blacknet | e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97cb3fda3cff430377a866d6b437de8f.exe
Size

220KB
MD5

97cb3fda3cff430377a866d6b437de8f
SHA1

2359c8459c1e1dd133c2842b51d2982e63016f92
SHA256

e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a
SHA512

e192d3afaa093b5b11643aafefa8192cfeb79e5f284e6c757532fd3e2a4a93970f5f8d54b0e983b4c406ced46aee04a99c186f31ff321f9292c51587603c630f
SSDEEP

3072:alaJEgEXbfa9K4Em8wNBiXMhDJv7WehI2135eDRCyqTp0FUSVBOHfHAXTRsPCgfr:BEg4S9KqiSJvthI25ebqqBOKTRsaj2e

Score

10^/10

blacknet bot evasion persistence trojan

Malware Config

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

Bot

http://furyx.de/panel

Mutex

BN[c1916af6f3a468e5b6f5c7f6b9c78982]

Attributes

antivm
false
elevate_uac
false
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
e162b1333458a713bc6916cc8ac4110c
startup
false
usb_spread
true

aes.plain

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/files/0x000600000002321b-19.dat	family_blacknet
behavioral2/memory/4844-102-0x0000000000920000-0x0000000000942000-memory.dmp	family_blacknet

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/files/0x000600000002321b-19.dat	disable_win_def
behavioral2/memory/4844-102-0x0000000000920000-0x0000000000942000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

furz.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	furz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	furz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	furz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	furz.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

97cb3fda3cff430377a866d6b437de8f.exeUacTest.exefurz.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	97cb3fda3cff430377a866d6b437de8f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	UacTest.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	furz.exe

Executes dropped EXE 5 IoCs

Processes:

furz.exeUacTest.exeInpwdja.exeMnrjvryib.exeWindowsUpdate.exe

pid	Process
4844	furz.exe
5112	UacTest.exe
2324	Inpwdja.exe
2440	Mnrjvryib.exe
2320	WindowsUpdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

97cb3fda3cff430377a866d6b437de8f.exefurz.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe"	97cb3fda3cff430377a866d6b437de8f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e162b1333458a713bc6916cc8ac4110c = "C:\\Windows\\Microsoft\\MyClient\\WindowsUpdate.exe"	furz.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exe

description	pid	Process	procid_target
PID 2616 set thread context of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87

Drops file in Windows directory 3 IoCs

Processes:

furz.exeWindowsUpdate.exe

description	ioc	Process
File created	C:\Windows\Microsoft\MyClient\WindowsUpdate.exe	furz.exe
File opened for modification	C:\Windows\Microsoft\MyClient\WindowsUpdate.exe	furz.exe
File created	C:\Windows\Microsoft\MyClient\svchosts.exe	WindowsUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exe

pid	Process
2336	schtasks.exe
1612	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

Processes:

taskkill.exe

pid	Process
4952	taskkill.exe

Modifies registry class 1 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	97cb3fda3cff430377a866d6b437de8f.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
4764	reg.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXE

pid	Process
4608	PING.EXE
4052	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exefurz.exepowershell.exe

pid	Process
5060	97cb3fda3cff430377a866d6b437de8f.exe
5060	97cb3fda3cff430377a866d6b437de8f.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
3208	powershell.exe
3208	powershell.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exefurz.exetaskkill.exepowershell.exeWindowsUpdate.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	5060	97cb3fda3cff430377a866d6b437de8f.exe
Token: SeDebugPrivilege	4844	furz.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	2320	WindowsUpdate.exe
Token: SeDebugPrivilege	2024	powershell.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

furz.exeWindowsUpdate.exe

pid	Process
4844	furz.exe
4844	furz.exe
4844	furz.exe
2320	WindowsUpdate.exe
2320	WindowsUpdate.exe
2320	WindowsUpdate.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

97cb3fda3cff430377a866d6b437de8f.exe97cb3fda3cff430377a866d6b437de8f.execmd.exeUacTest.exeInpwdja.exeMnrjvryib.execmd.execmd.execmd.exefurz.exeWindowsUpdate.exe

