blacknet | e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97cb3fda3cff430377a866d6b437de8f.exe
Size

220KB
MD5

97cb3fda3cff430377a866d6b437de8f
SHA1

2359c8459c1e1dd133c2842b51d2982e63016f92
SHA256

e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a
SHA512

e192d3afaa093b5b11643aafefa8192cfeb79e5f284e6c757532fd3e2a4a93970f5f8d54b0e983b4c406ced46aee04a99c186f31ff321f9292c51587603c630f
SSDEEP

3072:alaJEgEXbfa9K4Em8wNBiXMhDJv7WehI2135eDRCyqTp0FUSVBOHfHAXTRsPCgfr:BEg4S9KqiSJvthI25ebqqBOKTRsaj2e

Score

10^/10

blacknet bot evasion persistence trojan

Malware Config

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

Bot

http://furyx.de/panel

Mutex

BN[c1916af6f3a468e5b6f5c7f6b9c78982]

Attributes

antivm
false
elevate_uac
false
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
e162b1333458a713bc6916cc8ac4110c
startup
false
usb_spread
true

aes.plain

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\furz.exe	family_blacknet
behavioral2/memory/4844-102-0x0000000000920000-0x0000000000942000-memory.dmp	family_blacknet

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\furz.exe	disable_win_def
behavioral2/memory/4844-102-0x0000000000920000-0x0000000000942000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

furz.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	furz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	furz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	furz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	furz.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

97cb3fda3cff430377a866d6b437de8f.exeUacTest.exefurz.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	97cb3fda3cff430377a866d6b437de8f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	UacTest.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	furz.exe

Executes dropped EXE 5 IoCs

Processes:

furz.exeUacTest.exeInpwdja.exeMnrjvryib.exeWindowsUpdate.exe

pid process

4844 furz.exe
5112 UacTest.exe
2324 Inpwdja.exe
2440 Mnrjvryib.exe
2320 WindowsUpdate.exe

pid	process
4844	furz.exe
5112	UacTest.exe
2324	Inpwdja.exe
2440	Mnrjvryib.exe
2320	WindowsUpdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

97cb3fda3cff430377a866d6b437de8f.exefurz.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe"	97cb3fda3cff430377a866d6b437de8f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e162b1333458a713bc6916cc8ac4110c = "C:\\Windows\\Microsoft\\MyClient\\WindowsUpdate.exe"	furz.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exe

description pid process target process

PID 2616 set thread context of 5060 2616 97cb3fda3cff430377a866d6b437de8f.exe 97cb3fda3cff430377a866d6b437de8f.exe

description	pid	process	target process
PID 2616 set thread context of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	97cb3fda3cff430377a866d6b437de8f.exe

Drops file in Windows directory 3 IoCs

Processes:

furz.exeWindowsUpdate.exe

description	ioc	process
File created	C:\Windows\Microsoft\MyClient\WindowsUpdate.exe	furz.exe
File opened for modification	C:\Windows\Microsoft\MyClient\WindowsUpdate.exe	furz.exe
File created	C:\Windows\Microsoft\MyClient\svchosts.exe	WindowsUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2336 schtasks.exe
1612 schtasks.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4952 taskkill.exe

pid	process
2336	schtasks.exe
1612	schtasks.exe

pid	process
4952	taskkill.exe

Modifies registry class 1 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	97cb3fda3cff430377a866d6b437de8f.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

4764 reg.exe
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

4608 PING.EXE
4052 PING.EXE

pid	process
4764	reg.exe

pid	process
4608	PING.EXE
4052	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exefurz.exepowershell.exe

pid	process
5060	97cb3fda3cff430377a866d6b437de8f.exe
5060	97cb3fda3cff430377a866d6b437de8f.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
3208	powershell.exe
3208	powershell.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exefurz.exetaskkill.exepowershell.exeWindowsUpdate.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	5060	97cb3fda3cff430377a866d6b437de8f.exe
Token: SeDebugPrivilege	4844	furz.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	2320	WindowsUpdate.exe
Token: SeDebugPrivilege	2024	powershell.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

furz.exeWindowsUpdate.exe

pid process

4844 furz.exe
4844 furz.exe
4844 furz.exe
2320 WindowsUpdate.exe
2320 WindowsUpdate.exe
2320 WindowsUpdate.exe

