njrat | b26f3837d1069076e8e4a4e0dd77c0a375452a8f1829bfdb9bcbc44e01d3347f

Analysis

max time kernel
61s
max time network
64s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
05/02/2025, 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

C0D3X17 (123).rar
Size

37.5MB
MD5

6fd4cf19af37d9fc8860f00675d3d068
SHA1

1b1d72a7d677c1f982d7b46054e904f8619040f4
SHA256

b26f3837d1069076e8e4a4e0dd77c0a375452a8f1829bfdb9bcbc44e01d3347f
SHA512

3cf415dda7f6fc27a5e2a022e837178a4f4ef3e78373cc14454ba1e85aa467308d1fa81a09293a4d7e1c7dd6a6511d1492e9b46654d99af4e98cc18361de154c
SSDEEP

786432:JCqf2YINtXHgh1EiZwgEMLFuBwhamncUpFKJnBh/4UF10hxKqu+J3xtKadQ:IFYINtaEU4MRk4cQFKJBh/NFuxKqP3xu

Score

10^/10

njrat xworm defense_evasion discovery execution persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

1VeDwfujGeaxOsgJ

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000027dc7-13.dat	family_xworm
behavioral1/memory/2984-23-0x0000000000A40000-0x0000000000A4E000-memory.dmp	family_xworm

Njrat family
njrat
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2772	netsh.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\Control Panel\International\Geo\Nation	C0D3X17-NUKER.exe
Key value queried	\REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\Control Panel\International\Geo\Nation	system.dll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\Control Panel\International\Geo\Nation	host.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5b4af3576e30808651ae14fbef1ee719.exe	GameSDK.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5b4af3576e30808651ae14fbef1ee719.exe	GameSDK.exe

Executes dropped EXE 7 IoCs

pid	Process
3152	C0D3X17-NUKER.exe
2984	rundl32.exe
1152	Stable_Network.exe
3300	host.exe
1148	system.dll.exe
4080	GameSDK.exe
1364	CL_Debug_Log.txt

Loads dropped DLL 1 IoCs

pid	Process
1148	system.dll.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5b4af3576e30808651ae14fbef1ee719 = "\"C:\\ProgramData\\GameSDK.exe\" .."	GameSDK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5b4af3576e30808651ae14fbef1ee719 = "\"C:\\ProgramData\\GameSDK.exe\" .."	GameSDK.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
27	raw.githubusercontent.com
25	raw.githubusercontent.com

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000027dca-28.dat	autoit_exe
behavioral1/files/0x0008000000027e22-195.dat	autoit_exe
behavioral1/files/0x0009000000027e20-197.dat	autoit_exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\eVaUexeF4x.txt	system.dll.exe
File opened for modification	C:\Windows\System32\eVaUexeF4x.txt	system.dll.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1784	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C0D3X17-NUKER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stable_Network.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameSDK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CL_Debug_Log.txt

