defendnot | 2b655e235a7fada0895ca197a65dcde998e1e33b91c16868b64c759fb904059c

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_9cf5b3e947d1dba0ca6854ddd0890504_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 24.2MB
Sample261012-sbmwwaxtf1
SHA256 2b655e235a7fada0895ca197a65dcde998e1e33b91c16868b64c759fb904059c
MD5 9cf5b3e947d1dba0ca6854ddd0890504
SHA1 92b863cb8607837128be50275d91777e078a21d3
SHA512 4de9f2e474713fd893f95d84a7e7582c9595a8fb0d8fbae445b26919caec84e69d808a3c738c563ad2bf2992f157d71bb510f6b293cda8943e5e74ee13193a66
SSDEEP 786432:nkxEp8FaXRyHwkOSZqSzH7eG7U0ficCKzTnswV:kmXRyHSOT7eG7U05RTns2
TLSH
T18047330497EC00F9E1F3907999F38A42DF73B48F5772A68B078C49651F531A0A9BEB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution defendnot xworm hacktool persistence privilege_escalation rat trojan upx

Malware Config

Extracted

Family

xworm

us.loclx.io:49051

Attributes

Install_directory
%ProgramData%
install_file
DlpUserAgent.exe

Signatures

Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
hacktool defendnot
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c437-613.dat	family_xworm
behavioral2/memory/4040-624-0x00000000001F0000-0x0000000000238000-memory.dmp	family_xworm

Detects Defendnot 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c436-653.dat	family_defendnot

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c437-613.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4040-624-0x00000000001F0000-0x0000000000238000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c438-605.dat	UPX
behavioral2/memory/5252-610-0x0000000140000000-0x0000000140027000-memory.dmp	UPX
behavioral2/memory/5252-664-0x0000000140000000-0x0000000140027000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4672	powershell.exe
476	powershell.exe
2272	powershell.exe
6064	powershell.exe
4632	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DlpUserAgent.lnk	DlpUserAgent.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DlpUserAgent.lnk	DlpUserAgent.exe

Executes dropped EXE 9 IoCs

pid	Process
5252	notdefend.exe
4040	DlpUserAgent.exe
296	Raton.exe
1748	defendnot-loader.exe
2724	defendnot-loader.exe
5980	DlpUserAgent.exe
2680	DlpUserAgent.exe
5460	DlpUserAgent.exe
3640	DlpUserAgent.exe

Loads dropped DLL 2 IoCs

pid	Process
1696	Taskmgr.exe
3024	Taskmgr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\DlpUserAgent = "C:\\ProgramData\\DlpUserAgent.exe"	DlpUserAgent.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Icons\desktop.ini	2026-10-11_9cf5b3e947d1dba0ca6854ddd0890504_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Icons\desktop.ini	2026-10-11_9cf5b3e947d1dba0ca6854ddd0890504_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipapi.co
7	ipapi.co

