ratonrat | 1a9fc8492eabd26832e92d35a5836cb1aa884c19a2d8f2318f4b7f969a705ed4

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 19:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
not fake_protected.exe
Size 2.5MB
Sample260815-x88bastsb1
SHA256 1a9fc8492eabd26832e92d35a5836cb1aa884c19a2d8f2318f4b7f969a705ed4
MD5 2d360671fe0ccd897a843217e0e938aa
SHA1 677583e0c68173f91e3f6e717cc47c9cb27a42b4
SHA512 44e6b41138ce118019f14a4285d7062933fc1ee37a5546be52b0c4150f24c42e5032f2988ff172458e8624c6de5fe3a707d9f2cca37dc7f94dd60a2c887846b0
SSDEEP 49152:sZ7F+Z65sew/K1rSjDdhixowkbE4aFcWOYgYr2jNclDRT7E7N2l98fCqlZ:sHasAK1+gHkg6sgYr2jKuN23v+
TLSH
T13FC51257CA7599EDC0AF2573FC1A6D8F6BD8B5E2A8B8C58BF48C041641B298D035F381
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution ratonrat persistence stealer

Malware Config

Extracted

Family

ratonrat

Version

Professional

jaydendestoyer101-44157.portmap.host:44157

Mutex

qluz6JLxdV94nSCVaFTMyTv

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
true
delay
0
hide_file
true
open_website
false
password
t.me/junk_code
process_critical
false
raw
https://pastebin.com/raw/k5PcpeFy
reconnect
3
startup
true
tag
Infected
uac
false
vm
false
website
https://t.me/example

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4708-5-0x0000000000400000-0x0000000000676000-memory.dmp	family_ratonrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4356	powershell.exe
4836	powershell.exe
1116	powershell.exe
4768	powershell.exe
4356	powershell.exe

Executes dropped EXE 7 IoCs

pid	Process
2104	not fake_protected.exe
3416	not fake_protected.exe
4692	not windows.exe
1464	not windows.exe
6092	not windows.exe
4364	not fake_protected.exe
4112	not fake_protected.exe

Loads dropped DLL 64 IoCs

pid	Process
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
4708	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\application = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\not windows.exe"	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2968 set thread context of 4708	2968	not fake_protected.exe	93
PID 2104 set thread context of 3416	2104	not fake_protected.exe	105
PID 4692 set thread context of 6092	4692	not windows.exe	114
PID 4364 set thread context of 4112	4364	not fake_protected.exe	123