pid	process
4844	furz.exe
4844	furz.exe
4844	furz.exe
2320	WindowsUpdate.exe
2320	WindowsUpdate.exe
2320	WindowsUpdate.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exe97cb3fda3cff430377a866d6b437de8f.execmd.exeUacTest.exeInpwdja.exeMnrjvryib.execmd.execmd.execmd.exefurz.exeWindowsUpdate.exe

description	pid	process	target process
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	97cb3fda3cff430377a866d6b437de8f.exe
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	97cb3fda3cff430377a866d6b437de8f.exe
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	97cb3fda3cff430377a866d6b437de8f.exe
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	97cb3fda3cff430377a866d6b437de8f.exe
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	97cb3fda3cff430377a866d6b437de8f.exe
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	97cb3fda3cff430377a866d6b437de8f.exe
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	97cb3fda3cff430377a866d6b437de8f.exe
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	97cb3fda3cff430377a866d6b437de8f.exe
PID 5060 wrote to memory of 4844	5060	97cb3fda3cff430377a866d6b437de8f.exe	furz.exe
PID 5060 wrote to memory of 4844	5060	97cb3fda3cff430377a866d6b437de8f.exe	furz.exe
PID 5060 wrote to memory of 5112	5060	97cb3fda3cff430377a866d6b437de8f.exe	UacTest.exe
PID 5060 wrote to memory of 5112	5060	97cb3fda3cff430377a866d6b437de8f.exe	UacTest.exe
PID 5060 wrote to memory of 5112	5060	97cb3fda3cff430377a866d6b437de8f.exe	UacTest.exe
PID 5060 wrote to memory of 1992	5060	97cb3fda3cff430377a866d6b437de8f.exe	cmd.exe
PID 5060 wrote to memory of 1992	5060	97cb3fda3cff430377a866d6b437de8f.exe	cmd.exe
PID 5060 wrote to memory of 1992	5060	97cb3fda3cff430377a866d6b437de8f.exe	cmd.exe
PID 1992 wrote to memory of 4608	1992	cmd.exe	PING.EXE
PID 1992 wrote to memory of 4608	1992	cmd.exe	PING.EXE
PID 1992 wrote to memory of 4608	1992	cmd.exe	PING.EXE
PID 1992 wrote to memory of 4052	1992	cmd.exe	PING.EXE
PID 1992 wrote to memory of 4052	1992	cmd.exe	PING.EXE
PID 1992 wrote to memory of 4052	1992	cmd.exe	PING.EXE
PID 5112 wrote to memory of 2324	5112	UacTest.exe	Inpwdja.exe
PID 5112 wrote to memory of 2324	5112	UacTest.exe	Inpwdja.exe
PID 5112 wrote to memory of 2324	5112	UacTest.exe	Inpwdja.exe
PID 5112 wrote to memory of 2440	5112	UacTest.exe	Mnrjvryib.exe
PID 5112 wrote to memory of 2440	5112	UacTest.exe	Mnrjvryib.exe
PID 5112 wrote to memory of 2440	5112	UacTest.exe	Mnrjvryib.exe
PID 2324 wrote to memory of 1236	2324	Inpwdja.exe	cmd.exe
PID 2324 wrote to memory of 1236	2324	Inpwdja.exe	cmd.exe
PID 2440 wrote to memory of 4000	2440	Mnrjvryib.exe	cmd.exe
PID 2440 wrote to memory of 4000	2440	Mnrjvryib.exe	cmd.exe
PID 1236 wrote to memory of 2572	1236	cmd.exe	cmd.exe
PID 1236 wrote to memory of 2572	1236	cmd.exe	cmd.exe
PID 2572 wrote to memory of 4764	2572	cmd.exe	reg.exe
PID 2572 wrote to memory of 4764	2572	cmd.exe	reg.exe
PID 4000 wrote to memory of 4952	4000	cmd.exe	taskkill.exe
PID 4000 wrote to memory of 4952	4000	cmd.exe	taskkill.exe
PID 4844 wrote to memory of 3208	4844	furz.exe	powershell.exe
PID 4844 wrote to memory of 3208	4844	furz.exe	powershell.exe
PID 4844 wrote to memory of 1336	4844	furz.exe	schtasks.exe
PID 4844 wrote to memory of 1336	4844	furz.exe	schtasks.exe
PID 4844 wrote to memory of 2320	4844	furz.exe	WindowsUpdate.exe
PID 4844 wrote to memory of 2320	4844	furz.exe	WindowsUpdate.exe
PID 4844 wrote to memory of 2336	4844	furz.exe	schtasks.exe
PID 4844 wrote to memory of 2336	4844	furz.exe	schtasks.exe
PID 2320 wrote to memory of 2024	2320	WindowsUpdate.exe	powershell.exe
PID 2320 wrote to memory of 2024	2320	WindowsUpdate.exe	powershell.exe
PID 2320 wrote to memory of 4396	2320	WindowsUpdate.exe	schtasks.exe
PID 2320 wrote to memory of 4396	2320	WindowsUpdate.exe	schtasks.exe
PID 2320 wrote to memory of 1612	2320	WindowsUpdate.exe	schtasks.exe
PID 2320 wrote to memory of 1612	2320	WindowsUpdate.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe
"C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2616

