da08fcc58105351d1e9e6240a29472fb4f879e42407217f931d676712db986a3

Analysis

max time kernel
52s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2023, 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da08fcc58105351d1e9e6240a29472fb4f879e42407217f931d676712db986a3.exe
Size

1.4MB
MD5

cf8327df2baa2752cc126a6266dd04df
SHA1

421a1c4b6a1446c3736333ecb747f84a6805aeec
SHA256

da08fcc58105351d1e9e6240a29472fb4f879e42407217f931d676712db986a3
SHA512

999f56ebeffe8fa803238fd5aac0fb128c625a8aed619a6430f8e4f6bb56c0b8238293ef5b6e137f184f34c4dbacd64fe9a274f1644058ec54cffd85926eb2f1
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

8^/10

evasion upx

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
5080	netsh.exe
1340	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000023091-108.dat	acprotect
behavioral1/files/0x0007000000023091-109.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	da08fcc58105351d1e9e6240a29472fb4f879e42407217f931d676712db986a3.exe

Executes dropped EXE 1 IoCs

pid	Process
4068	7z.exe

Loads dropped DLL 1 IoCs

pid	Process
4068	7z.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000023092-105.dat	upx
behavioral1/files/0x0008000000023092-107.dat	upx
behavioral1/memory/4068-106-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x0007000000023091-108.dat	upx
behavioral1/files/0x0007000000023091-109.dat	upx
behavioral1/memory/4068-110-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/memory/4068-114-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1072	PING.EXE
4432	PING.EXE
1312	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4904	powershell.exe
4904	powershell.exe
4492	powershell.exe
4492	powershell.exe
864	powershell.exe
864	powershell.exe
1732	powershell.exe
1732	powershell.exe
3212	powershell.exe
3212	powershell.exe
4232	powershell.exe
4232	powershell.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4744	WMIC.exe
Token: SeSecurityPrivilege	4744	WMIC.exe
Token: SeTakeOwnershipPrivilege	4744	WMIC.exe
Token: SeLoadDriverPrivilege	4744	WMIC.exe
Token: SeSystemProfilePrivilege	4744	WMIC.exe
Token: SeSystemtimePrivilege	4744	WMIC.exe
Token: SeProfSingleProcessPrivilege	4744	WMIC.exe
Token: SeIncBasePriorityPrivilege	4744	WMIC.exe
Token: SeCreatePagefilePrivilege	4744	WMIC.exe
Token: SeBackupPrivilege	4744	WMIC.exe
Token: SeRestorePrivilege	4744	WMIC.exe
Token: SeShutdownPrivilege	4744	WMIC.exe
Token: SeDebugPrivilege	4744	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4744	WMIC.exe
Token: SeRemoteShutdownPrivilege	4744	WMIC.exe
Token: SeUndockPrivilege	4744	WMIC.exe
Token: SeManageVolumePrivilege	4744	WMIC.exe
Token: 33	4744	WMIC.exe
Token: 34	4744	WMIC.exe
Token: 35	4744	WMIC.exe
Token: 36	4744	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4744	WMIC.exe
Token: SeSecurityPrivilege	4744	WMIC.exe
Token: SeTakeOwnershipPrivilege	4744	WMIC.exe
Token: SeLoadDriverPrivilege	4744	WMIC.exe
Token: SeSystemProfilePrivilege	4744	WMIC.exe
Token: SeSystemtimePrivilege	4744	WMIC.exe
Token: SeProfSingleProcessPrivilege	4744	WMIC.exe
Token: SeIncBasePriorityPrivilege	4744	WMIC.exe
Token: SeCreatePagefilePrivilege	4744	WMIC.exe
