8b88d6d26e5166df04376874aea51d36a6d4d68f59759fad20f04a643ea2b90e

Analysis

max time kernel
37s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2023, 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b88d6d26e5166df04376874aea51d36a6d4d68f59759fad20f04a643ea2b90e.exe
Size

1.4MB
MD5

5f7bdaed54aa3bfac6172468fa2aa13e
SHA1

a50d79912991ee01e4e791897a833431c0229343
SHA256

8b88d6d26e5166df04376874aea51d36a6d4d68f59759fad20f04a643ea2b90e
SHA512

0dc03b7f808a986828827d200b37084bf3ea84908f4573e7a34e615531074e56b52e9b480a70a24e27212548cc6f9050aab1ebdd8b013804f2511ac996ba627a
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

8^/10

evasion upx

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
2712	netsh.exe
1772	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00060000000231f3-235.dat	acprotect
behavioral1/files/0x00060000000231f3-234.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3216	7z.exe

Loads dropped DLL 1 IoCs

pid	Process
3216	7z.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000231f4-231.dat	upx
behavioral1/memory/3216-232-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x00060000000231f4-233.dat	upx
behavioral1/files/0x00060000000231f3-235.dat	upx
behavioral1/memory/3216-236-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/files/0x00060000000231f3-234.dat	upx
behavioral1/memory/3216-240-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
1580	PING.EXE
3828	PING.EXE
988	PING.EXE
2856	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4532	powershell.exe
4532	powershell.exe
4616	powershell.exe
4616	powershell.exe
4840	powershell.exe
4840	powershell.exe
3780	powershell.exe
3780	powershell.exe
4688	powershell.exe
4688	powershell.exe
3660	powershell.exe
3660	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5108	WMIC.exe
Token: SeSecurityPrivilege	5108	WMIC.exe
Token: SeTakeOwnershipPrivilege	5108	WMIC.exe
Token: SeLoadDriverPrivilege	5108	WMIC.exe
Token: SeSystemProfilePrivilege	5108	WMIC.exe
Token: SeSystemtimePrivilege	5108	WMIC.exe
Token: SeProfSingleProcessPrivilege	5108	WMIC.exe
Token: SeIncBasePriorityPrivilege	5108	WMIC.exe
Token: SeCreatePagefilePrivilege	5108	WMIC.exe
Token: SeBackupPrivilege	5108	WMIC.exe
Token: SeRestorePrivilege	5108	WMIC.exe
Token: SeShutdownPrivilege	5108	WMIC.exe
Token: SeDebugPrivilege	5108	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5108	WMIC.exe
Token: SeRemoteShutdownPrivilege	5108	WMIC.exe
Token: SeUndockPrivilege	5108	WMIC.exe
Token: SeManageVolumePrivilege	5108	WMIC.exe
Token: 33	5108	WMIC.exe
Token: 34	5108	WMIC.exe
Token: 35	5108	WMIC.exe
Token: 36	5108	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5108	WMIC.exe
Token: SeSecurityPrivilege	5108	WMIC.exe
Token: SeTakeOwnershipPrivilege	5108	WMIC.exe
Token: SeLoadDriverPrivilege	5108	WMIC.exe
Token: SeSystemProfilePrivilege	5108	WMIC.exe
Token: SeSystemtimePrivilege	5108	WMIC.exe
Token: SeProfSingleProcessPrivilege	5108	WMIC.exe
Token: SeIncBasePriorityPrivilege	5108	WMIC.exe
Token: SeCreatePagefilePrivilege	5108	WMIC.exe
Token: SeBackupPrivilege	5108	WMIC.exe
Token: SeRestorePrivilege	5108	WMIC.exe
Token: SeShutdownPrivilege	5108	WMIC.exe
Token: SeDebugPrivilege	5108	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5108	WMIC.exe
Token: SeRemoteShutdownPrivilege	5108	WMIC.exe
Token: SeUndockPrivilege	5108	WMIC.exe
Token: SeManageVolumePrivilege	5108	WMIC.exe
Token: 33	5108	WMIC.exe
Token: 34	5108	WMIC.exe
Token: 35	5108	WMIC.exe
Token: 36	5108	WMIC.exe