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5108	cmd.exe
5588	cmd.exe
932	cmd.exe
4792	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	not fake_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	not fake_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	not fake_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	not fake_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	not fake_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	not fake_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	not windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5540	timeout.exe
1140	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
992	schtasks.exe
4908	schtasks.exe
456	schtasks.exe
2508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
4836	powershell.exe
4836	powershell.exe
1116	powershell.exe
1116	powershell.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
4356	powershell.exe
4356	powershell.exe
1116	powershell.exe
4356	powershell.exe
3416	not fake_protected.exe
4692	not windows.exe
4692	not windows.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
4768	powershell.exe
4768	powershell.exe
4768	powershell.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe
3416	not fake_protected.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	3416	not fake_protected.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeIncreaseQuotaPrivilege	4356	powershell.exe
Token: SeSecurityPrivilege	4356	powershell.exe
Token: SeTakeOwnershipPrivilege	4356	powershell.exe
Token: SeLoadDriverPrivilege	4356	powershell.exe
Token: SeSystemProfilePrivilege	4356	powershell.exe
Token: SeSystemtimePrivilege	4356	powershell.exe
Token: SeProfSingleProcessPrivilege	4356	powershell.exe
Token: SeIncBasePriorityPrivilege	4356	powershell.exe
Token: SeCreatePagefilePrivilege	4356	powershell.exe
Token: SeBackupPrivilege	4356	powershell.exe
Token: SeRestorePrivilege	4356	powershell.exe
Token: SeShutdownPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeSystemEnvironmentPrivilege	4356	powershell.exe
Token: SeRemoteShutdownPrivilege	4356	powershell.exe
Token: SeUndockPrivilege	4356	powershell.exe
Token: SeManageVolumePrivilege	4356	powershell.exe
Token: 33	4356	powershell.exe
Token: 34	4356	powershell.exe
Token: 35	4356	powershell.exe
Token: 36	4356	powershell.exe
Token: SeDebugPrivilege	4692	not windows.exe
Token: SeDebugPrivilege	4768	powershell.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 4836	2968	not fake_protected.exe	89
PID 2968 wrote to memory of 5108	2968	not fake_protected.exe	90
PID 2968 wrote to memory of 4708	2968	not fake_protected.exe	93
PID 2968 wrote to memory of 4708	2968	not fake_protected.exe	93
PID 2968 wrote to memory of 4708	2968	not fake_protected.exe	93
PID 2968 wrote to memory of 4708	2968	not fake_protected.exe	93
PID 2968 wrote to memory of 4708	2968	not fake_protected.exe	93
PID 5108 wrote to memory of 456	5108	cmd.exe	94
PID 4708 wrote to memory of 5588	4708	not fake_protected.exe	95
PID 5588 wrote to memory of 2116	5588	cmd.exe	97
PID 5588 wrote to memory of 5540	5588	cmd.exe	98
PID 5588 wrote to memory of 2104	5588	cmd.exe	100
PID 5588 wrote to memory of 1140	5588	cmd.exe	101
PID 2104 wrote to memory of 1116	2104	not fake_protected.exe	102
PID 2104 wrote to memory of 932	2104	not fake_protected.exe	103
PID 2104 wrote to memory of 3416	2104	not fake_protected.exe	105
PID 2104 wrote to memory of 3416	2104	not fake_protected.exe	105
PID 2104 wrote to memory of 3416	2104	not fake_protected.exe	105
PID 2104 wrote to memory of 3416	2104	not fake_protected.exe	105
PID 2104 wrote to memory of 3416	2104	not fake_protected.exe	105
PID 932 wrote to memory of 2508	932	cmd.exe	107
PID 3416 wrote to memory of 4356	3416	not fake_protected.exe	108
PID 4692 wrote to memory of 1464	4692	not windows.exe	113
PID 4692 wrote to memory of 6092	4692	not windows.exe	114
PID 4692 wrote to memory of 6092	4692	not windows.exe	114
PID 4692 wrote to memory of 6092	4692	not windows.exe	114
PID 4692 wrote to memory of 6092	4692	not windows.exe	114
PID 4692 wrote to memory of 6092	4692	not windows.exe	114
PID 3416 wrote to memory of 992	3416	not fake_protected.exe	115
PID 4364 wrote to memory of 4768	4364	not fake_protected.exe	119
PID 4364 wrote to memory of 4792	4364	not fake_protected.exe	120
PID 4364 wrote to memory of 4112	4364	not fake_protected.exe	123
PID 4364 wrote to memory of 4112	4364	not fake_protected.exe	123
PID 4364 wrote to memory of 4112	4364	not fake_protected.exe	123
PID 4364 wrote to memory of 4112	4364	not fake_protected.exe	123
PID 4364 wrote to memory of 4112	4364	not fake_protected.exe	123
PID 4792 wrote to memory of 4908	4792	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\not fake_protected.exe
"C:\Users\Admin\AppData\Local\Temp\not fake_protected.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'application';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'application' -Value '"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\not windows.exe"' -PropertyType 'String'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /C schtasks /create /tn \application /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\not windows.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn \application /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\not windows.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:456
- C:\Users\Admin\AppData\Local\Temp\not fake_protected.exe
  #cmd
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_FfADsVuOBvbFPqDqnxce2uU21LtZ4j.bat""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5588
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:2116
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5540
  - - C:\Users\Admin\AppData\Roaming\PlatformRuntime\not fake_protected.exe
      "C:\Users\Admin\AppData\Roaming\PlatformRuntime\not fake_protected.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2104
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'application';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'application' -Value '"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\not windows.exe"' -PropertyType 'String'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1116
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /C schtasks /create /tn \application /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\not windows.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:932
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn \application /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\not windows.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2508
    - - C:\Users\Admin\AppData\Roaming\PlatformRuntime\not fake_protected.exe
        
        #cmd
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3416
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\not fake_protected.exe'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "not fake_protected" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\not fake_protected.exe\"" /rl HIGHEST /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:992
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1140

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\not windows.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\not windows.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\not windows.exe
  #cmd
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\not windows.exe
  #cmd
  2⤵
  - Executes dropped EXE
  PID:6092

