83cfccb9a7ac5a9a7e80aada449543db26b230d077b9d4c807418ee5bbcfce1a

Analysis

max time kernel
118s
max time network
136s
platform
windows10-1703_x64
resource
win10-20230831-en
resource tags

arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
submitted
01/09/2023, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

83cfccb9a7ac5a9a7e80aada449543db26b230d077b9d4c807418ee5bbcfce1a.exe
Size

1.4MB
MD5

dcdc25bd245583a506bc2cd8141534d0
SHA1

20272f7fc73474e15e470e5abde6732c765ac933
SHA256

83cfccb9a7ac5a9a7e80aada449543db26b230d077b9d4c807418ee5bbcfce1a
SHA512

ccef7c1e590fbe67d1fb79aa1c85f2dd96435ccdee6b24851f68b1489904672eb2fc100de0b92721d41848d46c30d03210a42d0e70b30859618692dd934da2a9
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

8^/10

evasion persistence upx

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
3440	netsh.exe
4260	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000800000001af3d-130.dat	acprotect
behavioral1/files/0x000800000001af3d-129.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
2940	7z.exe
2552	ratt.exe
196	ratt.exe

Loads dropped DLL 1 IoCs

pid	Process
2940	7z.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001af46-126.dat	upx
behavioral1/memory/2940-127-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x000700000001af46-128.dat	upx
behavioral1/files/0x000800000001af3d-130.dat	upx
behavioral1/memory/2940-131-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/files/0x000800000001af3d-129.dat	upx
behavioral1/memory/2940-135-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ratt = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ratt.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3080	PING.EXE
448	PING.EXE