Token: SeDebugPrivilege	4532	powershell.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	3780	powershell.exe
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeDebugPrivilege	3660	powershell.exe
Token: SeIncreaseQuotaPrivilege	1160	WMIC.exe
Token: SeSecurityPrivilege	1160	WMIC.exe
Token: SeTakeOwnershipPrivilege	1160	WMIC.exe
Token: SeLoadDriverPrivilege	1160	WMIC.exe
Token: SeSystemProfilePrivilege	1160	WMIC.exe
Token: SeSystemtimePrivilege	1160	WMIC.exe
Token: SeProfSingleProcessPrivilege	1160	WMIC.exe
Token: SeIncBasePriorityPrivilege	1160	WMIC.exe
Token: SeCreatePagefilePrivilege	1160	WMIC.exe
Token: SeBackupPrivilege	1160	WMIC.exe
Token: SeRestorePrivilege	1160	WMIC.exe
Token: SeShutdownPrivilege	1160	WMIC.exe
Token: SeDebugPrivilege	1160	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1160	WMIC.exe
Token: SeRemoteShutdownPrivilege	1160	WMIC.exe
Token: SeUndockPrivilege	1160	WMIC.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4264	4128	8b88d6d26e5166df04376874aea51d36a6d4d68f59759fad20f04a643ea2b90e.exe	85
PID 4128 wrote to memory of 4264	4128	8b88d6d26e5166df04376874aea51d36a6d4d68f59759fad20f04a643ea2b90e.exe	85
PID 4128 wrote to memory of 4264	4128	8b88d6d26e5166df04376874aea51d36a6d4d68f59759fad20f04a643ea2b90e.exe	85
PID 4264 wrote to memory of 2016	4264	cmd.exe	89
PID 4264 wrote to memory of 2016	4264	cmd.exe	89
PID 4264 wrote to memory of 2016	4264	cmd.exe	89
PID 2016 wrote to memory of 988	2016	cmd.exe	90
PID 2016 wrote to memory of 988	2016	cmd.exe	90
PID 2016 wrote to memory of 988	2016	cmd.exe	90
PID 4264 wrote to memory of 3040	4264	cmd.exe	91
PID 4264 wrote to memory of 3040	4264	cmd.exe	91
PID 4264 wrote to memory of 3040	4264	cmd.exe	91
PID 3040 wrote to memory of 5108	3040	cmd.exe	92
PID 3040 wrote to memory of 5108	3040	cmd.exe	92
PID 3040 wrote to memory of 5108	3040	cmd.exe	92
PID 4264 wrote to memory of 4532	4264	cmd.exe	94
PID 4264 wrote to memory of 4532	4264	cmd.exe	94
PID 4264 wrote to memory of 4532	4264	cmd.exe	94
PID 4264 wrote to memory of 4616	4264	cmd.exe	98
PID 4264 wrote to memory of 4616	4264	cmd.exe	98
PID 4264 wrote to memory of 4616	4264	cmd.exe	98
PID 4264 wrote to memory of 4840	4264	cmd.exe	100
PID 4264 wrote to memory of 4840	4264	cmd.exe	100
PID 4264 wrote to memory of 4840	4264	cmd.exe	100
PID 4264 wrote to memory of 3780	4264	cmd.exe	102
PID 4264 wrote to memory of 3780	4264	cmd.exe	102
PID 4264 wrote to memory of 3780	4264	cmd.exe	102
PID 4264 wrote to memory of 4688	4264	cmd.exe	105
PID 4264 wrote to memory of 4688	4264	cmd.exe	105
PID 4264 wrote to memory of 4688	4264	cmd.exe	105
PID 4264 wrote to memory of 3216	4264	cmd.exe	106
PID 4264 wrote to memory of 3216	4264	cmd.exe	106
PID 4264 wrote to memory of 3216	4264	cmd.exe	106
PID 4264 wrote to memory of 3660	4264	cmd.exe	108
PID 4264 wrote to memory of 3660	4264	cmd.exe	108
PID 4264 wrote to memory of 3660	4264	cmd.exe	108
PID 3660 wrote to memory of 2712	3660	powershell.exe	112
PID 3660 wrote to memory of 2712	3660	powershell.exe	112
PID 3660 wrote to memory of 2712	3660	powershell.exe	112
PID 3660 wrote to memory of 1772	3660	powershell.exe	113
PID 3660 wrote to memory of 1772	3660	powershell.exe	113
PID 3660 wrote to memory of 1772	3660	powershell.exe	113
PID 3660 wrote to memory of 3216	3660	powershell.exe	114
PID 3660 wrote to memory of 3216	3660	powershell.exe	114
PID 3660 wrote to memory of 3216	3660	powershell.exe	114
PID 3216 wrote to memory of 1160	3216	cmd.exe	115
PID 3216 wrote to memory of 1160	3216	cmd.exe	115
PID 3216 wrote to memory of 1160	3216	cmd.exe	115