C:\Users\Admin\AppData\Roaming\PlatformRuntime\not fake_protected.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\not fake_protected.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'application';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'application' -Value '"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\not windows.exe"' -PropertyType 'String'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /C schtasks /create /tn \application /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\not windows.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn \application /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\not windows.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4908
- C:\Users\Admin\AppData\Roaming\PlatformRuntime\not fake_protected.exe
  #cmd
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aforge.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.dll
Size 17KB
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.directshow.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.directshow.dll
Size 60KB
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.dll
Size 20KB
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

costura.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\costura.dll
Size 5KB
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.win32.registry.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\microsoft.win32.registry.dll
Size 22KB
SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
MD5 da40f3db8b34571684c0cb5bcecd2a79
SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
TLSH
T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.asio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.asio.dll
Size 33KB
SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
MD5 01a76191d31b3d6042484e452bd66ce0
SHA1 c84ecf4875c17d9cc91c911feabca640c7ffc661
SHA512 09fa738e43b1a4272a9e16045bcc0fd00858f4367d41b1f9fe3cf97589379b5fcd1fcbd1a24bca74a08187f080941cb575332d3725f620f93fd0b414dea0a9bd
SSDEEP 768:EehRrWpB5henH0HTYdpVCYKo9coe6ttHjBR/:EehRr68U47QGtHFx
TLSH
T10BF22B71EBD84A27C92E2779A0F2040407B5F191F623EB4F9A4C94A96FE73594790373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.core.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.core.dll
Size 183KB
SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
MD5 4e4302ce791e48f985a3a221a19a272b
SHA1 d2b0fd622daf57a012c3cf5bdf4b187f27d5d080
SHA512 1685a17be6d64c222ec606488e3f8e9707a8b7709054e9e99cb53c7b438f5b993820e2e9773e02455525ee06e18aa65ae150420224311f6c69d795c3d129e312
SSDEEP 3072:6lnWpdQWUY6GwfIGsnlLieRT0TWsPtt3RBntgqK2QlVEOPkk6uSYsM+S70I:FpdQJY6GwfIGOLi7tt3RBntgn2QlVEEO
TLSH
T151045B2563E48266E66F9BB5F0F204178BF0F4463437DB4E5E806AE92A07B01C592F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.dll
Size 7KB
SHA256 5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 e90ac3063409ef6876e26422dc61d0eb
SHA1 3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
SHA512 a04dc95e234652c8f4a8ddec88ee3ebd87e68d826eac008625f994323e569d3a3026c7cd7ce2d790ae2ac3018fadf10e600e7ba13cab9bbcc49192263a32fe6a
SSDEEP 96:QDBFskeJHnqvjZkcLqED5Iyr2T7AVUhkon1MrtrRGc5pkQrESd2uYO:QD7kHnqNkcLWyr2T7zSon1MRlwQoStY
TLSH
T1FDF1D724A398CA77CE6347B1A86706401379FA80A917CB2E0D8CA18FBD537594BB27D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.midi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.midi.dll
Size 45KB
SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 f6940019dad6c782bcb645c2f7d52db5
SHA1 1bbe492757bf99840d923fdd44c6a3f34b336cf7
SHA512 1da566cd9f7b0a81f9d858b48306111b0791991f867e77d24f87f26badf93ca6e6414b12669d83b4d3f0b96959c48172f4a77119dbd12e6d8b9e0d0b48caa006
SSDEEP 768:xwuDUaOqgwjYpA2knmsbS+O/RXgQPODHM0Mx7hlEmmyFyaetiWvmYRMUQ6LUOu5r:xwuDU7fwT2kmsbRMZgQP6HM0Mx7DP3eT
TLSH
T15C232A15A3F8861AE2BF3779FC7056110BB2B9867A32D74F0AD468AD1D237844C61773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winforms.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winforms.dll
Size 33KB
SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 115137414b41a26d6e73738cd94c036c
SHA1 e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SHA512 d30fd0043bb483e67700de48283d632811d45e89564ea6d9454b6a38dc3fee5440719224ec4085c70d21c665222f27dbb482ac5f578326a7698ecb7b46599b4c
SSDEEP 768:qNMJ4j7TupqLC+VHDvtiT8dMRrvCPRtbQDmZ1RnT+Geh:8uiCP8dIvMzbQDmcV
TLSH
T188E228195398CBBBC77E0E7944A211060376EA81B501FBED5EC8B1DD8D937520B60BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winmm.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winmm.dll
Size 56KB
SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 c1b78af3d6402be8f259dbbe9250e7fb
SHA1 98e2c38597c50390852801d46ff342889c7351ae
SHA512 776d15d506798eb4a66d5cb5b45591e1767f4030f14aa91198fdf0bcad2e689835418629a1cd3f2af36add4809adb04dd3a850d9d8f2594b0737e72cecc437cf
SSDEEP 768:jpQFu52mn7eYuo4OzgyA90g01OcjDHvgxLMgGd8GbIDrXa8Rcer+7bE:lQ8hexo4QguNHvgxLufIDudE
TLSH
T1BA433B017BDD427AD2FE1B3DA0F30A524734A892756BFB4F1998F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
Size 12KB
SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 f8d5274e3368aa40cc0fd5798d19c783
SHA1 87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SHA512 fa3f106d4ab31c0d516b4623f3108b29c05993a6e65e6e1f1a49e7d101860f78c63843743c3e560c2891fccade27e6024e7b1566d4b99dd0fa90480c1d1a45bc
SSDEEP 192:cl/e0xEXKl04vygxTppSYgDnWgdCpZ8u8u8u8u8u8u8u8u2JHqW6LvEX6KSf5V00:cl/nxEXKl04vygkJ9dddddddBAW6AX6d
TLSH
T15D42192DB784866FD96C0B3EB86622541772EA30AE63DF8F1CC4B03E7D6735885505B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.memory.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.numerics.vectors.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.numerics.vectors.dll
Size 113KB
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.resources.extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.resources.extensions.dll
Size 78KB
SHA256 b69c9547c7bf0d6e357993d41228b6cef033f4f2e0ecba9f07325c7e980139ae
MD5 058062075dae2f0db660018d899358da
SHA1 4489f30223d4f80ad7c220615be2047afa82f085
SHA512 d2a568d19a0dfe06f9d9916c335fa1d752ed7ca78844124079e41b34c2342cbe3486f1d77a68c6cdd576d30fe84d03b12a7c7a5aabd09ee98174b0a167af01c7
SSDEEP 1536:PElSh0fXNlYQRZLj2O5xEMXfy6lNQYjLTb+G8uNsHQEispJnuFvTbp6wy/ei+zq9:PlLQCpuh6wMs+9
TLSH
T12973B51173FC5319F6FB2FB865F151118A3ABDA2A931D62D198160DE1AB2BC08D70B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.runtime.compilerservices.unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.runtime.compilerservices.unsafe.dll
Size 16KB
SHA256 70868cd40021b6df1195ba764a6672d8e19ab58b86a263992986361f316a51ce
MD5 b78649f583f2b905c1cbf79ab90cc108
SHA1 847ec2fefaddbd2420e20065193497fa1ef2b489
SHA512 e9e99c5e60388956ac7cc8c2ae963364ad74a89432c5fae514648a68e24c13a684577313056ac9b6a264729f5c99de68bc809c14482d4f9dd12835f3cd13522d
SSDEEP 192:9Y4tIhywFXXbxfxdPWg9hWMW65FdQHnhWgN7aJeWPLyFqnajRRuvp7:9Y8ItFXXb/dPWg9hWOQHRN7WrolVRuvF
TLSH
T178723B999BA81103EE631F3096A5C943FE3CB3D61902D31D3985F7785C9E7D4AE20638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.accesscontrol.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.accesscontrol.dll
Size 30KB
SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
MD5 2d3e0b4ddf8628b41057b2aceef296eb
SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
TLSH
T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.principal.windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.principal.windows.dll
Size 14KB
SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
MD5 b40bda63658a012d46f930c243b77056
SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
TLSH
T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_phzpwmrz.y3u.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_phzpwmrz.y3u.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

