Overview

overview

10

Static

static

3

Loader.exe

windows10-2004-x64

10

Loader.exe

windows11-21h2-x64

10

Loader.exe

macos-10.15-amd64

1

Analysis

  • user interaction
    yes
  • max time kernel
    83s
  • max time network
    84s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/09/2026, 04:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Loader.exe
  • Size 3.0MB
  • Sample260920-e49dpabp2s
  • SHA256 c2f5d16fc8a66951988a5d81659ee66e372e9494c19a339cf6eb697847620856
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionratonratpersistencestealer

Malware Config

Extracted

Family

  • ratonrat

Version

  • Professional

Mutex

  • yt2VYrvFgXmX8CP27YQCM4a

Attributes
  • assist

    false

  • box

    false

  • box_icon

    Error

  • box_msg

    I'm the message box description

  • box_title

    Hello World

  • defender

    false

  • delay

    0

  • hide_file

    true

  • open_website

    false

  • process_critical

    false

  • raw

    silly21

  • reconnect

    3

  • startup

    true

  • tag

    Infected

  • uac

    false

  • vm

    false

  • website

    https://t.me/example

Signatures

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat
  • Contains code to disable Windows Defender 3 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects RatonRAT payload 3 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Modifies registry class 18 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3292
      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4460
        • C:\Users\Admin\AppData\Local\Temp\Soft.exe
          "C:\Users\Admin\AppData\Local\Temp\Soft.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:812
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_DZdEXBKK1JFGvU5RLpRvHHPHFBq2LB.bat""
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5032
            • C:\Windows\system32\chcp.com
              chcp 65001
              5⤵
                PID:1748
              • C:\Windows\system32\timeout.exe
                timeout /t 2 /nobreak
                5⤵
                • Delays execution with timeout.exe
                PID:1792
              • C:\Users\Admin\AppData\Roaming\PlatformRuntime\Soft.exe
                "C:\Users\Admin\AppData\Roaming\PlatformRuntime\Soft.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3076
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks" /create /tn "Soft" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\Soft.exe\"" /rl HIGHEST /f
                  6⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:2236
              • C:\Windows\system32\timeout.exe
                timeout /t 1 /nobreak
                5⤵
                • Delays execution with timeout.exe
                PID:1028
        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
          2⤵
            PID:1036
          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
            2⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:984
          • C:\Windows\System32\RuntimeBroker.exe
            "C:\Windows\System32\RuntimeBroker.exe"
            2⤵
            • Downloads MZ/PE file
            • Registers new Windows logon scripts automatically executed at logon.
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:640
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c whoami /user
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3400
              • C:\Windows\system32\whoami.exe
                whoami /user
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4088
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c whoami /user
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1144
              • C:\Windows\system32\whoami.exe
                whoami /user
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2692
            • C:\Windows\system32\cmd.exe
              /c reg import "C:\Users\Admin\AppData\Local\Temp\_persist_240781515.reg"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1056
              • C:\Windows\system32\reg.exe
                reg import "C:\Users\Admin\AppData\Local\Temp\_persist_240781515.reg"
                4⤵
                • Modifies WinLogon for persistence
                • Registers new Windows logon scripts automatically executed at logon.
                • Modifies registry class
                PID:4108
        • C:\Users\Admin\AppData\Roaming\PlatformRuntime\Soft.exe
          "C:\Users\Admin\AppData\Roaming\PlatformRuntime\Soft.exe"
          1⤵
          • Executes dropped EXE
          PID:2952
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
            PID:3276
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe --headless C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hidden -nop -ep bypass -c "&([ScriptBlock]::Create([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String((Get-ItemProperty 'Registry::HKEY_USERS\S-1-5-21-747854149-4118156852-591593384-1000\Environment').NetCache9468B1))))"
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:1976
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hidden -nop -ep bypass -c "&([ScriptBlock]::Create([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String((Get-ItemProperty 'Registry::HKEY_USERS\S-1-5-21-747854149-4118156852-591593384-1000\Environment').NetCache9468B1))))"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1736
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\no2ezpeo\no2ezpeo.cmdline"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2176
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES291.tmp" "c:\Users\Admin\AppData\Local\Temp\no2ezpeo\CSCAFC94B425FA4E3285301EA3253CBA7.TMP"
                  4⤵
                    PID:2960

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  2
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Windows Command Shell

                  1
                  T1059.003

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Boot or Logon Initialization Scripts

                  1
                  T1037

                  Logon Script (Windows)

                  1
                  T1037.001

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Boot or Logon Initialization Scripts

                  1
                  T1037

                  Logon Script (Windows)