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
64	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8b88d6d26e5166df04376874aea51d36a6d4d68f59759fad20f04a643ea2b90e.exe
"C:\Users\Admin\AppData\Local\Temp\8b88d6d26e5166df04376874aea51d36a6d4d68f59759fad20f04a643ea2b90e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5108
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3780
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3216
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2712
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1772
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3216
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="MSXGLQPS" set AutomaticManagedPagefile=False
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1160
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1288
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:3404
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      PID:3852
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:5080
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 9
        6⤵
        Runs ping.exe
        
        PID:1580
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:352
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 14 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 14 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:3572
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 14
        6⤵
        Runs ping.exe
        
        PID:3828
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:64
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    PID:4956
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    PID:932
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 10 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 10 > nul && "C:\Users\Admin\Music\rot.exe"
      4⤵
      PID:4776
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 10
        5⤵
        Runs ping.exe
        
        PID:988
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 10
        5⤵
        Runs ping.exe
        
        PID:2856
    - - C:\Users\Admin\Music\rot.exe
        
        "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
428.9MB

MD5
0323f9da1ccd48fbcd37b75a0373cc29

SHA1
ea8cdd71e55035dc75bdf93465337b04097e301b

SHA256
960cb2c766dfe4eea18d72e6a22ffddf7d50010ff68185843a854792a8520e68

SHA512
bee869fcb66f6245d399dc0a6c35e48b69ff307537da70a01b43a9ec33d66130b93d96912c51970049be686777500c5f77da7d5a85275c1bdb577cc600f55975

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
313.9MB

MD5
2c01ca29aea1a35638c9c5a2eda2b9a5

SHA1
0f466e95259a5c0a3b74050fa2cd5953001682a2

SHA256
b81cba29a8ff04cf70ece963bd6513e200db0b1ad159fa21b53a07b5895ada99

SHA512
2cc71f9af2e16f2b339c3d3a5812f600ef1df09d17b78e7eb22de505b18eb78c13fc80063278f028e9a7f8baf700da114a23986709dea9e9957da3bb7d2c39c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
33b19d75aa77114216dbc23f43b195e3

SHA1
36a6c3975e619e0c5232aa4f5b7dc1fec9525535

SHA256
b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

SHA512
676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ratt.exe.log

Filesize
1KB

MD5
9a2d0ce437d2445330f2646472703087

SHA1
33c83e484a15f35c2caa3af62d5da6b7713a20ae

SHA256
30ea2f716e85f8d14a201e3fb0897d745a01b113342dfb7a9b7ac133c4ef150c

SHA512
a61d18d90bfad9ea8afdfa37537cfea3d5a3d0c161e323fa65840c283bdc87c3de85daaff5519beea2f2719eec1c68398eea8679b55ff733a61052f073162d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
c5ba82a12ecb995713814782f3cd03da

SHA1
988f58ec78892b83590e1eb3f5214f65f6ef4bf6

SHA256
cc99c20b37b7fa98750908fd8caff76a841f3b2b34e6a2256af6aac472962297

SHA512
0758b9ffc7c6cbd265667495305c965ffd299e43f42c395b7b355fb14b02a2587ce44c145621234c9a4540fee07a4475bd06a6e65df7b4a48a3e832e3f8acbf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
2d6d22857285ed47d19f52c645f52d52

SHA1
1d84e5d25272c41abfa5913ca9870fe4555b9162

SHA256
663de1a60104cf5706e4bb5df8d722ead46793ea1064d69eb67917924bba72c5

SHA512
4243560dc33825865f131687f62c6643a053ba74a2a0495f41cc97fdf2adbb274bb80598c860e6f93f318b26fa7c96a65935408dbf9461bb198d1a6114b89c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
c9f18f13e1e0ef99e8d7463b7dc26ac2

