quasar | ee27945cbe83c55114f88b35c6bb4c05263545903c8a9e940d2e95d1198cb51a

Analysis

max time kernel
30s
max time network
129s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
02-08-2023 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee27945cbe83c55114f88b35c6bb4c05263545903c8a9e940d2e95d1198cb51a.exe
Size

1.4MB
MD5

adc9d6b3f0d58e41fd5cd18a7d92e8bb
SHA1

6aff0435a28739fd16adf60050096b53aae32946
SHA256

ee27945cbe83c55114f88b35c6bb4c05263545903c8a9e940d2e95d1198cb51a
SHA512

85b1abb9c80e029c6e8c6cc669882d352367be327b2e6b3af0bdf71c2aed3664d66507b183210e3e47353d2472e1296f7dfae48960868a4ba602183a3d8be7a3
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

10^/10

quasar -evasion spyware trojan upx

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

94.131.105.161:12344

Mutex

QSR_MUTEX_UEgITWnMKnRP3EZFzK

Attributes

encryption_key
5Q0JQBQQfAUHRJTcAIOF
install_name
lient.exe
log_directory
Lugs
reconnect_delay
3000
startup_key
itartup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/3340-620-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
4180	netsh.exe
2248	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000700000001b043-256.dat	acprotect
behavioral1/files/0x000700000001b043-255.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3420	7z.exe