not fake_protected.exe

Path C:\Users\Admin\AppData\Roaming\PlatformRuntime\not fake_protected.exe
Size 2.5MB
SHA256 1a9fc8492eabd26832e92d35a5836cb1aa884c19a2d8f2318f4b7f969a705ed4
MD5 2d360671fe0ccd897a843217e0e938aa
SHA1 677583e0c68173f91e3f6e717cc47c9cb27a42b4
SHA512 44e6b41138ce118019f14a4285d7062933fc1ee37a5546be52b0c4150f24c42e5032f2988ff172458e8624c6de5fe3a707d9f2cca37dc7f94dd60a2c887846b0
SSDEEP 49152:sZ7F+Z65sew/K1rSjDdhixowkbE4aFcWOYgYr2jNclDRT7E7N2l98fCqlZ:sHasAK1+gHkg6sgYr2jKuN23v+
TLSH
T13FC51257CA7599EDC0AF2573FC1A6D8F6BD8B5E2A8B8C58BF48C041641B298D035F381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_FfADsVuOBvbFPqDqnxce2uU21LtZ4j.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_FfADsVuOBvbFPqDqnxce2uU21LtZ4j.bat
Size 574B
SHA256 a675d0deb08ecd965c0208f4f4c5acb5437dfadec3cb816e4d4c359336fc868b
MD5 b430eeaa172207b7a5f3656b46628b51
SHA1 e72cbb5b62f3526b1c64bcc3f05a2cb3801ae753
SHA512 b78ef0204f616046ae578a6694ef0ff7baf231d7ec33866a1db15d0c4b9758c92d188b6f6ac2e59900207dc4f031d4d44f02898e6641ccf0dd9569c1394b737e
TLSH
T134F0244966CFC70F545051B70EB7B58CE1B584977F8076817BA8C00A0B9251BEEC3BA2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1116-175-0x0000000007590000-0x0000000007C0C000-memory.dmp