                  1
                  T1037.001

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Defense Evasion

                  Modify Registry

                  1
                  T1112

                  Credential Access

                  Discovery

                  Query Registry

                  3
                  T1012

                  System Information Discovery

                  3
                  T1082

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  103621DE9CD5414CC2538780B4B75751
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
                  • Size 808B
                  • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  1B1495DD322A24490E2BF2FAABAE1C61
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
                  • Size 355B
                  • SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  22D536C4B4AD2CEF7AC6B7789FD235E3
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
                  • Size 283B
                  • SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  A895B6D993B50747C556B6A6D9707284
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A895B6D993B50747C556B6A6D9707284
                  • Size 57KB
                  • SHA256 380e70043aa640a32e2a0912778e12239e783b5c15512ce9bf0456ef478c5b4f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  103621DE9CD5414CC2538780B4B75751
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
                  • Size 192B
                  • SHA256 191f9880e57df33a74eaf05351cd5bb84fe3224ad80cf1d094b64b70c12b4935
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  1B1495DD322A24490E2BF2FAABAE1C61
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
                  • Size 192B
                  • SHA256 bd7fb11de168ed7387d66117722e42daeb29e807457642fcfb209bd25ca5a8f6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  22D536C4B4AD2CEF7AC6B7789FD235E3
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
                  • Size 192B
                  • SHA256 fc0e43ea3d3cf889188c048d88d5b9ca17e21fcdbeb7860b13ded132427427e6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  A895B6D993B50747C556B6A6D9707284
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A895B6D993B50747C556B6A6D9707284
                  • Size 248B
                  • SHA256 2d8e1560171ea03abbf5425efb053b61b82323d8dc56ca71314d4572bc2462b5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Soft.exe.log
                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Soft.exe.log
                  • Size 859B
                  • SHA256 685f70bf685f654651dcd0acc495b6f52f02f73cc3ca8b3d2c8433aac9ba144d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  aforge.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.dll
                  • Size 17KB
                  • SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  aforge.video.directshow.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.directshow.dll
                  • Size 60KB
                  • SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  aforge.video.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.dll
                  • Size 20KB
                  • SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  costura.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\costura.dll
                  • Size 5KB
                  • SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  microsoft.win32.registry.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\microsoft.win32.registry.dll
                  • Size 22KB
                  • SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  naudio.asio.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.asio.dll
                  • Size 33KB
                  • SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  naudio.core.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.core.dll
                  • Size 183KB
                  • SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  naudio.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.dll
                  • Size 7KB
                  • SHA256 5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  naudio.midi.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.midi.dll
                  • Size 45KB
                  • SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  naudio.wasapi.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.wasapi.dll
                  • Size 176KB
                  • SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  naudio.winforms.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winforms.dll
                  • Size 33KB
                  • SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  naudio.winmm.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winmm.dll
                  • Size 56KB
                  • SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  newtonsoft.json.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\newtonsoft.json.dll
                  • Size 704KB
                  • SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  stuff.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
                  • Size 12KB
                  • SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  system.buffers.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.buffers.dll
                  • Size 20KB
                  • SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  system.memory.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.memory.dll
                  • Size 138KB
                  • SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  system.numerics.vectors.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.numerics.vectors.dll
                  • Size 113KB
                  • SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  system.resources.extensions.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.resources.extensions.dll
                  • Size 78KB
                  • SHA256 b69c9547c7bf0d6e357993d41228b6cef033f4f2e0ecba9f07325c7e980139ae
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  system.runtime.compilerservices.unsafe.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.runtime.compilerservices.unsafe.dll
                  • Size 16KB
                  • SHA256 70868cd40021b6df1195ba764a6672d8e19ab58b86a263992986361f316a51ce
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  system.security.accesscontrol.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.accesscontrol.dll
                  • Size 30KB
                  • SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  system.security.principal.windows.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.principal.windows.dll
                  • Size 14KB
                  • SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  RES291.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\RES291.tmp
                  • Size 1KB
                  • SHA256 5223f3799f48779805faa720d6a0a9a03386439f52037eedd81a886c5a96fe57
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Soft.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\Soft.exe
                  • Size 2.5MB
                  • SHA256 2daf95a7d0cb7579036afc7c1d58693cccb9351c6ea9c6b6475503ab61bfb92a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_m2tr1chn.zkk.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m2tr1chn.zkk.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  _persist_240781515.reg
                  • Path C:\Users\Admin\AppData\Local\Temp\_persist_240781515.reg
                  • Size 300KB
                  • SHA256 ac5a4071b08ff083a8a5dfc4911a159ef5616e89efb3928aa0f5626162803415
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  no2ezpeo.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\no2ezpeo\no2ezpeo.dll
                  • Size 3KB
                  • SHA256 54aca7395e62645f499d729eccdfb8bbcc653ee0b9f2f6bbe71cad9e9ea7f05d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  cleanup_DZdEXBKK1JFGvU5RLpRvHHPHFBq2LB.bat
                  • Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_DZdEXBKK1JFGvU5RLpRvHHPHFBq2LB.bat
                  • Size 518B
                  • SHA256 485b14c922691327eed2d42bfd316c42b591285926463d84985c8ab7e0f07d7d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  CSCAFC94B425FA4E3285301EA3253CBA7.TMP
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\no2ezpeo\CSCAFC94B425FA4E3285301EA3253CBA7.TMP
                  • Size 652B
                  • SHA256 d3cfff6077682a6b2d8c3f567ca63d21f7afed6c8265102e22a9a46568ed6ff5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  no2ezpeo.0.cs
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\no2ezpeo\no2ezpeo.0.cs
                  • Size 637B
                  • SHA256 8ae6ae9b08c30fcb39da410382f542c1b21d035842cf0e3bd3ac884caa0dec1a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  no2ezpeo.cmdline
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\no2ezpeo\no2ezpeo.cmdline
                  • Size 369B
                  • SHA256 5b448ec6380119f6b6429b99183aae3bc049083e24858a82c3c1dfe2f4bdfff0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/640-146-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-175-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-144-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-147-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-149-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-151-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-153-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-133-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-134-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-135-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-136-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-137-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-138-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-139-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-140-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-141-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-142-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-143-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-145-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-155-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-148-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-150-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-152-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-154-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-156-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-159-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-161-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-164-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-168-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-173-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-176-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-181-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-184-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-183-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-182-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-180-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-179-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-178-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-177-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-157-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-174-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-172-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-171-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-170-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-169-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-167-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-166-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-165-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-163-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-162-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-160-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/640-158-0x000002679F300000-0x000002679FA3D000-memory.dmp
                  Download