Token: SeBackupPrivilege	4744	WMIC.exe
Token: SeRestorePrivilege	4744	WMIC.exe
Token: SeShutdownPrivilege	4744	WMIC.exe
Token: SeDebugPrivilege	4744	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4744	WMIC.exe
Token: SeRemoteShutdownPrivilege	4744	WMIC.exe
Token: SeUndockPrivilege	4744	WMIC.exe
Token: SeManageVolumePrivilege	4744	WMIC.exe
Token: 33	4744	WMIC.exe
Token: 34	4744	WMIC.exe
Token: 35	4744	WMIC.exe
Token: 36	4744	WMIC.exe
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 4772	2144	da08fcc58105351d1e9e6240a29472fb4f879e42407217f931d676712db986a3.exe	87
PID 2144 wrote to memory of 4772	2144	da08fcc58105351d1e9e6240a29472fb4f879e42407217f931d676712db986a3.exe	87
PID 2144 wrote to memory of 4772	2144	da08fcc58105351d1e9e6240a29472fb4f879e42407217f931d676712db986a3.exe	87
PID 4772 wrote to memory of 4740	4772	cmd.exe	90
PID 4772 wrote to memory of 4740	4772	cmd.exe	90
PID 4772 wrote to memory of 4740	4772	cmd.exe	90
PID 4740 wrote to memory of 4500	4740	cmd.exe	91
PID 4740 wrote to memory of 4500	4740	cmd.exe	91
PID 4740 wrote to memory of 4500	4740	cmd.exe	91
PID 4772 wrote to memory of 4132	4772	cmd.exe	92
PID 4772 wrote to memory of 4132	4772	cmd.exe	92
PID 4772 wrote to memory of 4132	4772	cmd.exe	92
PID 4132 wrote to memory of 4744	4132	cmd.exe	93
PID 4132 wrote to memory of 4744	4132	cmd.exe	93
PID 4132 wrote to memory of 4744	4132	cmd.exe	93
PID 4772 wrote to memory of 4904	4772	cmd.exe	95
PID 4772 wrote to memory of 4904	4772	cmd.exe	95
PID 4772 wrote to memory of 4904	4772	cmd.exe	95
PID 4772 wrote to memory of 4492	4772	cmd.exe	96
PID 4772 wrote to memory of 4492	4772	cmd.exe	96
PID 4772 wrote to memory of 4492	4772	cmd.exe	96
PID 4772 wrote to memory of 864	4772	cmd.exe	97
PID 4772 wrote to memory of 864	4772	cmd.exe	97
PID 4772 wrote to memory of 864	4772	cmd.exe	97
PID 4772 wrote to memory of 1732	4772	cmd.exe	98
PID 4772 wrote to memory of 1732	4772	cmd.exe	98
PID 4772 wrote to memory of 1732	4772	cmd.exe	98
PID 4772 wrote to memory of 3212	4772	cmd.exe	99
PID 4772 wrote to memory of 3212	4772	cmd.exe	99
PID 4772 wrote to memory of 3212	4772	cmd.exe	99
PID 4772 wrote to memory of 4068	4772	cmd.exe	100
PID 4772 wrote to memory of 4068	4772	cmd.exe	100
PID 4772 wrote to memory of 4068	4772	cmd.exe	100
PID 4772 wrote to memory of 4232	4772	cmd.exe	102
PID 4772 wrote to memory of 4232	4772	cmd.exe	102
PID 4772 wrote to memory of 4232	4772	cmd.exe	102
PID 4232 wrote to memory of 5080	4232	powershell.exe	104
PID 4232 wrote to memory of 5080	4232	powershell.exe	104
PID 4232 wrote to memory of 5080	4232	powershell.exe	104
PID 4232 wrote to memory of 1340	4232	powershell.exe	105
PID 4232 wrote to memory of 1340	4232	powershell.exe	105
PID 4232 wrote to memory of 1340	4232	powershell.exe	105
PID 4232 wrote to memory of 3176	4232	powershell.exe	106
PID 4232 wrote to memory of 3176	4232	powershell.exe	106
PID 4232 wrote to memory of 3176	4232	powershell.exe	106
PID 3176 wrote to memory of 4344	3176	cmd.exe	107
PID 3176 wrote to memory of 4344	3176	cmd.exe	107
PID 3176 wrote to memory of 4344	3176	cmd.exe	107