Loads dropped DLL 1 IoCs

pid	Process
3420	7z.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3420-253-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x000700000001b043-256.dat	upx
behavioral1/memory/3420-257-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/files/0x000700000001b043-255.dat	upx
behavioral1/files/0x000700000001b047-254.dat	upx
behavioral1/files/0x000700000001b047-252.dat	upx
behavioral1/memory/3420-262-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
1036	PING.EXE
1512	PING.EXE
3064	PING.EXE
4472	PING.EXE
824	PING.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
2184	powershell.exe
2184	powershell.exe
2184	powershell.exe
320	powershell.exe
320	powershell.exe
320	powershell.exe
420	powershell.exe
420	powershell.exe
420	powershell.exe
3444	powershell.exe
3444	powershell.exe
3444	powershell.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4668	WMIC.exe
Token: SeSecurityPrivilege	4668	WMIC.exe
Token: SeTakeOwnershipPrivilege	4668	WMIC.exe
Token: SeLoadDriverPrivilege	4668	WMIC.exe
Token: SeSystemProfilePrivilege	4668	WMIC.exe
Token: SeSystemtimePrivilege	4668	WMIC.exe
Token: SeProfSingleProcessPrivilege	4668	WMIC.exe
Token: SeIncBasePriorityPrivilege	4668	WMIC.exe
Token: SeCreatePagefilePrivilege	4668	WMIC.exe
Token: SeBackupPrivilege	4668	WMIC.exe
Token: SeRestorePrivilege	4668	WMIC.exe
Token: SeShutdownPrivilege	4668	WMIC.exe
Token: SeDebugPrivilege	4668	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4668	WMIC.exe
Token: SeRemoteShutdownPrivilege	4668	WMIC.exe
Token: SeUndockPrivilege	4668	WMIC.exe
Token: SeManageVolumePrivilege	4668	WMIC.exe
Token: 33	4668	WMIC.exe
Token: 34	4668	WMIC.exe
Token: 35	4668	WMIC.exe
Token: 36	4668	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4668	WMIC.exe
Token: SeSecurityPrivilege	4668	WMIC.exe
Token: SeTakeOwnershipPrivilege	4668	WMIC.exe
Token: SeLoadDriverPrivilege	4668	WMIC.exe
Token: SeSystemProfilePrivilege	4668	WMIC.exe
Token: SeSystemtimePrivilege	4668	WMIC.exe
Token: SeProfSingleProcessPrivilege	4668	WMIC.exe
Token: SeIncBasePriorityPrivilege	4668	WMIC.exe
Token: SeCreatePagefilePrivilege	4668	WMIC.exe
Token: SeBackupPrivilege	4668	WMIC.exe
Token: SeRestorePrivilege	4668	WMIC.exe
Token: SeShutdownPrivilege	4668	WMIC.exe
Token: SeDebugPrivilege	4668	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4668	WMIC.exe
Token: SeRemoteShutdownPrivilege	4668	WMIC.exe
Token: SeUndockPrivilege	4668	WMIC.exe
Token: SeManageVolumePrivilege	4668	WMIC.exe
Token: 33	4668	WMIC.exe
Token: 34	4668	WMIC.exe
Token: 35	4668	WMIC.exe
Token: 36	4668	WMIC.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	320	powershell.exe
Token: SeDebugPrivilege	420	powershell.exe
Token: SeDebugPrivilege	3444	powershell.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 4452	2864	ee27945cbe83c55114f88b35c6bb4c05263545903c8a9e940d2e95d1198cb51a.exe	70
PID 2864 wrote to memory of 4452	2864	ee27945cbe83c55114f88b35c6bb4c05263545903c8a9e940d2e95d1198cb51a.exe	70
PID 2864 wrote to memory of 4452	2864	ee27945cbe83c55114f88b35c6bb4c05263545903c8a9e940d2e95d1198cb51a.exe	70
PID 4452 wrote to memory of 4464	4452	cmd.exe	73
PID 4452 wrote to memory of 4464	4452	cmd.exe	73
PID 4452 wrote to memory of 4464	4452	cmd.exe	73
PID 4464 wrote to memory of 4936	4464	cmd.exe	74
PID 4464 wrote to memory of 4936	4464	cmd.exe	74
PID 4464 wrote to memory of 4936	4464	cmd.exe	74
PID 4452 wrote to memory of 2828	4452	cmd.exe	75
PID 4452 wrote to memory of 2828	4452	cmd.exe	75
PID 4452 wrote to memory of 2828	4452	cmd.exe	75
PID 2828 wrote to memory of 4668	2828	cmd.exe	76
PID 2828 wrote to memory of 4668	2828	cmd.exe	76
PID 2828 wrote to memory of 4668	2828	cmd.exe	76
PID 4452 wrote to memory of 3632	4452	cmd.exe	78
PID 4452 wrote to memory of 3632	4452	cmd.exe	78
PID 4452 wrote to memory of 3632	4452	cmd.exe	78
PID 4452 wrote to memory of 3844	4452	cmd.exe	79
PID 4452 wrote to memory of 3844	4452	cmd.exe	79
PID 4452 wrote to memory of 3844	4452	cmd.exe	79
PID 4452 wrote to memory of 2184	4452	cmd.exe	80
PID 4452 wrote to memory of 2184	4452	cmd.exe	80
PID 4452 wrote to memory of 2184	4452	cmd.exe	80
PID 4452 wrote to memory of 320	4452	cmd.exe	81
PID 4452 wrote to memory of 320	4452	cmd.exe	81
PID 4452 wrote to memory of 320	4452	cmd.exe	81
PID 4452 wrote to memory of 420	4452	cmd.exe	82
PID 4452 wrote to memory of 420	4452	cmd.exe	82
PID 4452 wrote to memory of 420	4452	cmd.exe	82
PID 4452 wrote to memory of 3420	4452	cmd.exe	83
PID 4452 wrote to memory of 3420	4452	cmd.exe	83
PID 4452 wrote to memory of 3420	4452	cmd.exe	83
PID 4452 wrote to memory of 3444	4452	cmd.exe	84
PID 4452 wrote to memory of 3444	4452	cmd.exe	84
PID 4452 wrote to memory of 3444	4452	cmd.exe	84

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2300	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ee27945cbe83c55114f88b35c6bb4c05263545903c8a9e940d2e95d1198cb51a.exe
"C:\Users\Admin\AppData\Local\Temp\ee27945cbe83c55114f88b35c6bb4c05263545903c8a9e940d2e95d1198cb51a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:4936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4668
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3844
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2184
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:320
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:420
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3420
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3444
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4180
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2248
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:4968
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="CXVLSGIX" set AutomaticManagedPagefile=False
        5⤵
        
        PID:608
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:2524
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:1676
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      PID:4044
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:1644
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 9
        6⤵
        Runs ping.exe
        
        PID:824
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:2532
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 15 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 15 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:4440
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 15
        6⤵
        Runs ping.exe
        
        PID:1036
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:2300
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    PID:3232
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
      4⤵
      PID:3056
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 9
        5⤵
        Runs ping.exe
        
        PID:1512
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:2864
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 17 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 17 > nul && "C:\Users\Admin\Music\rot.exe"
      4⤵
      PID:1240
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 17
        5⤵
        Runs ping.exe
        
