55a0b99736fb2dd86d1e051c2edda7dbd7a82ea18dbc424965a92f283f7b4c3f

Analysis

max time kernel
61s
max time network
136s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
01-08-2023 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55a0b99736fb2dd86d1e051c2edda7dbd7a82ea18dbc424965a92f283f7b4c3f.exe
Size

1.4MB
MD5

93de327dfe24a0459e21835da5fe5f70
SHA1

5fa22ea8ccf2fa421e9e71bf02770d14cfafbb22
SHA256

55a0b99736fb2dd86d1e051c2edda7dbd7a82ea18dbc424965a92f283f7b4c3f
SHA512

eebe70b98b74ab047f799d5afbe307fe70f429bf070bbc328953153c36decf70bf69cea2b00d1d085c0cc48cbb477a118b2f05a83097b94b8536433b8725050d
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

8^/10

evasion upx

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
2044	netsh.exe
5088	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000700000001afb6-254.dat	acprotect
behavioral1/files/0x000700000001afb6-255.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
4796	7z.exe

Loads dropped DLL 1 IoCs

pid	Process
4796	7z.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001afb9-251.dat	upx
behavioral1/files/0x000700000001afb9-253.dat	upx
behavioral1/memory/4796-252-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x000700000001afb6-254.dat	upx
behavioral1/files/0x000700000001afb6-255.dat	upx
behavioral1/memory/4796-256-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/memory/4796-260-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
4124	PING.EXE
4192	PING.EXE
4532	PING.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe
4756	powershell.exe
4756	powershell.exe
4756	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
3000	powershell.exe
3000	powershell.exe
3000	powershell.exe
5080	powershell.exe
5080	powershell.exe
5080	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2380	WMIC.exe
Token: SeSecurityPrivilege	2380	WMIC.exe
Token: SeTakeOwnershipPrivilege	2380	WMIC.exe
Token: SeLoadDriverPrivilege	2380	WMIC.exe
Token: SeSystemProfilePrivilege	2380	WMIC.exe
Token: SeSystemtimePrivilege	2380	WMIC.exe
Token: SeProfSingleProcessPrivilege	2380	WMIC.exe
Token: SeIncBasePriorityPrivilege	2380	WMIC.exe
Token: SeCreatePagefilePrivilege	2380	WMIC.exe
Token: SeBackupPrivilege	2380	WMIC.exe
Token: SeRestorePrivilege	2380	WMIC.exe
Token: SeShutdownPrivilege	2380	WMIC.exe
Token: SeDebugPrivilege	2380	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2380	WMIC.exe
Token: SeRemoteShutdownPrivilege	2380	WMIC.exe
Token: SeUndockPrivilege	2380	WMIC.exe
Token: SeManageVolumePrivilege	2380	WMIC.exe
Token: 33	2380	WMIC.exe
Token: 34	2380	WMIC.exe
Token: 35	2380	WMIC.exe
Token: 36	2380	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2380	WMIC.exe
Token: SeSecurityPrivilege	2380	WMIC.exe
Token: SeTakeOwnershipPrivilege	2380	WMIC.exe
Token: SeLoadDriverPrivilege	2380	WMIC.exe
Token: SeSystemProfilePrivilege	2380	WMIC.exe
Token: SeSystemtimePrivilege	2380	WMIC.exe
Token: SeProfSingleProcessPrivilege	2380	WMIC.exe
Token: SeIncBasePriorityPrivilege	2380	WMIC.exe
Token: SeCreatePagefilePrivilege	2380	WMIC.exe
Token: SeBackupPrivilege	2380	WMIC.exe
Token: SeRestorePrivilege	2380	WMIC.exe
Token: SeShutdownPrivilege	2380	WMIC.exe
Token: SeDebugPrivilege	2380	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2380	WMIC.exe
Token: SeRemoteShutdownPrivilege	2380	WMIC.exe
Token: SeUndockPrivilege	2380	WMIC.exe
Token: SeManageVolumePrivilege	2380	WMIC.exe
Token: 33	2380	WMIC.exe
Token: 34	2380	WMIC.exe
Token: 35	2380	WMIC.exe
Token: 36	2380	WMIC.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeIncreaseQuotaPrivilege	4424	WMIC.exe
Token: SeSecurityPrivilege	4424	WMIC.exe