SHA1
5bbc6a9e5e5f70a9e285cb3153165ea99be6cc79

SHA256
8f2ae56c53eed9469d8a0138e4ddac0ec1d96369649d193c652b5bf989199d2e

SHA512
9a494636d37af4744453b67b119e1f3476e2eb7dd45667be747d216999a344d352a4cce86cf77167ffb10b5f25ec625fccf8f5c2fb77a8a29b0c1be48737bf86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
50b88afafcfeebf4e2106ad1ba3ec2d5

SHA1
67c80b960854c012a57b00aa26ca0b820513a3c3

SHA256
db6e5dc69d452d8a9ccf419ef66828ec185195b025d193c3644c637b945c9b6b

SHA512
ef165a9825b2d5e03f3fa3e28a2890f70830fcff8a40a6b8833afd65a7f7cd90e186632992993321a306650e71d58ea018a9970cf992f31da896042122d5d2cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
9cda842396a58877f2959651b59987e5

SHA1
abac42758f5591eff66cca69788f93bbc0911b77

SHA256
3c0c4d83f46dfca52466e7f2a49b449ae5324a65310cedb3b0236c34caccb177

SHA512
21916a67621da8268005bc57c792c0c87506be4769d0e38469bdc5bd57be2c167e3c7d9b61d30f3ebab7ac6af34c60ca7d3d09677e403bcc10568894d8a9fd94

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3re5jq5f.g2g.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
554.6MB

MD5
d8f8fdf948604928ab282535270d6b49

SHA1
98b82c24d8de23899d42e254eb9a7029ffd5ee04

SHA256
4a9111451d6b73e3a1b27ca5c46488dc97c13a6c6399b90537c0fa65400a746f

SHA512
d1379fb3dd83cf0e70d3182d12ec7f9f1d109afb4e1db351e84f5b495c75de8e2b4e4f8adeeccb02338f0f0ced4cb8253246af363b9edab3ae867e9db8dc0c30

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
285.7MB

MD5
4081fe22cf72f1ab8bd4fc210206cff8

SHA1
d54569cf6e0bdd006232ed4211c87b0943d00a0d

SHA256
8a49562fdfab010888ba36231a4b2ec731f8e8eb7b2017edb04e7a1bafa65b86

SHA512
63dc5e92e21c2c9c4d0be2782b907d9cbe5948964efb5a8007b4d8a0cc47740686339494c90ebecb09536443b754bc342ab4b2453dba8e3e077503b7f35b55c8

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
105.4MB

MD5
8301ea3e700c4ce0fc28becafc1e08c4

SHA1
53c6e8d6e8dd206a97715458707d722b8e6ee586

SHA256
aa3e7b60cd80844e3964112e105ca809911417f079ee64eb9267e9a95b04b145

SHA512
83905df594f702527b2f501540e28d59fdd8e05cee8a6e87e0cd48b731db50995701d50a9b243705be1dc6e7063e97687959ee92e0898754a105a98654dbf03a

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
30.7MB

MD5
ea6a3dd88aebc161e47e3c8c5b14cf21

SHA1
42cba2c87c4d12e33be9d1da672bdc5e048ddcf8

SHA256
49ad9949c944cbf9a944ac447e6fd429308098ffb7b628f7a091e7bd619c7550

SHA512
515f99572ea64951490ff92a8be4abcf10bd9a2e743d65d0c529d46b1b3f3ec379d1e5a6f2b1fbcc39e6826ff2b92c76b6d3971ca95a9f6d17c5a34e4fc870cf

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
34.1MB

MD5
8dbfbf4d2f3941c809166f9f784e046b

SHA1
65fc3dc62dc1fb2d12326aa622a9f6fcb287959b

SHA256
a892004a682bcf07914e82c1d1d5517af739fe2f0c5d044389873160e25ce6e3

SHA512
c5c01a1438a2dabef1aa3ef02a74f42384eecb05458bdd8c64caa35a20efb7d3d01794fefa858f98db4d04591a1801235f1c2fa396805b8d537d0365c75625ce

Download Submit
memory/932-299-0x0000000000E70000-0x0000000001026000-memory.dmp

Filesize
1.7MB

Download
memory/932-300-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/932-302-0x0000000005720000-0x0000000005730000-memory.dmp