Download

memory/1116-166-0x0000000006BC0000-0x0000000006BF6000-memory.dmp

Download

memory/1116-177-0x0000000006FC0000-0x0000000006FCA000-memory.dmp

Download

memory/1116-176-0x0000000006F50000-0x0000000006F6A000-memory.dmp

Download

memory/1116-182-0x0000000007140000-0x0000000007151000-memory.dmp

Download

memory/1116-171-0x0000000006C10000-0x0000000006CB3000-memory.dmp

Download

memory/1116-184-0x0000000007170000-0x0000000007180000-memory.dmp

Download

memory/1116-185-0x0000000007180000-0x0000000007195000-memory.dmp

Download

memory/1116-170-0x0000000006BA0000-0x0000000006BC0000-memory.dmp

Download

memory/1116-178-0x00000000071C0000-0x0000000007256000-memory.dmp

Download

memory/1116-186-0x0000000007290000-0x00000000072AC000-memory.dmp

Download

memory/1116-188-0x00000000072B0000-0x00000000072B8000-memory.dmp

Download

memory/1116-190-0x0000000007400000-0x0000000007422000-memory.dmp

Download

memory/1116-167-0x00000000729C0000-0x0000000072A0C000-memory.dmp

Download

memory/2968-0-0x0000000074AD2000-0x0000000074AD3000-memory.dmp

Download

memory/2968-2-0x00000000055E0000-0x0000000005B9A000-memory.dmp

Download

memory/2968-1-0x0000000000440000-0x00000000006C0000-memory.dmp

Download

memory/3416-189-0x00000000063C0000-0x00000000063CA000-memory.dmp

Download

memory/3416-212-0x0000000008060000-0x0000000008092000-memory.dmp

Download

memory/3416-197-0x0000000007450000-0x00000000074EC000-memory.dmp

Download

memory/3416-198-0x0000000007620000-0x00000000076D4000-memory.dmp

Download

memory/3416-196-0x0000000007390000-0x000000000739A000-memory.dmp

Download

memory/3416-213-0x00000000080A0000-0x00000000080BA000-memory.dmp

Download

memory/4356-179-0x00000000729C0000-0x0000000072A0C000-memory.dmp

Download

memory/4708-140-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4708-129-0x0000000005BF0000-0x0000000005BFA000-memory.dmp

Download

memory/4708-10-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4708-135-0x0000000005CC0000-0x0000000005D52000-memory.dmp

Download

memory/4708-6-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4708-5-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/4768-210-0x0000000007C00000-0x0000000007C15000-memory.dmp

Download

memory/4768-209-0x0000000007BC0000-0x0000000007BD1000-memory.dmp

Download

memory/4768-208-0x00000000078B0000-0x0000000007953000-memory.dmp

Download

memory/4768-205-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

Download

memory/4768-204-0x0000000006850000-0x000000000689C000-memory.dmp

Download

memory/4768-203-0x0000000006070000-0x00000000063CB000-memory.dmp

Download

memory/4836-9-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4836-47-0x0000000005800000-0x0000000005B5B000-memory.dmp

Download

memory/4836-43-0x0000000005680000-0x00000000056E6000-memory.dmp

Download

memory/4836-195-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4836-44-0x00000000056F0000-0x0000000005756000-memory.dmp

Download

memory/4836-187-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4836-42-0x0000000004E80000-0x0000000004EA2000-memory.dmp

Download

memory/4836-33-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4836-11-0x0000000005030000-0x000000000567A000-memory.dmp

Download

memory/4836-183-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4836-88-0x0000000005C50000-0x0000000005C6E000-memory.dmp

Download

memory/4836-89-0x0000000005C90000-0x0000000005CDC000-memory.dmp

Download

memory/4836-8-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4836-172-0x00000000729C0000-0x0000000072A0C000-memory.dmp

Download

memory/4836-7-0x0000000002410000-0x0000000002446000-memory.dmp

Download