Token: SeTakeOwnershipPrivilege	4424	WMIC.exe
Token: SeLoadDriverPrivilege	4424	WMIC.exe
Token: SeSystemProfilePrivilege	4424	WMIC.exe
Token: SeSystemtimePrivilege	4424	WMIC.exe
Token: SeProfSingleProcessPrivilege	4424	WMIC.exe
Token: SeIncBasePriorityPrivilege	4424	WMIC.exe
Token: SeCreatePagefilePrivilege	4424	WMIC.exe
Token: SeBackupPrivilege	4424	WMIC.exe
Token: SeRestorePrivilege	4424	WMIC.exe
Token: SeShutdownPrivilege	4424	WMIC.exe
Token: SeDebugPrivilege	4424	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4424	WMIC.exe
Token: SeRemoteShutdownPrivilege	4424	WMIC.exe
Token: SeUndockPrivilege	4424	WMIC.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 4272	1660	55a0b99736fb2dd86d1e051c2edda7dbd7a82ea18dbc424965a92f283f7b4c3f.exe	69
PID 1660 wrote to memory of 4272	1660	55a0b99736fb2dd86d1e051c2edda7dbd7a82ea18dbc424965a92f283f7b4c3f.exe	69
PID 1660 wrote to memory of 4272	1660	55a0b99736fb2dd86d1e051c2edda7dbd7a82ea18dbc424965a92f283f7b4c3f.exe	69
PID 4272 wrote to memory of 4712	4272	cmd.exe	72
PID 4272 wrote to memory of 4712	4272	cmd.exe	72
PID 4272 wrote to memory of 4712	4272	cmd.exe	72
PID 4712 wrote to memory of 3824	4712	cmd.exe	73
PID 4712 wrote to memory of 3824	4712	cmd.exe	73
PID 4712 wrote to memory of 3824	4712	cmd.exe	73
PID 4272 wrote to memory of 1108	4272	cmd.exe	74
PID 4272 wrote to memory of 1108	4272	cmd.exe	74
PID 4272 wrote to memory of 1108	4272	cmd.exe	74
PID 1108 wrote to memory of 2380	1108	cmd.exe	75
PID 1108 wrote to memory of 2380	1108	cmd.exe	75
PID 1108 wrote to memory of 2380	1108	cmd.exe	75
PID 4272 wrote to memory of 3424	4272	cmd.exe	77
PID 4272 wrote to memory of 3424	4272	cmd.exe	77
PID 4272 wrote to memory of 3424	4272	cmd.exe	77
PID 4272 wrote to memory of 4416	4272	cmd.exe	78
PID 4272 wrote to memory of 4416	4272	cmd.exe	78
PID 4272 wrote to memory of 4416	4272	cmd.exe	78
PID 4272 wrote to memory of 4756	4272	cmd.exe	79
PID 4272 wrote to memory of 4756	4272	cmd.exe	79
PID 4272 wrote to memory of 4756	4272	cmd.exe	79
PID 4272 wrote to memory of 4952	4272	cmd.exe	80
PID 4272 wrote to memory of 4952	4272	cmd.exe	80
PID 4272 wrote to memory of 4952	4272	cmd.exe	80
PID 4272 wrote to memory of 3000	4272	cmd.exe	81
PID 4272 wrote to memory of 3000	4272	cmd.exe	81
PID 4272 wrote to memory of 3000	4272	cmd.exe	81
PID 4272 wrote to memory of 4796	4272	cmd.exe	82
PID 4272 wrote to memory of 4796	4272	cmd.exe	82
PID 4272 wrote to memory of 4796	4272	cmd.exe	82
PID 4272 wrote to memory of 5080	4272	cmd.exe	83
PID 4272 wrote to memory of 5080	4272	cmd.exe	83
PID 4272 wrote to memory of 5080	4272	cmd.exe	83
PID 5080 wrote to memory of 2044	5080	powershell.exe	84
PID 5080 wrote to memory of 2044	5080	powershell.exe	84
PID 5080 wrote to memory of 2044	5080	powershell.exe	84
PID 5080 wrote to memory of 5088	5080	powershell.exe	85
PID 5080 wrote to memory of 5088	5080	powershell.exe	85
PID 5080 wrote to memory of 5088	5080	powershell.exe	85
PID 5080 wrote to memory of 2808	5080	powershell.exe	86
PID 5080 wrote to memory of 2808	5080	powershell.exe	86
PID 5080 wrote to memory of 2808	5080	powershell.exe	86
PID 2808 wrote to memory of 4424	2808	cmd.exe	87
PID 2808 wrote to memory of 4424	2808	cmd.exe	87
PID 2808 wrote to memory of 4424	2808	cmd.exe	87
PID 5080 wrote to memory of 4792	5080	powershell.exe	88
PID 5080 wrote to memory of 4792	5080	powershell.exe	88
PID 5080 wrote to memory of 4792	5080	powershell.exe	88
PID 4792 wrote to memory of 4596	4792	cmd.exe	89
PID 4792 wrote to memory of 4596	4792	cmd.exe	89
PID 4792 wrote to memory of 4596	4792	cmd.exe	89