description	pid	Process	procid_target
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 5060 wrote to memory of 4844	5060	97cb3fda3cff430377a866d6b437de8f.exe	88
PID 5060 wrote to memory of 4844	5060	97cb3fda3cff430377a866d6b437de8f.exe	88
PID 5060 wrote to memory of 5112	5060	97cb3fda3cff430377a866d6b437de8f.exe	89
PID 5060 wrote to memory of 5112	5060	97cb3fda3cff430377a866d6b437de8f.exe	89
PID 5060 wrote to memory of 5112	5060	97cb3fda3cff430377a866d6b437de8f.exe	89
PID 5060 wrote to memory of 1992	5060	97cb3fda3cff430377a866d6b437de8f.exe	90
PID 5060 wrote to memory of 1992	5060	97cb3fda3cff430377a866d6b437de8f.exe	90
PID 5060 wrote to memory of 1992	5060	97cb3fda3cff430377a866d6b437de8f.exe	90
PID 1992 wrote to memory of 4608	1992	cmd.exe	92
PID 1992 wrote to memory of 4608	1992	cmd.exe	92
PID 1992 wrote to memory of 4608	1992	cmd.exe	92
PID 1992 wrote to memory of 4052	1992	cmd.exe	93
PID 1992 wrote to memory of 4052	1992	cmd.exe	93
PID 1992 wrote to memory of 4052	1992	cmd.exe	93
PID 5112 wrote to memory of 2324	5112	UacTest.exe	94
PID 5112 wrote to memory of 2324	5112	UacTest.exe	94
PID 5112 wrote to memory of 2324	5112	UacTest.exe	94
PID 5112 wrote to memory of 2440	5112	UacTest.exe	95
PID 5112 wrote to memory of 2440	5112	UacTest.exe	95
PID 5112 wrote to memory of 2440	5112	UacTest.exe	95
PID 2324 wrote to memory of 1236	2324	Inpwdja.exe	98
PID 2324 wrote to memory of 1236	2324	Inpwdja.exe	98
PID 2440 wrote to memory of 4000	2440	Mnrjvryib.exe	99
PID 2440 wrote to memory of 4000	2440	Mnrjvryib.exe	99
PID 1236 wrote to memory of 2572	1236	cmd.exe	100
PID 1236 wrote to memory of 2572	1236	cmd.exe	100
PID 2572 wrote to memory of 4764	2572	cmd.exe	101
PID 2572 wrote to memory of 4764	2572	cmd.exe	101
PID 4000 wrote to memory of 4952	4000	cmd.exe	102
PID 4000 wrote to memory of 4952	4000	cmd.exe	102
PID 4844 wrote to memory of 3208	4844	furz.exe	104
PID 4844 wrote to memory of 3208	4844	furz.exe	104
PID 4844 wrote to memory of 1336	4844	furz.exe	106
PID 4844 wrote to memory of 1336	4844	furz.exe	106
PID 4844 wrote to memory of 2320	4844	furz.exe	108
PID 4844 wrote to memory of 2320	4844	furz.exe	108
PID 4844 wrote to memory of 2336	4844	furz.exe	109
PID 4844 wrote to memory of 2336	4844	furz.exe	109
PID 2320 wrote to memory of 2024	2320	WindowsUpdate.exe	111
PID 2320 wrote to memory of 2024	2320	WindowsUpdate.exe	111
PID 2320 wrote to memory of 4396	2320	WindowsUpdate.exe	116
PID 2320 wrote to memory of 4396	2320	WindowsUpdate.exe	116
PID 2320 wrote to memory of 1612	2320	WindowsUpdate.exe	120
PID 2320 wrote to memory of 1612	2320	WindowsUpdate.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe
"C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe
  "C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Users\Admin\AppData\Local\Temp\furz.exe
    "C:\Users\Admin\AppData\Local\Temp\furz.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3208
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /delete /tn "WindowsUpdate.exe" /f
      4⤵
      PID:1336
  - - C:\Windows\Microsoft\MyClient\WindowsUpdate.exe
      "C:\Windows\Microsoft\MyClient\WindowsUpdate.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-MpPreference -verbose
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /delete /tn "WindowsUpdate.exe" /f
        5⤵
        
        PID:4396
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "WindowsUpdate.exe" /sc ONLOGON /tr "C:\Windows\WindowsUpdate.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:1612
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsUpdate.exe" /sc ONLOGON /tr "C:\Windows\WindowsUpdate.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:2336
- - C:\Users\Admin\AppData\Local\Temp\UacTest.exe
    "C:\Users\Admin\AppData\Local\Temp\UacTest.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe
      "C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2324
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5081.tmp\5082.tmp\5083.bat C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1236
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe
      "C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2440
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\50A0.tmp\50A1.tmp\50A2.bat C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4000
      - C:\Windows\system32\taskkill.exe
        
        Taskkill /IM cmd.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 100
      4⤵
      Runs ping.exe
      PID:4608
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 900
      4⤵
      Runs ping.exe
      PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\97cb3fda3cff430377a866d6b437de8f.exe.log

Filesize
507B

MD5
76ffb2f33cb32ade8fc862a67599e9d8

SHA1
920cc4ab75b36d2f9f6e979b74db568973c49130

SHA256
f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310

SHA512
f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\5081.tmp\5082.tmp\5083.bat

Filesize
187B

MD5
befbbfdadeef80e445fdd152a121a6d1

SHA1
67019f2a12662f2ff92dc7977769b0debdbf564e

SHA256
0848f1ac65974856844e59ff3b8d492c88acf43f0fd64505d5bf3fd4e43d9da6

SHA512
867c4ee6cb22ba7ba0d5aa9c16d321f36013588b6057e3f3f0e6de670481ab1f7d46c1553b9410ff753de7e923d1b774db0c8297091fd9c852bdc96fee43ee32