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2640	attrib.exe

C:\Users\Admin\AppData\Local\Temp\da08fcc58105351d1e9e6240a29472fb4f879e42407217f931d676712db986a3.exe
"C:\Users\Admin\AppData\Local\Temp\da08fcc58105351d1e9e6240a29472fb4f879e42407217f931d676712db986a3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:4500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4744
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4904
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4068
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:5080
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1340
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3176
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="RYHSSIAS" set AutomaticManagedPagefile=False
        5⤵
        
        PID:4344
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1672
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:2340
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      PID:5048
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:2844
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 7
        6⤵
        Runs ping.exe
        
        PID:1312
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:1172
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 16 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 16 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:2612
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 16
        6⤵
        Runs ping.exe
        
        PID:1072
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:2640
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    PID:2792
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    PID:1216
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 13 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 13 > nul && "C:\Users\Admin\Music\rot.exe"
      4⤵
      PID:1632
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 13
        5⤵
        Runs ping.exe
        
        PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
452.8MB

MD5
b6e908fc280c561ddc9e45571225eacc

SHA1
d16487e1e510a1cc292dd05dacff302fd8b98b84

SHA256
70ffd2dd9e7e41656e318e34e5283f35d609c0af560bccfab624b59051b16e1d

SHA512
b49e6734bb9afcbeb1f1240c88e7dbd54596988aa0a85dbc35133806314d60902c3993b80794a67d51317306db78196aaf0f0baece0177af2c8d447c429802cb

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
166.5MB

MD5
86ab930bf6f57ea05c0f4a34a338553c

SHA1
1b06f70908ad21437674354a5956e7eb0cf1ac69

SHA256
30afbb2bc81cfa2669d0084ea9ef142e636cb22cd329aea06aa4395d0e852208

SHA512
aaca5c03f57a707c45ee41cb106c3005fc183cba4dfde0064eb685404bb6e2a3cf05b865d679ea6154f3b8a753c000f014d00d46accb4582bf31e5b8c4e9d45c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
33b19d75aa77114216dbc23f43b195e3

SHA1
36a6c3975e619e0c5232aa4f5b7dc1fec9525535

SHA256
b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

SHA512
676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ratt.exe.log

Filesize
1KB

MD5
9a2d0ce437d2445330f2646472703087

SHA1
33c83e484a15f35c2caa3af62d5da6b7713a20ae

SHA256
30ea2f716e85f8d14a201e3fb0897d745a01b113342dfb7a9b7ac133c4ef150c

SHA512
a61d18d90bfad9ea8afdfa37537cfea3d5a3d0c161e323fa65840c283bdc87c3de85daaff5519beea2f2719eec1c68398eea8679b55ff733a61052f073162d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
5a293c22f472c7450f132a3623bc57e2

SHA1
51f7e093266ab0c59f8c5ea427092474aa67a628

SHA256
844dda2bffc01f70fefa94be2463d6d36f17f7f8b649ab936726071eefc41ea8

SHA512
db5ca2917f311cc6161282e9b2d1bb676efeca7d9def5c1caa239910aa59b42134b59886d7ba4a8e205f97033026dec5df657f9120c1b65e60549cf89dd5bad4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
2b808ba5487ba6d561079b514788e823

SHA1
e3e465301d8cae47899f1f14da7785d4dc594cfd

SHA256
08a8ff0198704ad20744f9fc9a5faaf3160e4f421453c3a6c86c898a58f82f89

SHA512
1c832cfbde24c3c8607e2f9ba948f96a1456d0e5d0ea9bb654659209ab4d717ce195596a84f5f3bbeda0ba6cfbaaea01d0b5cb582cb9bc49eea96643a7f55d98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
2639e9af4d9e5b7ecbacc4bcf062c461