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3448	attrib.exe

C:\Users\Admin\AppData\Local\Temp\55a0b99736fb2dd86d1e051c2edda7dbd7a82ea18dbc424965a92f283f7b4c3f.exe
"C:\Users\Admin\AppData\Local\Temp\55a0b99736fb2dd86d1e051c2edda7dbd7a82ea18dbc424965a92f283f7b4c3f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:3824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2380
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3424
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4796
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2044
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:5088
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="KUPIWSCI" set AutomaticManagedPagefile=False
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4792
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:4596
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      PID:4932
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:32
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 6
        6⤵
        Runs ping.exe
        
        PID:4124
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:2092
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 20 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:2220
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 20
        6⤵
        Runs ping.exe
        
        PID:4192
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:3448
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    PID:2176
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    PID:4908
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 12 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 12 > nul && "C:\Users\Admin\Music\rot.exe"
      4⤵
      PID:4948
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 12
        5⤵
        Runs ping.exe
        
        PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
423.9MB

MD5
c5fe461c7aba96f1752dcd52d9b00894

SHA1
06ad5990bb95e3e63cf566cb8329909e77786d80

SHA256
58c28fb92579827c4edaff92da609af5116a81241bf83ee4bcc3a74dcd3fb7b2

SHA512
9b315a521438c11acfff08cc2604dda55280d8d165ff33eac68e8f7673c25666e19bf1c9937f2e8a3946ba61b8313df66e6173b9a8602601a2400f68d9e98974

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
390.1MB

MD5
82087c719e2d969f0541742304db3861

SHA1
ddeb035b7792138afb8f1360d109b62e36df2ddc

SHA256
fe9fa7b0ded4306cf05b524295c5cbbd07559db432a8accf7a66b01a7a4dabe0

SHA512
537f7bd6a7945ab7d9d0841e1b4b1733583f8fd150caa0b16d3b94b7790c9117aee66f10725c6a7d4409097b7d7291f3b37329f4b151da212a29e493abf101e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
0f5cbdca905beb13bebdcf43fb0716bd

SHA1
9e136131389fde83297267faf6c651d420671b3f

SHA256
a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060

SHA512
a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ratt.exe.log

Filesize
1KB

MD5
9e104e9aa0cfdec0753de24cbe3f587b

SHA1
f63b8d0b29c65e518be6a9412e7499c9de11be78

SHA256
59a9f13de0e003ea4adcd0193477f147b0c91ae847eebc744e91a4efe167223f

SHA512
8253854159ceac2d84eb371c9672730831505dea52ac3bc2cca45ee5308717ca3f11734602d0a409974b137084a8c20e6b7653640991e45708f692c65ac4933b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
96e1f094c29c7d20cb4122dc36d18db2

SHA1
46f16b81b6be2ec9f84499c3a24a35530ca8ff64

SHA256
8f4bf77380f071a16179b0fd9c823e1a6d79715842b48f5a1c980140b32cc724

SHA512
104e29dc1f6b9c2526e5c9133bb7e9231294b9ae0cbc743853bb765c886467d503ddcaeb96c2dd8fa9e478f6bfcf48dc6e7b56e3f7665752f2e8fcd0f896bc2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
cdd03de9b83b419d83604c6eb47d53b2