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
916	powershell.exe
916	powershell.exe
916	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
1924	powershell.exe
1924	powershell.exe
1924	powershell.exe
1396	powershell.exe
1396	powershell.exe
1396	powershell.exe
2960	powershell.exe
2960	powershell.exe
2960	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2552	ratt.exe
2552	ratt.exe
2552	ratt.exe
2552	ratt.exe
2552	ratt.exe
2552	ratt.exe
2552	ratt.exe
2552	ratt.exe
2552	ratt.exe
2552	ratt.exe
2552	ratt.exe
2552	ratt.exe
2552	ratt.exe
2552	ratt.exe
2552	ratt.exe
2552	ratt.exe
196	ratt.exe
196	ratt.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4320	WMIC.exe
Token: SeSecurityPrivilege	4320	WMIC.exe
Token: SeTakeOwnershipPrivilege	4320	WMIC.exe
Token: SeLoadDriverPrivilege	4320	WMIC.exe
Token: SeSystemProfilePrivilege	4320	WMIC.exe
Token: SeSystemtimePrivilege	4320	WMIC.exe
Token: SeProfSingleProcessPrivilege	4320	WMIC.exe
Token: SeIncBasePriorityPrivilege	4320	WMIC.exe
Token: SeCreatePagefilePrivilege	4320	WMIC.exe
Token: SeBackupPrivilege	4320	WMIC.exe
Token: SeRestorePrivilege	4320	WMIC.exe
Token: SeShutdownPrivilege	4320	WMIC.exe
Token: SeDebugPrivilege	4320	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4320	WMIC.exe
Token: SeRemoteShutdownPrivilege	4320	WMIC.exe
Token: SeUndockPrivilege	4320	WMIC.exe
Token: SeManageVolumePrivilege	4320	WMIC.exe
Token: 33	4320	WMIC.exe
Token: 34	4320	WMIC.exe
Token: 35	4320	WMIC.exe
Token: 36	4320	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4320	WMIC.exe
Token: SeSecurityPrivilege	4320	WMIC.exe
Token: SeTakeOwnershipPrivilege	4320	WMIC.exe
Token: SeLoadDriverPrivilege	4320	WMIC.exe
Token: SeSystemProfilePrivilege	4320	WMIC.exe
Token: SeSystemtimePrivilege	4320	WMIC.exe
Token: SeProfSingleProcessPrivilege	4320	WMIC.exe
Token: SeIncBasePriorityPrivilege	4320	WMIC.exe
Token: SeCreatePagefilePrivilege	4320	WMIC.exe
Token: SeBackupPrivilege	4320	WMIC.exe
Token: SeRestorePrivilege	4320	WMIC.exe
Token: SeShutdownPrivilege	4320	WMIC.exe
Token: SeDebugPrivilege	4320	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4320	WMIC.exe
Token: SeRemoteShutdownPrivilege	4320	WMIC.exe
Token: SeUndockPrivilege	4320	WMIC.exe
Token: SeManageVolumePrivilege	4320	WMIC.exe
Token: 33	4320	WMIC.exe
Token: 34	4320	WMIC.exe
Token: 35	4320	WMIC.exe
Token: 36	4320	WMIC.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeIncreaseQuotaPrivilege	2956	WMIC.exe
Token: SeSecurityPrivilege	2956	WMIC.exe
Token: SeTakeOwnershipPrivilege	2956	WMIC.exe
Token: SeLoadDriverPrivilege	2956	WMIC.exe
Token: SeSystemProfilePrivilege	2956	WMIC.exe
Token: SeSystemtimePrivilege	2956	WMIC.exe
Token: SeProfSingleProcessPrivilege	2956	WMIC.exe
Token: SeIncBasePriorityPrivilege	2956	WMIC.exe
Token: SeCreatePagefilePrivilege	2956	WMIC.exe
Token: SeBackupPrivilege	2956	WMIC.exe
Token: SeRestorePrivilege	2956	WMIC.exe
Token: SeShutdownPrivilege	2956	WMIC.exe
Token: SeDebugPrivilege	2956	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2956	WMIC.exe
Token: SeRemoteShutdownPrivilege	2956	WMIC.exe
Token: SeUndockPrivilege	2956	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 4188	316	83cfccb9a7ac5a9a7e80aada449543db26b230d077b9d4c807418ee5bbcfce1a.exe	69
PID 316 wrote to memory of 4188	316	83cfccb9a7ac5a9a7e80aada449543db26b230d077b9d4c807418ee5bbcfce1a.exe	69
PID 316 wrote to memory of 4188	316	83cfccb9a7ac5a9a7e80aada449543db26b230d077b9d4c807418ee5bbcfce1a.exe	69
PID 4188 wrote to memory of 4536	4188	cmd.exe	72
PID 4188 wrote to memory of 4536	4188	cmd.exe	72
PID 4188 wrote to memory of 4536	4188	cmd.exe	72
PID 4536 wrote to memory of 4628	4536	cmd.exe	73
PID 4536 wrote to memory of 4628	4536	cmd.exe	73
PID 4536 wrote to memory of 4628	4536	cmd.exe	73
PID 4188 wrote to memory of 2892	4188	cmd.exe	74
PID 4188 wrote to memory of 2892	4188	cmd.exe	74
PID 4188 wrote to memory of 2892	4188	cmd.exe	74
PID 2892 wrote to memory of 4320	2892	cmd.exe	75
PID 2892 wrote to memory of 4320	2892	cmd.exe	75
PID 2892 wrote to memory of 4320	2892	cmd.exe	75
PID 4188 wrote to memory of 916	4188	cmd.exe	77
PID 4188 wrote to memory of 916	4188	cmd.exe	77
PID 4188 wrote to memory of 916	4188	cmd.exe	77
PID 4188 wrote to memory of 3656	4188	cmd.exe	78
PID 4188 wrote to memory of 3656	4188	cmd.exe	78
PID 4188 wrote to memory of 3656	4188	cmd.exe	78
PID 4188 wrote to memory of 1924	4188	cmd.exe	79
PID 4188 wrote to memory of 1924	4188	cmd.exe	79
PID 4188 wrote to memory of 1924	4188	cmd.exe	79
PID 4188 wrote to memory of 1396	4188	cmd.exe	80
PID 4188 wrote to memory of 1396	4188	cmd.exe	80
PID 4188 wrote to memory of 1396	4188	cmd.exe	80
PID 4188 wrote to memory of 2960	4188	cmd.exe	81
PID 4188 wrote to memory of 2960	4188	cmd.exe	81
PID 4188 wrote to memory of 2960	4188	cmd.exe	81
PID 4188 wrote to memory of 2940	4188	cmd.exe	82
PID 4188 wrote to memory of 2940	4188	cmd.exe	82
PID 4188 wrote to memory of 2940	4188	cmd.exe	82
PID 4188 wrote to memory of 2280	4188	cmd.exe	83
PID 4188 wrote to memory of 2280	4188	cmd.exe	83
PID 4188 wrote to memory of 2280	4188	cmd.exe	83
PID 2280 wrote to memory of 3440	2280	powershell.exe	84
PID 2280 wrote to memory of 3440	2280	powershell.exe	84
PID 2280 wrote to memory of 3440	2280	powershell.exe	84
PID 2280 wrote to memory of 4260	2280	powershell.exe	85
PID 2280 wrote to memory of 4260	2280	powershell.exe	85
PID 2280 wrote to memory of 4260	2280	powershell.exe	85
PID 2280 wrote to memory of 5012	2280	powershell.exe	86
PID 2280 wrote to memory of 5012	2280	powershell.exe	86
PID 2280 wrote to memory of 5012	2280	powershell.exe	86
PID 5012 wrote to memory of 2956	5012	cmd.exe	87
PID 5012 wrote to memory of 2956	5012	cmd.exe	87
PID 5012 wrote to memory of 2956	5012	cmd.exe	87
PID 2280 wrote to memory of 4368	2280	powershell.exe	88
PID 2280 wrote to memory of 4368	2280	powershell.exe	88
PID 2280 wrote to memory of 4368	2280	powershell.exe	88
PID 4368 wrote to memory of 4604	4368	cmd.exe	89
PID 4368 wrote to memory of 4604	4368	cmd.exe	89
PID 4368 wrote to memory of 4604	4368	cmd.exe	89
PID 2280 wrote to memory of 2552	2280	powershell.exe	90
PID 2280 wrote to memory of 2552	2280	powershell.exe	90
PID 2280 wrote to memory of 2552	2280	powershell.exe	90
PID 2280 wrote to memory of 1304	2280	powershell.exe	91
PID 2280 wrote to memory of 1304	2280	powershell.exe	91
PID 2280 wrote to memory of 1304	2280	powershell.exe	91
PID 4188 wrote to memory of 3356	4188	cmd.exe	92
PID 4188 wrote to memory of 3356	4188	cmd.exe	92
PID 4188 wrote to memory of 3356	4188	cmd.exe	92
PID 2552 wrote to memory of 2432	2552	ratt.exe	94