SHA1
c033981abc7aa2f9296d99a29a765f8b40bbe95a

SHA256
25d864c2ed8cf2abefce9ca3075dca4f76e25a8e80cb5b71e72a880a907677a9

SHA512
cc1b2adc497ac4f01dd981d3c4e878167f1c47a9e4f836d06ddd525eb6977a4771fdd55ad25a01d29783d43450b1b9258641c649bfbf19c80ef58af75da6c2d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
f84e234c336c3fea30830006e5c74bee

SHA1
b119fe209bac1231e5bbd6a2a66ba232628122b3

SHA256
e0a9d29ca9e5b394855aa2947d1db463e3589e341e69d2e7169545e6fa1260b4

SHA512
5e7de986020997c8f7d6d8591d85c6a2d7d7e4b5ea0168b2dfe7483a17b77ec5517b8e0a606a6fbc8e529dc6a134058a051342af6f8312fbc7e07b45991e38d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
ea5aa005f5dd3937d80b12d35e7cfa0f

SHA1
ebc722f4810e733a619ebfb5bd9ac7d142078446

SHA256
5fa5ff35b7ef18af696a1c9ebc978848d4a5d0de3ecd97acb6a540f041fef656

SHA512
e3bbeb11b8b6e7ecf4982f9277c28a5a4334a308e3f0ff79f2c7b878c711d95d353df688a3e3d3ae0969cf2ba85f52f13dfe9dfd32361c65556c74f05dc60bfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ijxzlh2s.frt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
674.3MB

MD5
9d4f22311f6454405557220059ee70cf

SHA1
fc021351300c12853be6e496783f9226982ce7b3

SHA256
4d832ad48fd69f75f4e2734314f5a780bab0a2e4e76b7c8d9cc56e1e306186f2

SHA512
32de6cb664f68c60e5f7d6e789ed1d82eb3c893bf0de49d3711b44f1b19932867b4b8e7faebec71d57a62a6d82bf89eec6ba310b7e9eb35c73bcb0a1789d9852

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
93.4MB

MD5
05d260002aace33775328fe0ed1d0a64

SHA1
59553b810c3e6185ef4fcb0c91d5329065d3694a

SHA256
d49be86e43f4a6cb0de6b381b90b1176652c0cded3e869dd08ff09bbd0945d7b

SHA512
00d189e95b8923ea8adc89d6d4a4bbc5630aa9b660bfb5925e1c34dc6c3a87cb8d4418afd34b2b6aaa06da9f01793107010b42e9cbc831460db17e7072274ae7

Download Submit
memory/864-55-0x00000000045E0000-0x00000000045F0000-memory.dmp

Filesize
64KB

Download
memory/864-62-0x0000000005520000-0x0000000005874000-memory.dmp

Filesize
3.3MB

Download
memory/864-69-0x00000000045E0000-0x00000000045F0000-memory.dmp

Filesize
64KB

Download
memory/864-54-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/864-70-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/864-56-0x00000000045E0000-0x00000000045F0000-memory.dmp

Filesize
64KB

Download
memory/1732-81-0x00000000060B0000-0x0000000006404000-memory.dmp

Filesize
3.3MB

Download
memory/1732-72-0x00000000030D0000-0x00000000030E0000-memory.dmp

Filesize
64KB

Download
memory/1732-86-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/1732-71-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/1732-73-0x00000000030D0000-0x00000000030E0000-memory.dmp

Filesize
64KB

Download
memory/3212-102-0x0000000004D60000-0x0000000004D70000-memory.dmp

Filesize
64KB

Download
memory/3212-103-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/3212-87-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/3212-88-0x0000000004D60000-0x0000000004D70000-memory.dmp

