cf2461096b45777d29d645920b8f367d8d5e66422dd

Download Submit
C:\Users\Admin\Downloads\LokiRAT_Relapse.exe

Filesize
1.1MB

MD5
aabb54951546132e70a8e9f02bf8b5ba

SHA1
29df820f6a1ba8225ecb5628b6f3d1ec71bc3cdd

SHA256
1cc4fab54263dfa842c80a72b78a9c223894264b9b4f25263d8fdc2f69def8a1

SHA512
5049fe5833af239207d4c7b8cca5715b4c363a372b39b76450dd1ef866e5a83201646ab6e97bcca9e4be7cf2461096b45777d29d645920b8f367d8d5e66422dd

Download Submit
C:\Users\Admin\Downloads\LokiRAT_Relapse.zfSdsP1E.exe.part

Filesize
3KB

MD5
e8b5d08d753fe4ce05385870831e4e34

SHA1
3a3a2cdaa7d05d33ccaab2ed61eac0fd57ad846f

SHA256
7e7adf928d6f11b7013018ef1fd34f7a25ad139907425c87a8bddfc506142312

SHA512
3b352e579f72268f032057b4d331400b665d2617deefebcad4a2897e395a1b7071fe42a12fb4a98c4ed5b7ee2b77a248784f93c62551369073e228f5dce582db

Download Submit
C:\Users\Admin\Downloads\Mono.Cecil.dll

Filesize
335KB

MD5
cb79dd472ae13ef082326ecc0c7891c5

SHA1
e95f4f9e6d41c7b14ab660d1f2d0fc500c182c7c

SHA256
5b39caf5c7e489336a1c9585cfa89adfa12682887b799cc3e21e10ce9484e57d

SHA512
5b86e39a8bb6d60d83ecb0906e1b7bff84e0ec9244861919530f0509dc6c704a0c352f9ee35c489c1347b338644099895ec7675701ebf777a249fabb81bbba31

Download Submit
C:\Users\Admin\Downloads\Mono.Cecil.dll

Filesize
335KB

MD5
cb79dd472ae13ef082326ecc0c7891c5

SHA1
e95f4f9e6d41c7b14ab660d1f2d0fc500c182c7c

SHA256
5b39caf5c7e489336a1c9585cfa89adfa12682887b799cc3e21e10ce9484e57d

SHA512
5b86e39a8bb6d60d83ecb0906e1b7bff84e0ec9244861919530f0509dc6c704a0c352f9ee35c489c1347b338644099895ec7675701ebf777a249fabb81bbba31

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\stub.exe

Filesize
102KB

MD5
e162b1333458a713bc6916cc8ac4110c

SHA1
7053e1ae3e60b42f9fb8850f8a727099530c8fcd

SHA256
2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02

SHA512
9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a

Download Submit
C:\Users\Admin\Downloads\watcher.T38u89Go.exe.part

Filesize
17KB

MD5
89dd6e72358a669b7d6e2348307a7af7

SHA1
0db348f3c6114a45d71f4d218e0e088b71c7bb0a

SHA256
ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e

SHA512
93b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b

Download Submit
C:\Users\Admin\Downloads\watcher.exe

Filesize
17KB

MD5
89dd6e72358a669b7d6e2348307a7af7

SHA1
0db348f3c6114a45d71f4d218e0e088b71c7bb0a

SHA256
ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e

SHA512
93b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b

Download Submit
C:\Users\Admin\Downloads\watcher.exe

Filesize
17KB

MD5
89dd6e72358a669b7d6e2348307a7af7

SHA1
0db348f3c6114a45d71f4d218e0e088b71c7bb0a

SHA256
ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e

SHA512
93b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b

Download Submit
memory/640-530-0x0000000002970000-0x0000000002980000-memory.dmp

Filesize
64KB

Download
memory/916-327-0x000001D94C200000-0x000001D94C264000-memory.dmp

Filesize
400KB

Download
memory/916-328-0x000001D9667B0000-0x000001D9667C0000-memory.dmp

Filesize
64KB

Download
memory/1064-498-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/1104-561-0x000000001BAE0000-0x000000001BAF0000-memory.dmp

Filesize
64KB

Download
memory/1404-591-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

Filesize
64KB

Download
memory/1480-651-0x0000000002210000-0x0000000002220000-memory.dmp

Filesize
64KB

Download
memory/1800-397-0x0000000000900000-0x0000000000920000-memory.dmp

Filesize
128KB

Download
memory/2260-590-0x0000000073C40000-0x0000000073C9B000-memory.dmp

Filesize
364KB

Download
memory/2260-600-0x0000000000710000-0x0000000000B52000-memory.dmp

Filesize
4.3MB

Download
memory/2260-592-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2260-579-0x0000000000710000-0x0000000000B52000-memory.dmp

Filesize
4.3MB

Download
memory/2260-580-0x0000000001240000-0x0000000001241000-memory.dmp

Filesize
4KB

Download
memory/2936-644-0x000000001BC20000-0x000000001BC30000-memory.dmp

Filesize
64KB

Download
memory/3140-535-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/4664-540-0x000000001AD80000-0x000000001AD90000-memory.dmp

Filesize
64KB

Download
memory/4856-426-0x0000000000BF0000-0x0000000000BFC000-memory.dmp

Filesize
48KB

Download
memory/4856-430-0x000000001C6F0000-0x000000001C78C000-memory.dmp

Filesize
624KB

Download
memory/4856-431-0x000000001BBD0000-0x000000001BBD8000-memory.dmp

Filesize
32KB

Download
memory/4856-432-0x000000001C850000-0x000000001C89C000-memory.dmp

Filesize
304KB

Download
memory/4856-472-0x0000000001220000-0x0000000001230000-memory.dmp

Filesize
64KB

Download
memory/4856-434-0x0000000001220000-0x0000000001230000-memory.dmp

Filesize
64KB

Download
memory/4856-429-0x000000001C170000-0x000000001C63E000-memory.dmp

Filesize
4.8MB

Download
memory/4856-428-0x0000000001220000-0x0000000001230000-memory.dmp

Filesize
64KB

Download
memory/4856-468-0x0000000001220000-0x0000000001230000-memory.dmp

Filesize
64KB

Download
memory/4856-427-0x000000001BAF0000-0x000000001BB96000-memory.dmp

Filesize
664KB

Download