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1304	attrib.exe

C:\Users\Admin\AppData\Local\Temp\83cfccb9a7ac5a9a7e80aada449543db26b230d077b9d4c807418ee5bbcfce1a.exe
"C:\Users\Admin\AppData\Local\Temp\83cfccb9a7ac5a9a7e80aada449543db26b230d077b9d4c807418ee5bbcfce1a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:4628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4320
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3656
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2940
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3440
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4260
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5012
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="NDZBLGCF" set AutomaticManagedPagefile=False
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4368
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:4604
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2552
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:2432
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 8
        6⤵
        Runs ping.exe
        
        PID:3080
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:2888
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 9 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 9 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:4508
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 9
        6⤵
        Runs ping.exe
        
        PID:448
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:1304
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    - Adds Run key to start application
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
501.1MB

MD5
792e71134972d04e39b24b701fc01ba5

SHA1
5ef88c12a520c67a8e4efee5e717d31d8bbd0a28

SHA256
09c2bd96dc15b3eab16874881737d93e3993d1ac98006c5a18d9b2d86600eea1

SHA512
df5a57267d8447e4bceca3061297559ec9690fa0f9e754f65529a06c5f3aec655eee2a086ed77e6d332c689d02827dddf29017433ae363b2922ecc8ee5fe08ad

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
374.1MB

MD5
d3fea6318accf6cae6428cd6135c0e2a

SHA1
40b981775d19b12d9b5fddf212cf5a768d0ec4cf

SHA256
43cc259f1ea1aad8af120467bc85372cebb36b8d549a6e72817b28d3a3157ee0

SHA512
c7fe12632d3d9990f01bae00c600ce1c04fb8bfb63ce6aca1dc2a4a747d71ceb835821aa0c7cc108fa1fbb04fb06f97b0f04d14426b26f2493679c8271f4c699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
fe8b8bdf927bdd59cc1c64835c515894