                  memory/812-29-0x0000022046D80000-0x000002204700E000-memory.dmp
                  Download

                  memory/812-83-0x00007FFAFF0F0000-0x00007FFAFF2E5000-memory.dmp
                  Download

                  memory/812-74-0x0000022061630000-0x000002206163A000-memory.dmp
                  Download

                  memory/812-30-0x00007FFAFF0F0000-0x00007FFAFF2E5000-memory.dmp
                  Download

                  memory/984-28-0x00007FFAFF18D000-0x00007FFAFF18E000-memory.dmp
                  Download

                  memory/984-26-0x0000000140000000-0x0000000140027000-memory.dmp
                  Download

                  memory/984-119-0x0000000140000000-0x0000000140027000-memory.dmp
                  Download

                  memory/984-210-0x0000000140000000-0x0000000140027000-memory.dmp
                  Download

                  memory/984-23-0x0000000140000000-0x0000000140027000-memory.dmp
                  Download

                  memory/984-24-0x00007FFAFF0F0000-0x00007FFAFF2E5000-memory.dmp
                  Download

                  memory/984-22-0x0000000140000000-0x0000000140027000-memory.dmp
                  Download

                  memory/984-21-0x0000000140000000-0x0000000140027000-memory.dmp
                  Download

                  memory/1036-15-0x0000000140000000-0x0000000140040000-memory.dmp
                  Download

                  memory/1036-20-0x0000000140000000-0x0000000140040000-memory.dmp
                  Download

                  memory/1036-18-0x0000000140000000-0x0000000140040000-memory.dmp
                  Download

                  memory/1036-17-0x0000000140000000-0x0000000140040000-memory.dmp
                  Download

                  memory/1036-25-0x0000000140000000-0x0000000140040000-memory.dmp
                  Download

                  memory/1036-16-0x0000000140000000-0x0000000140040000-memory.dmp
                  Download

                  memory/1036-14-0x0000000140000000-0x0000000140040000-memory.dmp
                  Download

                  memory/1036-19-0x0000000140000000-0x0000000140040000-memory.dmp
                  Download

                  memory/1036-13-0x0000000140000000-0x0000000140040000-memory.dmp
                  Download

                  memory/1736-227-0x000001CD786B0000-0x000001CD786D2000-memory.dmp
                  Download

                  memory/1736-242-0x000001CD78580000-0x000001CD78588000-memory.dmp
                  Download

                  memory/4460-0-0x0000000000730000-0x0000000000A3A000-memory.dmp
                  Download

                  memory/4460-1-0x000000001D3C0000-0x000000001D6B0000-memory.dmp
                  Download