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\C0D3X17\winmgmts:\AOQQJLUY\root\CIMV2	Stable_Network.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1312	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1784	powershell.exe
1784	powershell.exe
1784	powershell.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
240	7zFM.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeRestorePrivilege	240	7zFM.exe
Token: 35	240	7zFM.exe
Token: SeSecurityPrivilege	240	7zFM.exe
Token: SeDebugPrivilege	2984	rundl32.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeRestorePrivilege	1364	CL_Debug_Log.txt
Token: 35	1364	CL_Debug_Log.txt
Token: SeSecurityPrivilege	1364	CL_Debug_Log.txt
Token: SeSecurityPrivilege	1364	CL_Debug_Log.txt
Token: SeDebugPrivilege	4080	GameSDK.exe
Token: 33	4080	GameSDK.exe
Token: SeIncBasePriorityPrivilege	4080	GameSDK.exe
Token: SeDebugPrivilege	4600	powershell_ise.exe
Token: 33	4080	GameSDK.exe
Token: SeIncBasePriorityPrivilege	4080	GameSDK.exe
Token: 33	4080	GameSDK.exe
Token: SeIncBasePriorityPrivilege	4080	GameSDK.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
240	7zFM.exe
240	7zFM.exe
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1152	Stable_Network.exe
1152	Stable_Network.exe
1152	Stable_Network.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 2984	3152	C0D3X17-NUKER.exe	96
PID 3152 wrote to memory of 2984	3152	C0D3X17-NUKER.exe	96
PID 3152 wrote to memory of 1152	3152	C0D3X17-NUKER.exe	97
PID 3152 wrote to memory of 1152	3152	C0D3X17-NUKER.exe	97
PID 3152 wrote to memory of 1152	3152	C0D3X17-NUKER.exe	97
PID 3152 wrote to memory of 3300	3152	C0D3X17-NUKER.exe	98
PID 3152 wrote to memory of 3300	3152	C0D3X17-NUKER.exe	98
PID 3152 wrote to memory of 3300	3152	C0D3X17-NUKER.exe	98
PID 3152 wrote to memory of 1148	3152	C0D3X17-NUKER.exe	99
PID 3152 wrote to memory of 1148	3152	C0D3X17-NUKER.exe	99
PID 1148 wrote to memory of 3008	1148	system.dll.exe	104
PID 1148 wrote to memory of 3008	1148	system.dll.exe	104
PID 3008 wrote to memory of 1784	3008	cmd.exe	105
PID 3008 wrote to memory of 1784	3008	cmd.exe	105
PID 3300 wrote to memory of 4080	3300	host.exe	106
PID 3300 wrote to memory of 4080	3300	host.exe	106
PID 3300 wrote to memory of 4080	3300	host.exe	106
PID 1784 wrote to memory of 4172	1784	powershell.exe	107
PID 1784 wrote to memory of 4172	1784	powershell.exe	107
PID 4172 wrote to memory of 4260	4172	csc.exe	108
PID 4172 wrote to memory of 4260	4172	csc.exe	108
PID 1152 wrote to memory of 1364	1152	Stable_Network.exe	109
PID 1152 wrote to memory of 1364	1152	Stable_Network.exe	109
PID 1152 wrote to memory of 1364	1152	Stable_Network.exe	109
PID 1152 wrote to memory of 4884	1152	Stable_Network.exe	111
PID 1152 wrote to memory of 4884	1152	Stable_Network.exe	111
PID 1152 wrote to memory of 4884	1152	Stable_Network.exe	111
PID 4884 wrote to memory of 1312	4884	cmd.exe	113
PID 4884 wrote to memory of 1312	4884	cmd.exe	113
PID 4884 wrote to memory of 1312	4884	cmd.exe	113
PID 4080 wrote to memory of 2772	4080	GameSDK.exe	116
PID 4080 wrote to memory of 2772	4080	GameSDK.exe	116
PID 4080 wrote to memory of 2772	4080	GameSDK.exe	116

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\C0D3X17 (123).rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:240

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4896

C:\Users\Admin\Desktop\C0D3X17\C0D3X17-NUKER.exe
"C:\Users\Admin\Desktop\C0D3X17\C0D3X17-NUKER.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Users\Admin\AppData\Roaming\rundl32.exe
  "C:\Users\Admin\AppData\Roaming\rundl32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Users\Admin\AppData\Roaming\Stable_Network.exe
  "C:\Users\Admin\AppData\Roaming\Stable_Network.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
    C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1312
- C:\Users\Admin\AppData\Local\Temp\host.exe
  "C:\Users\Admin\AppData\Local\Temp\host.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\ProgramData\GameSDK.exe
    "C:\ProgramData\GameSDK.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\ProgramData\GameSDK.exe" "GameSDK.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2772
- C:\Users\Admin\AppData\Local\Temp\system.dll.exe
  "C:\Users\Admin\AppData\Local\Temp\system.dll.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\mbbdNBRQQE.ps1""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\mbbdNBRQQE.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1784
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tsmmdbix\tsmmdbix.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4172
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B8.tmp" "c:\Users\Admin\AppData\Local\Temp\tsmmdbix\CSC6E0043B747464514BC89BAF4674A980.TMP"
        6⤵
        
        PID:4260

C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "C:\Users\Admin\AppData\Local\Temp\mbbdNBRQQE.ps1"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\32.exe

Filesize
7.4MB

MD5
f71859e5750415fb32eb045e58635cae

SHA1
fa70d2a35caeb0c12214775cad8cdd8ff0583b59

SHA256
8d668f74825fd8cf5809d9c63e36084bd04d672585fb1f5cdda429e052b8488e

SHA512
423bc36ec4d2b811aa54685a70d5b9daad21d31e95759b1437b7b1966bcdd05d322a76c4288dc647b35bd4b1f6acc0c692fa4ba365715e55671da4edef65df1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\64.exe

Filesize
8.4MB

MD5
4f19535079b64da77ce91d429cfbcfdc

SHA1
68b4d4679024111b246c45328db9478f3a67a709

SHA256
fc02c6319cc5b32536a4b1773a5aba82c213fed6de3249d117b2c8ffe5c82b58

SHA512
fcea894e6a00384c4af0d5abd8143a72b122c6e3052b602ee4a150c89b538e4ac5f76dcbc01770548dba6ef67dd13420450d368bfb42ddcf4fd11995181382dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt

Filesize
722KB

MD5
43141e85e7c36e31b52b22ab94d5e574

SHA1
cfd7079a9b268d84b856dc668edbb9ab9ef35312

SHA256
ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d

SHA512
9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt

Filesize
14.6MB

MD5
053bd8fa3b586bd5b8ee60970c6cae44

SHA1
ada9b5270e7025a5438bc0066f68286243db15c7

SHA256
e0e342cd6302970770d542d516a02a445c13f1f6a77799342ced658ca4e3f8ad

SHA512
0bc717c9bc09ee019662ee3cee795ad5510981d36ca706872f776385b4b98826768c5a5136e592e997383690a0d1634d72d4462a05120550a6e5a3295e5a587c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5B8.tmp

Filesize
1KB

MD5
c3c8d641302403f541d6ef45d75dbd88

SHA1
864977fb0d36dc101375e0237fdd4497272a6f64

SHA256
582118bfef3225e2a1de5cb18bb315fe52161f407c24b36e5374929f61b61fac

SHA512
0008ead63ea7f81f4fa77e00377fa0aa2420c1fb01603c5c3c338be5188a559e436f18f4c83068c28c858b5522810ccfc81e386133384205c56e3043e6b7cb21

Download Submit
C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml

Filesize
2KB

MD5
46f2f154060d639b1f5f1ceb47ba9574

SHA1
6bdee2c266f48415b9d580801fea16a9d43faa25

SHA256
a08b36bde4948ac2878d5aaaad2e2cacf0ed2b1fde097b9c6ae2d777843b1d4f

SHA512
752e3042d9e3b50748d4075aca84ab61a975dad6be1d5c1ef6d807e8933048e75221ea0babf935b1aee778bad3f51374ca3984418cb4587d5f2e1de45b07f7a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0l4cbb4p.5ka.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\host.exe

Filesize
22KB

MD5
1b6c329b64a9d5a8b37db35c6ab08d81

SHA1
9d233019f811dc56810102889838e5087a1f18b1

SHA256
4cc11297a2bd2f4d4cbbb8ed3123e46db325a0808a29499897c34e3e49d392f9

SHA512
df80242f2e33269c6cbdfef39460fcfb3f5b44c1f7463c8c897813c9ad2f828769e486469e948dbcd6378791c2917ac8f39cabb38a797207cc55e4cfee794fe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\mbbdNBRQQE.ps1

Filesize
380B

MD5
cbb9a56c9c8d7c3494b508934ace0b98

SHA1
e76539db673cc1751864166494d4d3d1761cb117

SHA256
027703af742d779f4dcde399ac49a3334f1b9e51b199215203e1f4b5e3251fe5

SHA512
f71e0a521c2b0aa034e0a2c9f0efd7d813d8408d118979f8e05ecd3aa6fb94c67793e2302ed9455aad9a63d43a53fa1ac2b3d45f7bdfa1cc8104c9a9ace84129

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

Filesize
1.8MB

MD5
66a65322c9d362a23cf3d3f7735d5430

SHA1
ed59f3e4b0b16b759b866ef7293d26a1512b952e

SHA256
f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

SHA512
0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

Download Submit
C:\Users\Admin\AppData\Local\Temp\system.dll.exe

Filesize
37.2MB

MD5
fe7289489248263aa30870bb95892163

SHA1
c5f853974f90c6f032d7119eae24a811dd4a55af

SHA256
8f41b4f16a02cf70f620b3f9cc8d11eb3d97707eb8d50f418789628ad77c4bf9

SHA512
aebcec7967744dab0f605e349d396a8e397b7e36f9d5f80c38f6caf08f2cf45edb7ab873cfee59082ad7f54bb4b092593c434e1755ec3ca13d8273b734e4c0bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tsmmdbix\tsmmdbix.dll

Filesize
3KB

MD5
3c0c52b8595c65b3572f437ed55c406f

SHA1
a77ae253134866607bc602b65d03f605194a70e9

SHA256
7e34bba6c6c85030a07076880ea4dc1033be67cde7a93a3a337121347fcd5828

SHA512
f8fc290f5fd62610da84bcc612e46ac2a4f33e1a9ad3b823373556e6b70e0403403927d84c04b786b259bf6a0cd9e4ba3ed578ecba6dec394b67cbeb45960cdf

Download Submit
C:\Users\Admin\AppData\Roaming\Stable_Network.exe

Filesize
15.9MB

MD5
a1a51313f8d07d2eb4ca0123108094e1

SHA1
4024e60d52e4c992596b73cb205ea7b4a1a91ae0

SHA256
8753515f422c81bf9bf921d9857f5f7ee0b3f47573e84129092e095147eebd63

SHA512
3a43cdaae6d988f935f4092d5a9a4eb3cf2f2230d438858a3dc24eec6b050c21c1844f899b60fc69ed3d34b76f2f4057b82e8730f149b0103628af7219392e4d