SHA1
7303055182b9ca23fba22bb18800228d912ac950

SHA256
58e92b217cd4e215153a4c5e8c147aba4e08609a14d2d5e5c6f264e7de033543

SHA512
45e93991428906d7214e0988c603d7dcedfef43c886dbeb0004a52d9449fdaa7870fb4fcf64f2605a68db1cafb147739f297da0701bac8acd78a23124ecdc4ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
f34e91130bc6c27f38b7ce45a3686f5c

SHA1
4bae10fb4df014e66ea06d275fa5d2a4f5160b16

SHA256
3c117c827a8f12fc5d9d9b874c063fa7ef3dc4ff302486e65553487ae0a3a8ec

SHA512
68c27a2c45a404dbabc81139697696b3af7c1aff4d2d81ee7bd805ca894d0890a4a523a9777e6b390f1eab77474dd6c39255491974e916e19c11e56ee4fd2e8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
c3bb99af9b874fe1a1b544c603ea7741

SHA1
2c085684f267cf45d1925ec64a16ae12e91c1004

SHA256
bc14d4905112478cb5344dde070acd08eb908c212ad0a36e108f7b519c568a31

SHA512
1dbfc67c94b86b322e4c578230a6846e07eed0a62ea83a762c8bc49f14e2d10c32fa4645e3a819cde45f8a464124af48dd63d1b58600f1a6abf2fd13476af959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
93bc4fc48e3b8b4105100747b1926831

SHA1
04be299a9aa35633980edff874f017f08e709f3a

SHA256
33b434954c79defeef8049e9f7eba8c607b55a91b7a43e996cba5bb43936191a

SHA512
0f85f420b13ea04038879612e96604fc33e574856ab46977280bac2b1fe3466797aae67aab5f9061855b495e70ecdf123e7e93ca3ba90dc6c0830019a7fe701a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
83f902042126d8c82c43a43586f6f726

SHA1
53731597a6fdd27766617ade8c38f4c1a22f5414

SHA256
7a6de0d621e8af304821f65a8c34970af4d6f86b368d2411f294894b145365cd

SHA512
0296a739d96a6e046e42317107ab0d63695dc66ae0e34904b7a7ed617e0d7748cdc18c0700908c66544c03dc174147926f5e2dcc27c5403ed6d526e4df978bb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sip4p0l0.imh.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
745.1MB

MD5
be788bb3680cf3809d9678ee6f7ba321

SHA1
499f01d5f654f83e172004dcc03f99abdd251734

SHA256
03a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b

SHA512
83c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
297.2MB

MD5
b9ea9c472c4ba12a2717b9c0d77024e6

SHA1
6f036834eb562c6a29e9d11082fc949e5c30e03f

SHA256
5f5a7a05b2ff74e2b92abfc889e628731df154e037e86f8ed66447d5df17634a

SHA512
0fa146ebc85dc00cfaa855744fed08ee663bb805af2868170184250065c3d48b4f47d5c3b707705a9873f9cd50c8485bf81bbba6a6f45191e671e19864cc9358

Download Submit
\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
memory/916-24-0x00000000080D0000-0x0000000008136000-memory.dmp

Filesize
408KB

Download
memory/916-43-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/916-40-0x0000000005160000-0x0000000005170000-memory.dmp