        PID:3064
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 17
        5⤵
        Runs ping.exe
        
        PID:4472
    - - C:\Users\Admin\Music\rot.exe
        
        "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:2828
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
225.8MB

MD5
2b844a88442cdaf8d6214b7c02f899d7

SHA1
306b52ea3b97adb94f2fe915349a6fe9023d2e65

SHA256
faf88aab83cbf72f7b72741be8fe198eb10d39bf7b023bd3b8ee30101a3a1a6a

SHA512
7c85546f4b7616d29f65e54c5caebbec4b71a2bcbb7c9bd2451136766083e1629bc5fbc00e3d51f4f543f167184734c9c9c7a18d7d58a74a15a3646ca79e4ad0

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
204.1MB

MD5
0215df21b3dec155dafef379e1e5d472

SHA1
c62cce6f2ab73c0602c2528994656ac54d67f640

SHA256
7dcf4332a1687d32b5395a4a5410364b96ed040d49a5ef9769425e03a7eb7979

SHA512
bb610edcb6d8c4d86f5f2955c9226affdb69ceda4cd02dc1ac31c8f5c70a9435b67ce7a0d81baf590689c36cf54cbfd0c641984831eff91af1072593e1ac1261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
0f5cbdca905beb13bebdcf43fb0716bd

SHA1
9e136131389fde83297267faf6c651d420671b3f

SHA256
a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060

SHA512
a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ratt.exe.log

Filesize
1KB

MD5
9e104e9aa0cfdec0753de24cbe3f587b

SHA1
f63b8d0b29c65e518be6a9412e7499c9de11be78

SHA256
59a9f13de0e003ea4adcd0193477f147b0c91ae847eebc744e91a4efe167223f

SHA512
8253854159ceac2d84eb371c9672730831505dea52ac3bc2cca45ee5308717ca3f11734602d0a409974b137084a8c20e6b7653640991e45708f692c65ac4933b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
68c45a91e17bc44ef450fb083f62d549

SHA1
3892f71273148646158db023d4382777a6d8f666

SHA256
82dab2acd04b31bfd5fcc379dd805ed874b2ad036adfab876e59848b9be6ef83

SHA512
d2ad359ba62be14e8eebc961edf45e077321c5fa267422355210f2588a311eaf65aca7f2892e3de97ecf9932d74763a4da7a552a6bcc60a833348413fb1a9111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
038fee2f3c1a77f5887d610d03c505f6

SHA1
c4dd52adb4e6306fc034b5a73200361bc8199944

SHA256
62f4286a5069bfc735939801fd378fbcd2a879a412eb64fb5087ba39b8c838cd

SHA512
6aa1d13094a7657c2bbe60265184c8bdb7f313b99664681523b40c2d71a83289631cdab629e33c496142791b432c4f424889d15101cf6bc53e5a02eb34982219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
744add73f0d79c7b1b4cc80921c7a7bb

SHA1
8067bf0a61e184ef0072c74b1b4e446e6615ceab

SHA256
73f9ef54d209a7066e2878d67157466f926f245bb67ce6b464536255a1a25ff1

SHA512
d1b647b6885154cc227db730c6c3deff981a33b26e9831bd490fc999b36d8be0e426b0e1f9d9ff4d2946dacf778750c7f2e0952d0cf63bbef42dc406dfb2f689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
3199164faa87c56c1f87ce4d27ea14e0

SHA1
a870c44ed1b94ae4676d89839fb2301494c13303

SHA256
cb913dd64c0dd2cbac76c9d5506b0a9ac3b3c69276d038f2a7d9a0eb7959057f

SHA512
324cdc59d4c5e5ae06fe343f478d0aa437e04b865120565d565b7568f6df5cd17b036384c48dc6ffe99d8db96811209e3173d22936d28ea31be94a2ed2963570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
e9742702a1bbb356db5eff02ffab9f1f

SHA1
7c303c52dc7ee8e0a0a4c3a7dc8a3ff43eebf1bf

SHA256
a1582813febf7a155970151557122e8c0e096ad480e27a3c02e87dea6cf6a698

SHA512
cf1f0a075f896ccafa024c64bff81b22bed49be3b60c306c2e8ffce7099273f08a537163989656680a98b5f99c65e98cdebb74b5a8b9adcbe6130b740784c080