Filesize
64KB

Download
memory/3216-240-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3216-232-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3216-236-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/3660-281-0x0000000007150000-0x0000000007172000-memory.dmp

Filesize
136KB

Download
memory/3660-273-0x0000000006E10000-0x0000000006E1A000-memory.dmp

Filesize
40KB

Download
memory/3660-294-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/3660-285-0x000000007EE40000-0x000000007EE50000-memory.dmp

Filesize
64KB

Download
memory/3660-270-0x0000000006050000-0x000000000606E000-memory.dmp

Filesize
120KB

Download
memory/3660-284-0x0000000000E70000-0x0000000000E80000-memory.dmp

Filesize
64KB

Download
memory/3660-282-0x0000000008040000-0x00000000085E4000-memory.dmp

Filesize
5.6MB

Download
memory/3660-260-0x00000000705C0000-0x000000007060C000-memory.dmp

Filesize
304KB

Download
memory/3660-259-0x0000000006080000-0x00000000060B2000-memory.dmp

Filesize
200KB

Download
memory/3660-280-0x0000000000E70000-0x0000000000E80000-memory.dmp

Filesize
64KB

Download
memory/3660-279-0x0000000000E70000-0x0000000000E80000-memory.dmp

Filesize
64KB

Download
memory/3660-278-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/3660-277-0x0000000007010000-0x0000000007018000-memory.dmp

Filesize
32KB

Download
memory/3660-276-0x00000000070E0000-0x00000000070FA000-memory.dmp

Filesize
104KB

Download
memory/3660-275-0x0000000006FC0000-0x0000000006FCE000-memory.dmp

Filesize
56KB

Download
memory/3660-274-0x0000000007040000-0x00000000070D6000-memory.dmp

Filesize
600KB

Download
memory/3660-244-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/3660-245-0x0000000000E70000-0x0000000000E80000-memory.dmp

Filesize
64KB

Download
memory/3660-246-0x0000000000E70000-0x0000000000E80000-memory.dmp

Filesize
64KB

Download
memory/3660-271-0x0000000007410000-0x0000000007A8A000-memory.dmp

Filesize
6.5MB

Download
memory/3660-272-0x0000000006DC0000-0x0000000006DDA000-memory.dmp

Filesize
104KB

Download
memory/3660-258-0x000000007EE40000-0x000000007EE50000-memory.dmp

Filesize
64KB

Download
memory/3780-200-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/3780-201-0x00000000030B0000-0x00000000030C0000-memory.dmp

Filesize
64KB

Download
memory/3780-213-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/3852-290-0x0000000004A90000-0x0000000004B2C000-memory.dmp

Filesize
624KB

Download
memory/3852-298-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/3852-301-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/3852-296-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/3852-295-0x0000000004DA0000-0x0000000004DAA000-memory.dmp

Filesize
40KB

Download
memory/3852-292-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/3852-291-0x0000000004BD0000-0x0000000004C62000-memory.dmp

Filesize
584KB

Download
memory/3852-289-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/3852-288-0x0000000000540000-0x00000000006F6000-memory.dmp

Filesize
1.7MB

Download
memory/4532-151-0x0000000005090000-0x00000000050F6000-memory.dmp

Filesize
408KB

Download
memory/4532-149-0x0000000005250000-0x0000000005878000-memory.dmp

Filesize
6.2MB

Download
memory/4532-146-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/4532-166-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/4532-147-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

Filesize
64KB

Download
memory/4532-148-0x0000000002670000-0x00000000026A6000-memory.dmp

Filesize
216KB

Download
memory/4532-163-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

Filesize
64KB

Download
memory/4532-150-0x0000000004FF0000-0x0000000005012000-memory.dmp

Filesize
136KB

Download
memory/4532-157-0x0000000005980000-0x00000000059E6000-memory.dmp

Filesize
408KB

Download
memory/4532-162-0x0000000006030000-0x000000000604E000-memory.dmp

Filesize
120KB

Download
memory/4616-172-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/4616-183-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/4616-168-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/4616-169-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/4616-181-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/4688-229-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/4688-215-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/4688-214-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/4688-228-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/4688-216-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/4840-186-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/4840-198-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/4840-199-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/4840-184-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/4840-185-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download