Download Submit
C:\Users\Admin\AppData\Roaming\rundl32.exe

Filesize
32KB

MD5
c51af2c2a47ba5716ba57939bbe28b5d

SHA1
3e7294cba2e81cec02b5c18db9c8e6b6fdea60a6

SHA256
52055979386ff9f81bceaa8a2a2e2be3f0f78e74097bf34b7c7aa8bd0cd01033

SHA512
0f0e9dcd7eb85820e4be8a19cc471b8599c1b69e2750b528e88e8fd508bd994a382f4fdd10850f74966732c6e46a48ec92c9155c1bb516a2e94de70494ade28a

Download Submit
C:\Users\Admin\Desktop\C0D3X17\C0D3X17-NUKER.exe

Filesize
37.5MB

MD5
1723589503194e30504ab703f55b70fd

SHA1
1a74dcf5d737dd91bdeee28859c5d44506be9b16

SHA256
60600f983d15d7313292ae4f84daf1a97fc627bc3f70f5b854004fda492cdc7f

SHA512
7f457e68ab252a22c209c261ad5a97c2b3770fe73fbee1463aeb4d94b8f779344ae99ac019cdc099feda1441256d134674e236744799f9ec7dc065ed1637db93

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tsmmdbix\CSC6E0043B747464514BC89BAF4674A980.TMP

Filesize
652B

MD5
2219f2985061e0310ddd241ebc74e55e

SHA1
822fb386a324ff75de9a7528c3a0006d2435f506

SHA256
64b9e45a9b9c8e86a92aa882d2f66ec542c8a54e8194aab0ae174d21df4137a6

SHA512
4ec35cfd457831939ff335a9e659a27a7b3e1932c3987d52304dfc693288ca82d944e614339da3e97abd9eb033285bc28de06e6a1fa930ab135e7f8bdff7d871

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tsmmdbix\tsmmdbix.0.cs

Filesize
312B

MD5
ecbf151f81ff98f7dff196304a40239e

SHA1
ccf6b97b6f8276656b042d64f0595963fe9ec79c

SHA256
295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8

SHA512
4526a59055a18af6c0c13fb9f55a9a9bc15aa1407b697849e19b6cc32c88ee7206b3efff806bd154d36bce144ae1d9c407c6ea0f5077c54fbe92cd172c203720

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tsmmdbix\tsmmdbix.cmdline

Filesize
369B

MD5
39393a54f82f682c3c4d0be91be40eca

SHA1
74f23a58cec176c451e2aab0603751ddcd6102e7

SHA256
99718da87f03cfdfa4a3f04609d37a1b3f42ef71ae68489c3c5833f3c6ca2445

SHA512
3e870a39e67c39cd05b1a64f3e55062fff5561e9d86d7ec781aae3d19c7fed2849c06047b3999b13dc6c3c6ca790eb4b765b6a27a8c4ea22b6390f62a9c840b3

Download Submit
memory/1784-178-0x000001FBB6360000-0x000001FBB6368000-memory.dmp

Filesize
32KB

Download
memory/1784-164-0x000001FBB6370000-0x000001FBB6392000-memory.dmp

Filesize
136KB

Download
memory/2984-23-0x0000000000A40000-0x0000000000A4E000-memory.dmp

Filesize
56KB

Download
memory/3152-9-0x0000000075050000-0x0000000075601000-memory.dmp

Filesize
5.7MB

Download
memory/3152-7-0x0000000075050000-0x0000000075601000-memory.dmp

Filesize
5.7MB

Download
memory/3152-67-0x0000000075050000-0x0000000075601000-memory.dmp

Filesize
5.7MB

Download
memory/3152-6-0x0000000075052000-0x0000000075053000-memory.dmp

Filesize
4KB

Download
memory/4600-198-0x000001B88BE20000-0x000001B88BE58000-memory.dmp

Filesize
224KB

Download
memory/4600-199-0x000001B8A87F0000-0x000001B8A883A000-memory.dmp

Filesize
296KB

Download
memory/4600-200-0x000001B8A64C0000-0x000001B8A64CE000-memory.dmp

Filesize
56KB

Download
memory/4600-201-0x000001B8A87B0000-0x000001B8A87E8000-memory.dmp

Filesize
224KB

Download
memory/4600-206-0x000001B8A8790000-0x000001B8A8798000-memory.dmp

Filesize
32KB

Download
memory/4600-216-0x000001B8A8A60000-0x000001B8A8A68000-memory.dmp

Filesize
32KB

Download
memory/4600-217-0x000001B8A8A70000-0x000001B8A8A78000-memory.dmp

Filesize
32KB

Download
memory/4600-218-0x000001B8A7E50000-0x000001B8A7E58000-memory.dmp

Filesize
32KB

Download
memory/4600-219-0x000001B8A8D00000-0x000001B8A8D26000-memory.dmp

Filesize
152KB

Download