SHA1
8ce0a987d9edbc5327f1627da3981faffdc95402

SHA256
9dba6269d5e9b8ea0e682dbbed7c152a101f7c67d35ec7682d9da7df6d689a43

SHA512
2f7be1e84c20f0aca2d42e9b9dfd8fd2ad7c621f91eab59d0047beea7b0b500fad86207925df83644c3c87fb77c0511597c2ca42ad469e9bead8e8a1b84d8551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
81a9cda068068740c655a9a95de7d427

SHA1
922ccf3d98aded3a1fc0f471fb395918f669e548

SHA256
60337bc8bafca3962f1ca820bc23c231d66c3f6525f58805e189152fcf31ddc0

SHA512
c1015b183f525456b9399a65380ac8b47362ff8f05dffbe69382f9653a65680e0258cf5785d621f967734b73edeea7bbfee35a59b2e985a995b3c014b465787d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
8462aea670db08c169518fd48ffd7b4e

SHA1
62d218118926332b0cfbaf47e23eefb8e5990a31

SHA256
b59dfddc42a104b74b8d429fd7344772b53b1d5bf392e0f9394d188b79c05105

SHA512
cea25f99a567931e966afc920b9e19e6a3d496edb8751239b40feb17ca993047150adf2ad6cee082d838c33b4f89e678a9b994d913d12f6c2a0e0295db3f0ab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
b8fcd150250c88f45bd0a050f4e6fd76

SHA1
d94ae614cd6d5491f5d9ec3f7309d4cd66cbedab

SHA256
d58066828261f69d837473954db22fccdf77ca093f6d0aefb3abdf6d414f92bf

SHA512
410760590e0b111daa6a7e41804006c1c6b891e48455895409e2e55f74342b3bbf114e5a4b30b0cfdef457f0e987226e5b371d4a1b77a87f018eb9701d1158f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xk0l2saz.of2.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
745.1MB

MD5
be788bb3680cf3809d9678ee6f7ba321

SHA1
499f01d5f654f83e172004dcc03f99abdd251734

SHA256
03a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b

SHA512
83c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
311.4MB

MD5
d3a8839bdde9e7770c6857976845afee

SHA1
8f0ea8a8356cf7a6cfbbc240fc80db75980f1952

SHA256
9d16cbdab8f9f3e014326b52b5750e5344573d5292b7d3debf1cf3c85cbc97ef

SHA512
891e3043eb14815ff6ff95246c5f3c2995030800d5ced898f7d6c94b3db505115db5bbb2cdf3788da0c2a97c3a925d5c9e6f2d65cf27e04c4a8726c745068474

Download Submit
\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
memory/3000-231-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/3000-245-0x0000000004A10000-0x0000000004A20000-memory.dmp

Filesize
64KB

Download
memory/3000-247-0x0000000004A10000-0x0000000004A20000-memory.dmp

Filesize
64KB

Download
memory/3000-249-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/3000-233-0x0000000004A10000-0x0000000004A20000-memory.dmp

Filesize
64KB

Download
memory/3000-232-0x0000000004A10000-0x0000000004A20000-memory.dmp

Filesize
64KB

Download
memory/3424-138-0x00000000052E0000-0x0000000005316000-memory.dmp

Filesize
216KB

Download
memory/3424-148-0x0000000008CD0000-0x0000000008D1B000-memory.dmp

Filesize
300KB

Download
memory/3424-140-0x0000000005390000-0x00000000053A0000-memory.dmp

Filesize
64KB

Download
memory/3424-143-0x0000000007A00000-0x0000000007A22000-memory.dmp

Filesize
136KB

Download
memory/3424-144-0x00000000082B0000-0x0000000008316000-memory.dmp

Filesize
408KB

Download
memory/3424-145-0x0000000007BA0000-0x0000000007C06000-memory.dmp

Filesize
408KB

Download
memory/3424-149-0x0000000008A90000-0x0000000008B06000-memory.dmp

Filesize
472KB

Download
memory/3424-142-0x0000000007C10000-0x0000000008238000-memory.dmp

Filesize
6.2MB

Download
memory/3424-146-0x00000000083E0000-0x0000000008730000-memory.dmp

Filesize
3.3MB

Download
memory/3424-139-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/3424-165-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/3424-160-0x0000000005390000-0x00000000053A0000-memory.dmp