C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe
"C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060

C:\Users\Admin\AppData\Local\Temp\furz.exe
"C:\Users\Admin\AppData\Local\Temp\furz.exe"
3⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /delete /tn "WindowsUpdate.exe" /f
4⤵
PID:1336

C:\Windows\Microsoft\MyClient\WindowsUpdate.exe
"C:\Windows\Microsoft\MyClient\WindowsUpdate.exe"
4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /delete /tn "WindowsUpdate.exe" /f
5⤵
PID:4396

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "WindowsUpdate.exe" /sc ONLOGON /tr "C:\Windows\WindowsUpdate.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1612

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "WindowsUpdate.exe" /sc ONLOGON /tr "C:\Windows\WindowsUpdate.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2336

C:\Users\Admin\AppData\Local\Temp\UacTest.exe
"C:\Users\Admin\AppData\Local\Temp\UacTest.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112

C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe
"C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5081.tmp\5082.tmp\5083.bat C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
6⤵
- Suspicious use of WriteProcessMemory
PID:2572

C:\Windows\System32\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
7⤵
- UAC bypass
- Modifies registry key
PID:4764

C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe
"C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\50A0.tmp\50A1.tmp\50A2.bat C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:4000

C:\Windows\system32\taskkill.exe
Taskkill /IM cmd.exe /F
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 100
4⤵
- Runs ping.exe
PID:4608

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 900
4⤵
- Runs ping.exe
PID:4052

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\97cb3fda3cff430377a866d6b437de8f.exe.log
Filesize
507B

MD5
76ffb2f33cb32ade8fc862a67599e9d8

SHA1
920cc4ab75b36d2f9f6e979b74db568973c49130

SHA256
f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310

SHA512
f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\5081.tmp\5082.tmp\5083.bat
Filesize
187B

MD5
befbbfdadeef80e445fdd152a121a6d1

SHA1
67019f2a12662f2ff92dc7977769b0debdbf564e

SHA256
0848f1ac65974856844e59ff3b8d492c88acf43f0fd64505d5bf3fd4e43d9da6

SHA512
867c4ee6cb22ba7ba0d5aa9c16d321f36013588b6057e3f3f0e6de670481ab1f7d46c1553b9410ff753de7e923d1b774db0c8297091fd9c852bdc96fee43ee32

Download Submit
C:\Users\Admin\AppData\Local\Temp\50A0.tmp\50A1.tmp\50A2.bat
Filesize
34B

MD5
4f4ecd10fc86be6be730390c06be67c8

SHA1
4c59c25907109fd48d8d94caaa8b8266ffa3c7c3

SHA256
a9bf329ec3514d7d5698851137d508b763b1a627747b1ce40ddd5c524538459c

SHA512
b4e89c807071e770b9327693032c8d1ebc06811dfeccfe0892e00deb449b75cb5d921ed2f7ae53d3fae00837bd6eed3fcb0bfc7168cad0f0c44997e51e4365f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe
Filesize
88KB