Filesize
64KB

Download
memory/916-39-0x0000000005160000-0x0000000005170000-memory.dmp

Filesize
64KB

Download
memory/916-28-0x0000000008930000-0x00000000089A6000-memory.dmp

Filesize
472KB

Download
memory/916-27-0x0000000008850000-0x000000000889B000-memory.dmp

Filesize
300KB

Download
memory/916-26-0x0000000007F40000-0x0000000007F5C000-memory.dmp

Filesize
112KB

Download
memory/916-25-0x0000000008140000-0x0000000008490000-memory.dmp

Filesize
3.3MB

Download
memory/916-23-0x0000000007E80000-0x0000000007EE6000-memory.dmp

Filesize
408KB

Download
memory/916-22-0x0000000007660000-0x0000000007682000-memory.dmp

Filesize
136KB

Download
memory/916-21-0x0000000007850000-0x0000000007E78000-memory.dmp

Filesize
6.2MB

Download
memory/916-20-0x0000000005160000-0x0000000005170000-memory.dmp

Filesize
64KB

Download
memory/916-19-0x0000000005030000-0x0000000005066000-memory.dmp

Filesize
216KB

Download
memory/916-18-0x0000000005160000-0x0000000005170000-memory.dmp

Filesize
64KB

Download
memory/916-17-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/1396-102-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/1396-100-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/1396-104-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/1396-88-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/1924-69-0x00000000043E0000-0x00000000043F0000-memory.dmp

Filesize
64KB

Download
memory/1924-85-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/1924-82-0x00000000043E0000-0x00000000043F0000-memory.dmp

Filesize
64KB

Download
memory/1924-67-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/1924-81-0x00000000043E0000-0x00000000043F0000-memory.dmp

Filesize
64KB

Download
memory/2280-141-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/2280-177-0x0000000006850000-0x0000000006860000-memory.dmp

Filesize
64KB

Download
memory/2280-404-0x0000000009C00000-0x000000000A278000-memory.dmp

Filesize
6.5MB

Download
memory/2280-411-0x000000000A280000-0x000000000A77E000-memory.dmp

Filesize
5.0MB

Download
memory/2280-378-0x0000000008CA0000-0x0000000008CA8000-memory.dmp

Filesize
32KB

Download
memory/2280-373-0x0000000009040000-0x000000000905A000-memory.dmp

Filesize
104KB

Download
memory/2280-251-0x0000000006850000-0x0000000006860000-memory.dmp

Filesize
64KB

Download
memory/2280-249-0x000000007F860000-0x000000007F870000-memory.dmp

Filesize
64KB

Download
memory/2280-178-0x0000000009160000-0x00000000091F4000-memory.dmp

Filesize
592KB

Download
memory/2280-171-0x0000000008B50000-0x0000000008B6E000-memory.dmp

Filesize
120KB

Download
memory/2280-405-0x00000000090A0000-0x00000000090BA000-memory.dmp

Filesize
104KB

Download
memory/2280-142-0x0000000006850000-0x0000000006860000-memory.dmp

Filesize
64KB

Download
memory/2280-143-0x00000000075D0000-0x0000000007920000-memory.dmp

Filesize
3.3MB

Download
memory/2280-176-0x0000000008F90000-0x0000000009035000-memory.dmp

Filesize
660KB

Download
memory/2280-145-0x0000000007F90000-0x0000000007FDB000-memory.dmp

Filesize
300KB

Download
memory/2280-410-0x0000000009200000-0x0000000009222000-memory.dmp

Filesize
136KB

Download
memory/2280-165-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/2280-168-0x0000000006850000-0x0000000006860000-memory.dmp

Filesize
64KB

Download
memory/2280-169-0x000000007F860000-0x000000007F870000-memory.dmp

Filesize
64KB

Download
memory/2280-170-0x0000000008B90000-0x0000000008BC3000-memory.dmp

Filesize
204KB

Download
memory/2552-449-0x0000000000450000-0x0000000000496000-memory.dmp

Filesize
280KB

Download
memory/2552-446-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/2552-445-0x0000000004C70000-0x0000000004D02000-memory.dmp

Filesize
584KB

Download
memory/2552-440-0x0000000000A90000-0x0000000000C46000-memory.dmp

Filesize
1.7MB

Download
memory/2552-442-0x0000000004BD0000-0x0000000004C6C000-memory.dmp

Filesize
624KB

Download
memory/2552-441-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/2940-135-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2940-131-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/2940-127-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2960-122-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/2960-124-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/2960-120-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/2960-108-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/2960-107-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/3656-65-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/3656-61-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3656-64-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3656-49-0x0000000007890000-0x0000000007BE0000-memory.dmp

Filesize
3.3MB

Download
memory/3656-48-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3656-47-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3656-46-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download