Filesize
64KB

Download
memory/3424-141-0x0000000005390000-0x00000000053A0000-memory.dmp

Filesize
64KB

Download
memory/3424-161-0x0000000005390000-0x00000000053A0000-memory.dmp

Filesize
64KB

Download
memory/3424-147-0x0000000008340000-0x000000000835C000-memory.dmp

Filesize
112KB

Download
memory/4416-172-0x00000000086A0000-0x00000000086EB000-memory.dmp

Filesize
300KB

Download
memory/4416-186-0x0000000003300000-0x0000000003310000-memory.dmp

Filesize
64KB

Download
memory/4416-187-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/4416-183-0x0000000003300000-0x0000000003310000-memory.dmp

Filesize
64KB

Download
memory/4416-169-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/4416-170-0x0000000003300000-0x0000000003310000-memory.dmp

Filesize
64KB

Download
memory/4756-203-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/4756-190-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/4756-206-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/4756-207-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/4756-191-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/4796-252-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4796-260-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4796-256-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/4932-576-0x00000000053E0000-0x0000000005472000-memory.dmp

Filesize
584KB

Download
memory/4932-572-0x0000000005270000-0x000000000530C000-memory.dmp

Filesize
624KB

Download
memory/4932-568-0x00000000009A0000-0x0000000000B56000-memory.dmp

Filesize
1.7MB

Download
memory/4932-566-0x0000000073E80000-0x000000007456E000-memory.dmp

Filesize
6.9MB

Download
memory/4952-210-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/4952-212-0x0000000007480000-0x0000000007490000-memory.dmp

Filesize
64KB

Download
memory/4952-211-0x0000000007480000-0x0000000007490000-memory.dmp

Filesize
64KB

Download
memory/4952-224-0x0000000007480000-0x0000000007490000-memory.dmp

Filesize
64KB

Download
memory/4952-228-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/4952-225-0x0000000007480000-0x0000000007490000-memory.dmp

Filesize
64KB

Download
memory/5080-289-0x0000000073E80000-0x000000007456E000-memory.dmp

Filesize
6.9MB

Download
memory/5080-297-0x0000000008E20000-0x0000000008E3E000-memory.dmp

Filesize
120KB

Download
memory/5080-302-0x0000000009180000-0x0000000009225000-memory.dmp

Filesize
660KB

Download
memory/5080-303-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/5080-304-0x00000000092D0000-0x0000000009364000-memory.dmp

Filesize
592KB

Download
memory/5080-487-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/5080-498-0x0000000008DC0000-0x0000000008DDA000-memory.dmp

Filesize
104KB

Download
memory/5080-503-0x0000000008DB0000-0x0000000008DB8000-memory.dmp

Filesize
32KB

Download
memory/5080-529-0x0000000009CB0000-0x000000000A328000-memory.dmp

Filesize
6.5MB

Download
memory/5080-530-0x0000000009230000-0x000000000924A000-memory.dmp

Filesize
104KB

Download
memory/5080-535-0x00000000092A0000-0x00000000092C2000-memory.dmp

Filesize
136KB

Download
memory/5080-536-0x000000000A330000-0x000000000A82E000-memory.dmp

Filesize
5.0MB

Download
memory/5080-296-0x00000000090C0000-0x00000000090F3000-memory.dmp

Filesize
204KB

Download
memory/5080-291-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/5080-290-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/5080-271-0x0000000007C10000-0x0000000007C5B000-memory.dmp

Filesize
300KB

Download
memory/5080-269-0x0000000007760000-0x0000000007AB0000-memory.dmp

Filesize
3.3MB

Download
memory/5080-268-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/5080-267-0x0000000006910000-0x0000000006920000-memory.dmp

Filesize
64KB

Download
memory/5080-266-0x0000000073E80000-0x000000007456E000-memory.dmp

Filesize
6.9MB

Download