MD5
d1082e6ae11fecd45ebe0f2b3d32230d

SHA1
c070a8395ccb984f5bcd8f22629ffa1b41ea14c1

SHA256
dce696122649ef915c08645cf53e6b118977ce476b076f72d00e3b6f3e309c77

SHA512
d712276a263e77617838a709e4a8d6b18a676832e909f0ab5547d22a128c309c92dc0f1044c62c0782c3f9f3e2103c08dd9eaf6166f17fd7f0165490e17c0ca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe
Filesize
88KB

MD5
5303046dacbdfcb013ff016a72311e22

SHA1
deaef4843f0bfcb1bf57a93a9e5ed1c4a7a1e009

SHA256
46618b299010b375a3be43493d14de102180a042f03bdfa1d3290d04feba587a

SHA512
261f76a0c02366ca31ec4e964bb414bf6c42587eea79079beb4b6c66875f565ff925d45722b40c84fdd6ac844dad1d878381f87d8b28af75a98310f534af2b1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UacTest.exe
Filesize
140KB

MD5
7c011f0ea2387f0124c959e3f663cb4d

SHA1
12e668079661c557963236786bb821af4628ee1b

SHA256
6b69a8fd83ca150642a20128f84cdd2e91aaa6852e705e55e4116caa487903c4

SHA512
f5770246c943a997c96713a721d512fc0eaf530f3b7d22abe56f50d35b582af4b9f86a65113dee0f09aa7766d257ac0b29a9a56348891339399a2923b399925e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_skdg1fri.p14.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\furz.exe
Filesize
117KB

MD5
b72d429d1d690165c7b0de4a074c4a58

SHA1
f0704d227482a80f2f90dab79ed4acd9770fe565

SHA256
b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae

SHA512
f3b565e67d5a15d5305982701bd5f0d37eec0bfe2d152556584fa1d01faf1def6e616d0addea91e0663be084450b49f99e2108cc06a9b50c9e1482f9290b6c5c

Download Submit
memory/2024-180-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/2024-182-0x000002D3814E0000-0x000002D3814F0000-memory.dmp

Filesize
64KB

Download
memory/2024-194-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/2024-181-0x000002D3814E0000-0x000002D3814F0000-memory.dmp

Filesize
64KB

Download
memory/2320-199-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/2320-175-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Filesize
64KB

Download
memory/2320-196-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Filesize
64KB

Download
memory/2320-197-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Filesize
64KB

Download
memory/2320-195-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Filesize
64KB

Download
memory/2320-170-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/2320-176-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Filesize
64KB

Download
memory/2616-12-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/2616-5-0x0000000005860000-0x00000000058FC000-memory.dmp

Filesize
624KB

Download
memory/2616-4-0x00000000056E0000-0x0000000005772000-memory.dmp

Filesize
584KB

Download
memory/2616-3-0x0000000005D70000-0x0000000006314000-memory.dmp

Filesize
5.6MB

Download
memory/2616-7-0x0000000005670000-0x000000000567A000-memory.dmp

Filesize
40KB

Download
memory/2616-2-0x0000000005780000-0x0000000005790000-memory.dmp

Filesize
64KB

Download
memory/2616-1-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/2616-0-0x0000000000CA0000-0x0000000000CDE000-memory.dmp

Filesize
248KB

Download
memory/3208-135-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/3208-146-0x00000289B9280000-0x00000289B92A2000-memory.dmp

Filesize
136KB

Download
memory/3208-147-0x00000289A0410000-0x00000289A0420000-memory.dmp

Filesize
64KB

Download
memory/3208-136-0x00000289A0410000-0x00000289A0420000-memory.dmp

Filesize
64KB

Download
memory/3208-150-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-174-0x000000001EFB0000-0x000000001F0B0000-memory.dmp

Filesize
1024KB

Download
memory/4844-178-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-152-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/4844-154-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/4844-169-0x000000001EFB0000-0x000000001F0B0000-memory.dmp

Filesize
1024KB

Download
memory/4844-102-0x0000000000920000-0x0000000000942000-memory.dmp

Filesize
136KB

Download
memory/4844-171-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-173-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/4844-151-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/4844-106-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-108-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/4844-153-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/5060-110-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/5060-14-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/5060-13-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/5060-11-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/5060-8-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5112-109-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/5112-111-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/5112-107-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/5112-112-0x0000000005050000-0x000000000505A000-memory.dmp

Filesize
40KB

Download
memory/5112-128-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download