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dr2wsvzv.ok0.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
336.0MB

MD5
43303618d610d91994329319bad62c85

SHA1
2f6328f9af6eeeb3779ee0bf91d3b276ac33e963

SHA256
8e10fa61f9c8cd74263ca12b1b013d55c4475687a3eef13f541c674cf44c568e

SHA512
70b13813b305f146997774b0dcc3f4190acc16f7eec50ee80bbc8109da264f372995f923cbc050e92b8c1fa8dff8922074e05f2f8cd9f382494b91d6477de084

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
188.5MB

MD5
815559bdf686101344c4ae9a61197ab4

SHA1
ca2b64fc8529759df4d79349cf5f7759355ab4e3

SHA256
e533d6719c17123dc6ae40fe77650efa65a30a34b5e40bf58f961276851be776

SHA512
eadd1f23a155ee72e7821a68233a88817b46dc82fe8e4e8ad73b6463d2d43ac09719b139e4e4bcdb91d19bd977a67df7d4dacf62b9e440db06776fae877bcc39

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
138.3MB

MD5
196f5813bd18e0355d0a226c8a00c3c6

SHA1
8f9e758ee27b6d084a7a3fbb1c95c1982992daca

SHA256
453314fd2b42cd7465220560dc1f34452d61a870785bf04d4c1268ff88f01496

SHA512
7dac688809e0fd1a6f683569e7197074db31c083ead5dcce796fc7bec8a575aaea6e53e92205f073dafee4eed32dfa13f2c0a24c5598ba2729bda8dbd0f39f25

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
102.4MB

MD5
8f7f32a8418701ba581a0c2772ab8ee2

SHA1
5274b7027b2f4a1df79d475d127a891ea9463ac4

SHA256
3496fafac0b5d35b8d060843e769155d6db51ec90894d881667a87b3360e522a

SHA512
0ee744784e264af32f2e49ab4654f3b22a49310492f667f71061809a0ea604a35da5802623f4427ed326499682872915322f4cbe9ab8ff25c9aa395d432c5b94

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
102.0MB

MD5
fb0f996549e4cb3469faef65b7194811

SHA1
e5160fc7a7cbc07ca8d2061499cebf7138fa7266

SHA256
92ae81897dba729b339d2d2a889d417c3242d61360174870b99f01e9dec2bb05

SHA512
11656e486e046352febb1a998438e8bde2d552bd41f4312c149025c913e59a616673781f1d7f676ef6b501db326cc04bd9d17f32bbff17638eba84a477ad92e4

Download Submit
\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
memory/320-214-0x0000000007770000-0x0000000007780000-memory.dmp

Filesize
64KB

Download
memory/320-212-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/320-230-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/320-226-0x0000000007770000-0x0000000007780000-memory.dmp

Filesize
64KB

Download
memory/320-229-0x0000000007770000-0x0000000007780000-memory.dmp

Filesize
64KB

Download
memory/320-213-0x0000000007770000-0x0000000007780000-memory.dmp

Filesize
64KB

Download
memory/420-259-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/420-233-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/420-247-0x0000000004660000-0x0000000004670000-memory.dmp

Filesize
64KB

Download
memory/420-248-0x0000000004660000-0x0000000004670000-memory.dmp

Filesize
64KB

Download
memory/420-234-0x0000000004660000-0x0000000004670000-memory.dmp

Filesize
64KB

Download
memory/420-235-0x0000000004660000-0x0000000004670000-memory.dmp

Filesize
64KB

Download
memory/2184-208-0x0000000007180000-0x0000000007190000-memory.dmp

Filesize
64KB

Download
memory/2184-209-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/2184-192-0x0000000007180000-0x0000000007190000-memory.dmp

Filesize
64KB

Download
memory/2184-205-0x0000000007180000-0x0000000007190000-memory.dmp

Filesize
64KB

Download
memory/2184-193-0x0000000007180000-0x0000000007190000-memory.dmp

Filesize
64KB

Download
memory/2184-191-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/3340-620-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3420-262-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3420-253-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3420-257-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/3444-304-0x0000000004500000-0x0000000004510000-memory.dmp