Filesize
64KB

Download
memory/3212-89-0x0000000004D60000-0x0000000004D70000-memory.dmp

Filesize
64KB

Download
memory/3212-95-0x0000000005B80000-0x0000000005ED4000-memory.dmp

Filesize
3.3MB

Download
memory/4068-114-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4068-110-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/4068-106-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4232-148-0x0000000007810000-0x0000000007E8A000-memory.dmp

Filesize
6.5MB

Download
memory/4232-147-0x00000000070D0000-0x0000000007173000-memory.dmp

Filesize
652KB

Download
memory/4232-164-0x0000000008440000-0x00000000089E4000-memory.dmp

Filesize
5.6MB

Download
memory/4232-163-0x0000000007560000-0x0000000007582000-memory.dmp

Filesize
136KB

Download
memory/4232-161-0x000000007F8E0000-0x000000007F8F0000-memory.dmp

Filesize
64KB

Download
memory/4232-160-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/4232-159-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/4232-158-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/4232-157-0x0000000007420000-0x0000000007428000-memory.dmp

Filesize
32KB

Download
memory/4232-156-0x00000000074F0000-0x000000000750A000-memory.dmp

Filesize
104KB

Download
memory/4232-155-0x00000000073E0000-0x00000000073F4000-memory.dmp

Filesize
80KB

Download
memory/4232-154-0x00000000073D0000-0x00000000073DE000-memory.dmp

Filesize
56KB

Download
memory/4232-118-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4232-119-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/4232-120-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/4232-130-0x0000000005810000-0x0000000005B64000-memory.dmp

Filesize
3.3MB

Download
memory/4232-153-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4232-132-0x0000000006430000-0x000000000647C000-memory.dmp

Filesize
304KB

Download
memory/4232-152-0x00000000073B0000-0x00000000073C1000-memory.dmp

Filesize
68KB

Download
memory/4232-134-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/4232-135-0x0000000006E90000-0x0000000006EC2000-memory.dmp

Filesize
200KB

Download
memory/4232-136-0x0000000070D20000-0x0000000070D6C000-memory.dmp

Filesize
304KB

Download
memory/4232-146-0x0000000006480000-0x000000000649E000-memory.dmp

Filesize
120KB

Download
memory/4232-151-0x0000000007450000-0x00000000074E6000-memory.dmp

Filesize
600KB

Download
memory/4232-150-0x0000000007220000-0x000000000722A000-memory.dmp

Filesize
40KB

Download
memory/4232-149-0x00000000071C0000-0x00000000071DA000-memory.dmp

Filesize
104KB

Download
memory/4492-37-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4492-53-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4492-52-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/4492-49-0x0000000005C40000-0x0000000005F94000-memory.dmp

Filesize
3.3MB

Download
memory/4492-39-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/4492-38-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/4904-29-0x0000000006090000-0x00000000063E4000-memory.dmp

Filesize
3.3MB

Download
memory/4904-32-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download
memory/4904-35-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/4904-31-0x0000000006690000-0x00000000066DC000-memory.dmp

Filesize
304KB

Download
memory/4904-30-0x0000000006660000-0x000000000667E000-memory.dmp

Filesize
120KB

Download
memory/4904-17-0x00000000056A0000-0x00000000056C2000-memory.dmp

Filesize
136KB

Download
memory/4904-19-0x0000000006020000-0x0000000006086000-memory.dmp

Filesize
408KB

Download
memory/4904-18-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/4904-16-0x0000000005900000-0x0000000005F28000-memory.dmp

Filesize
6.2MB

Download
memory/4904-15-0x0000000003060000-0x0000000003096000-memory.dmp

Filesize
216KB

Download
memory/4904-14-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download
memory/4904-13-0x0000000074FD0000-0x0000000075780000-memory.dmp

Filesize
7.7MB

Download
memory/5048-167-0x0000000001000000-0x00000000011B6000-memory.dmp

Filesize
1.7MB

Download