Download Submit
C:\Users\Admin\AppData\Local\Temp\50A0.tmp\50A1.tmp\50A2.bat

Filesize
34B

MD5
4f4ecd10fc86be6be730390c06be67c8

SHA1
4c59c25907109fd48d8d94caaa8b8266ffa3c7c3

SHA256
a9bf329ec3514d7d5698851137d508b763b1a627747b1ce40ddd5c524538459c

SHA512
b4e89c807071e770b9327693032c8d1ebc06811dfeccfe0892e00deb449b75cb5d921ed2f7ae53d3fae00837bd6eed3fcb0bfc7168cad0f0c44997e51e4365f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe

Filesize
88KB

MD5
d1082e6ae11fecd45ebe0f2b3d32230d

SHA1
c070a8395ccb984f5bcd8f22629ffa1b41ea14c1

SHA256
dce696122649ef915c08645cf53e6b118977ce476b076f72d00e3b6f3e309c77

SHA512
d712276a263e77617838a709e4a8d6b18a676832e909f0ab5547d22a128c309c92dc0f1044c62c0782c3f9f3e2103c08dd9eaf6166f17fd7f0165490e17c0ca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe

Filesize
88KB

MD5
5303046dacbdfcb013ff016a72311e22

SHA1
deaef4843f0bfcb1bf57a93a9e5ed1c4a7a1e009

SHA256
46618b299010b375a3be43493d14de102180a042f03bdfa1d3290d04feba587a

SHA512
261f76a0c02366ca31ec4e964bb414bf6c42587eea79079beb4b6c66875f565ff925d45722b40c84fdd6ac844dad1d878381f87d8b28af75a98310f534af2b1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UacTest.exe

Filesize
140KB

MD5
7c011f0ea2387f0124c959e3f663cb4d

SHA1
12e668079661c557963236786bb821af4628ee1b

SHA256
6b69a8fd83ca150642a20128f84cdd2e91aaa6852e705e55e4116caa487903c4

SHA512
f5770246c943a997c96713a721d512fc0eaf530f3b7d22abe56f50d35b582af4b9f86a65113dee0f09aa7766d257ac0b29a9a56348891339399a2923b399925e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_skdg1fri.p14.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\furz.exe

Filesize
117KB

MD5
b72d429d1d690165c7b0de4a074c4a58

SHA1
f0704d227482a80f2f90dab79ed4acd9770fe565

SHA256
b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae

SHA512
f3b565e67d5a15d5305982701bd5f0d37eec0bfe2d152556584fa1d01faf1def6e616d0addea91e0663be084450b49f99e2108cc06a9b50c9e1482f9290b6c5c

Download Submit
memory/2024-180-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/2024-182-0x000002D3814E0000-0x000002D3814F0000-memory.dmp

Filesize
64KB

Download
memory/2024-194-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/2024-181-0x000002D3814E0000-0x000002D3814F0000-memory.dmp

Filesize
64KB

Download
memory/2320-199-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/2320-175-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Filesize
64KB

Download
memory/2320-196-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Filesize
64KB

Download
memory/2320-197-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Filesize
64KB

Download
memory/2320-195-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Filesize
64KB

Download
memory/2320-170-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/2320-176-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Filesize
64KB

Download
memory/2616-12-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/2616-5-0x0000000005860000-0x00000000058FC000-memory.dmp

Filesize
624KB

Download
memory/2616-4-0x00000000056E0000-0x0000000005772000-memory.dmp

Filesize
584KB

Download
memory/2616-3-0x0000000005D70000-0x0000000006314000-memory.dmp

Filesize
5.6MB

Download
memory/2616-7-0x0000000005670000-0x000000000567A000-memory.dmp

Filesize
40KB

Download
memory/2616-2-0x0000000005780000-0x0000000005790000-memory.dmp

Filesize
64KB

Download
memory/2616-1-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/2616-0-0x0000000000CA0000-0x0000000000CDE000-memory.dmp

Filesize
248KB

Download
memory/3208-135-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/3208-146-0x00000289B9280000-0x00000289B92A2000-memory.dmp

Filesize
136KB

Download
memory/3208-147-0x00000289A0410000-0x00000289A0420000-memory.dmp

Filesize
64KB

Download
memory/3208-136-0x00000289A0410000-0x00000289A0420000-memory.dmp

Filesize
64KB

Download
memory/3208-150-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-174-0x000000001EFB0000-0x000000001F0B0000-memory.dmp

Filesize
1024KB

Download
memory/4844-178-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-152-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/4844-154-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/4844-169-0x000000001EFB0000-0x000000001F0B0000-memory.dmp

Filesize
1024KB

Download
memory/4844-102-0x0000000000920000-0x0000000000942000-memory.dmp

Filesize
136KB

Download
memory/4844-171-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-173-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/4844-151-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/4844-106-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-108-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/4844-153-0x0000000002A10000-0x0000000002A20000-memory.dmp

Filesize
64KB

Download
memory/5060-110-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/5060-14-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/5060-13-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/5060-11-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/5060-8-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5112-109-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/5112-111-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/5112-107-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/5112-112-0x0000000005050000-0x000000000505A000-memory.dmp

Filesize
40KB

Download
memory/5112-128-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download