Filesize
64KB

Download
memory/3444-302-0x0000000009330000-0x00000000093D5000-memory.dmp

Filesize
660KB

Download
memory/3444-566-0x0000000004500000-0x0000000004510000-memory.dmp

Filesize
64KB

Download
memory/3444-537-0x000000000A220000-0x000000000A71E000-memory.dmp

Filesize
5.0MB

Download
memory/3444-536-0x0000000009570000-0x0000000009592000-memory.dmp

Filesize
136KB

Download
memory/3444-530-0x0000000009BA0000-0x000000000A218000-memory.dmp

Filesize
6.5MB

Download
memory/3444-531-0x0000000009520000-0x000000000953A000-memory.dmp

Filesize
104KB

Download
memory/3444-519-0x0000000004500000-0x0000000004510000-memory.dmp

Filesize
64KB

Download
memory/3444-504-0x00000000092F0000-0x00000000092F8000-memory.dmp

Filesize
32KB

Download
memory/3444-499-0x0000000009300000-0x000000000931A000-memory.dmp

Filesize
104KB

Download
memory/3444-484-0x0000000004500000-0x0000000004510000-memory.dmp

Filesize
64KB

Download
memory/3444-268-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download
memory/3444-269-0x0000000004500000-0x0000000004510000-memory.dmp

Filesize
64KB

Download
memory/3444-270-0x0000000004500000-0x0000000004510000-memory.dmp

Filesize
64KB

Download
memory/3444-271-0x0000000007840000-0x0000000007B90000-memory.dmp

Filesize
3.3MB

Download
memory/3444-305-0x0000000009480000-0x0000000009514000-memory.dmp

Filesize
592KB

Download
memory/3444-273-0x00000000080B0000-0x00000000080FB000-memory.dmp

Filesize
300KB

Download
memory/3444-303-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download
memory/3444-295-0x000000007EE80000-0x000000007EE90000-memory.dmp

Filesize
64KB

Download
memory/3444-296-0x0000000009270000-0x00000000092A3000-memory.dmp

Filesize
204KB

Download
memory/3444-297-0x0000000009230000-0x000000000924E000-memory.dmp

Filesize
120KB

Download
memory/3632-161-0x00000000067E0000-0x00000000067F0000-memory.dmp

Filesize
64KB

Download
memory/3632-139-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/3632-148-0x0000000006DF0000-0x0000000006E0C000-memory.dmp

Filesize
112KB

Download
memory/3632-149-0x0000000007AA0000-0x0000000007AEB000-memory.dmp

Filesize
300KB

Download
memory/3632-150-0x0000000007C60000-0x0000000007CD6000-memory.dmp

Filesize
472KB

Download
memory/3632-162-0x00000000067E0000-0x00000000067F0000-memory.dmp

Filesize
64KB

Download
memory/3632-147-0x0000000007540000-0x0000000007890000-memory.dmp

Filesize
3.3MB

Download
memory/3632-166-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/3632-144-0x0000000006BE0000-0x0000000006C02000-memory.dmp

Filesize
136KB

Download
memory/3632-140-0x0000000006780000-0x00000000067B6000-memory.dmp

Filesize
216KB

Download
memory/3632-141-0x00000000067E0000-0x00000000067F0000-memory.dmp

Filesize
64KB

Download
memory/3632-142-0x00000000067E0000-0x00000000067F0000-memory.dmp

Filesize
64KB

Download
memory/3632-145-0x00000000074C0000-0x0000000007526000-memory.dmp

Filesize
408KB

Download
memory/3632-143-0x0000000006E20000-0x0000000007448000-memory.dmp

Filesize
6.2MB

Download
memory/3632-146-0x0000000006C80000-0x0000000006CE6000-memory.dmp

Filesize
408KB

Download
memory/3844-170-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/3844-184-0x0000000004630000-0x0000000004640000-memory.dmp

Filesize
64KB

Download
memory/3844-187-0x0000000004630000-0x0000000004640000-memory.dmp

Filesize
64KB

Download
memory/3844-188-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/3844-172-0x0000000004630000-0x0000000004640000-memory.dmp

Filesize
64KB

Download
memory/3844-171-0x0000000004630000-0x0000000004640000-memory.dmp

Filesize
64KB

Download
memory/4044-568-0x0000000001130000-0x00000000012E6000-memory.dmp

Filesize
1.7MB

Download
memory/4044-569-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download