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c438-605.dat	upx
behavioral2/memory/5252-610-0x0000000140000000-0x0000000140027000-memory.dmp	upx
behavioral2/memory/5252-664-0x0000000140000000-0x0000000140027000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SERVIC~1\LOCALS~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	DlpUserAgent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1952	cmd.exe
2444	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Raton.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DlpUserAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DlpUserAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Raton.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
476	powershell.exe
476	powershell.exe
476	powershell.exe
2272	powershell.exe
2272	powershell.exe
2272	powershell.exe
6064	powershell.exe
6064	powershell.exe
6064	powershell.exe
4632	powershell.exe
4632	powershell.exe
4632	powershell.exe
4040	DlpUserAgent.exe
4040	DlpUserAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4040	DlpUserAgent.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	296	Raton.exe
Token: SeDebugPrivilege	476	powershell.exe
Token: SeIncreaseQuotaPrivilege	476	powershell.exe
Token: SeSecurityPrivilege	476	powershell.exe
Token: SeTakeOwnershipPrivilege	476	powershell.exe
Token: SeLoadDriverPrivilege	476	powershell.exe
Token: SeSystemProfilePrivilege	476	powershell.exe
Token: SeSystemtimePrivilege	476	powershell.exe
Token: SeProfSingleProcessPrivilege	476	powershell.exe
Token: SeIncBasePriorityPrivilege	476	powershell.exe
Token: SeCreatePagefilePrivilege	476	powershell.exe
Token: SeBackupPrivilege	476	powershell.exe
Token: SeRestorePrivilege	476	powershell.exe
Token: SeShutdownPrivilege	476	powershell.exe
Token: SeDebugPrivilege	476	powershell.exe
Token: SeSystemEnvironmentPrivilege	476	powershell.exe
Token: SeRemoteShutdownPrivilege	476	powershell.exe
Token: SeUndockPrivilege	476	powershell.exe
Token: SeManageVolumePrivilege	476	powershell.exe
Token: 33	476	powershell.exe
Token: 34	476	powershell.exe
Token: 35	476	powershell.exe
Token: 36	476	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeIncreaseQuotaPrivilege	2272	powershell.exe
Token: SeSecurityPrivilege	2272	powershell.exe
Token: SeTakeOwnershipPrivilege	2272	powershell.exe
Token: SeLoadDriverPrivilege	2272	powershell.exe
Token: SeSystemProfilePrivilege	2272	powershell.exe
Token: SeSystemtimePrivilege	2272	powershell.exe
Token: SeProfSingleProcessPrivilege	2272	powershell.exe
Token: SeIncBasePriorityPrivilege	2272	powershell.exe
Token: SeCreatePagefilePrivilege	2272	powershell.exe
Token: SeBackupPrivilege	2272	powershell.exe
Token: SeRestorePrivilege	2272	powershell.exe
Token: SeShutdownPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeSystemEnvironmentPrivilege	2272	powershell.exe
Token: SeRemoteShutdownPrivilege	2272	powershell.exe
Token: SeUndockPrivilege	2272	powershell.exe
Token: SeManageVolumePrivilege	2272	powershell.exe
Token: 33	2272	powershell.exe
Token: 34	2272	powershell.exe
Token: 35	2272	powershell.exe
Token: 36	2272	powershell.exe
Token: SeDebugPrivilege	6064	powershell.exe
Token: SeIncreaseQuotaPrivilege	6064	powershell.exe
Token: SeSecurityPrivilege	6064	powershell.exe
Token: SeTakeOwnershipPrivilege	6064	powershell.exe
Token: SeLoadDriverPrivilege	6064	powershell.exe
Token: SeSystemProfilePrivilege	6064	powershell.exe
Token: SeSystemtimePrivilege	6064	powershell.exe
Token: SeProfSingleProcessPrivilege	6064	powershell.exe
Token: SeIncBasePriorityPrivilege	6064	powershell.exe
Token: SeCreatePagefilePrivilege	6064	powershell.exe
Token: SeBackupPrivilege	6064	powershell.exe
Token: SeRestorePrivilege	6064	powershell.exe
Token: SeShutdownPrivilege	6064	powershell.exe
Token: SeDebugPrivilege	6064	powershell.exe
Token: SeSystemEnvironmentPrivilege	6064	powershell.exe
Token: SeRemoteShutdownPrivilege	6064	powershell.exe
Token: SeUndockPrivilege	6064	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4040	DlpUserAgent.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 5252	5080	2026-10-11_9cf5b3e947d1dba0ca6854ddd0890504_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 5080 wrote to memory of 4040	5080	2026-10-11_9cf5b3e947d1dba0ca6854ddd0890504_cryptbot_icedid_luca-stealer_njrat_stealc.exe	90
PID 5252 wrote to memory of 2444	5252	notdefend.exe	91
PID 2444 wrote to memory of 4672	2444	cmd.exe	93
PID 5080 wrote to memory of 296	5080	2026-10-11_9cf5b3e947d1dba0ca6854ddd0890504_cryptbot_icedid_luca-stealer_njrat_stealc.exe	94
PID 4672 wrote to memory of 1748	4672	powershell.exe	95
PID 1748 wrote to memory of 1696	1748	defendnot-loader.exe	96
PID 4040 wrote to memory of 476	4040	DlpUserAgent.exe	97
PID 2724 wrote to memory of 3024	2724	defendnot-loader.exe	102
PID 2724 wrote to memory of 1952	2724	defendnot-loader.exe	106
PID 4040 wrote to memory of 2272	4040	DlpUserAgent.exe	107
PID 4040 wrote to memory of 6064	4040	DlpUserAgent.exe	109
PID 4040 wrote to memory of 4632	4040	DlpUserAgent.exe	111
PID 4040 wrote to memory of 3644	4040	DlpUserAgent.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-11_9cf5b3e947d1dba0ca6854ddd0890504_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_9cf5b3e947d1dba0ca6854ddd0890504_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Roaming\notdefend.exe
  "C:\Users\Admin\AppData\Roaming\notdefend.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5252
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E366.tmp\E367.tmp\E368.bat C:\Users\Admin\AppData\Roaming\notdefend.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process 'defendnot-loader.exe' -ArgumentList '-n microsoft360-enable','--silent','--autorun-as-user' -NoNewWindow"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4672
    - - C:\Users\Admin\AppData\Roaming\defendnot-loader.exe
        
        "defendnot-loader.exe" -n microsoft360-enable --silent --autorun-as-user
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1748
      - C:\Windows\SYSTEM32\Taskmgr.exe
        
        Taskmgr.exe
        6⤵
        Loads dropped DLL
        
        PID:1696
- C:\Users\Admin\AppData\Roaming\DlpUserAgent.exe
  "C:\Users\Admin\AppData\Roaming\DlpUserAgent.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\DlpUserAgent.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DlpUserAgent.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\DlpUserAgent.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DlpUserAgent.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4632
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DlpUserAgent" /tr "C:\ProgramData\DlpUserAgent.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3644
- C:\Users\Admin\AppData\Roaming\Raton.exe
  "C:\Users\Admin\AppData\Roaming\Raton.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:296

C:\Users\Admin\AppData\Roaming\defendnot-loader.exe
C:\Users\Admin\AppData\Roaming\defendnot-loader.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SYSTEM32\Taskmgr.exe
  Taskmgr.exe
  2⤵
  - Loads dropped DLL
  PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:1952

C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\MpCmdRun.exe" -wdenable
1⤵
- Drops file in Windows directory
PID:2560

C:\PROGRA~3\DlpUserAgent.exe
C:\PROGRA~3\DLPUSE~1.EXE
1⤵
- Executes dropped EXE
PID:5980

C:\ProgramData\DlpUserAgent.exe
C:\ProgramData\DlpUserAgent.exe
1⤵
- Executes dropped EXE
PID:2680

C:\ProgramData\DlpUserAgent.exe
"C:\ProgramData\DlpUserAgent.exe"
1⤵
- Executes dropped EXE
PID:5460

C:\ProgramData\DlpUserAgent.exe
"C:\ProgramData\DlpUserAgent.exe"
1⤵
- Executes dropped EXE
PID:3640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9e2e11b45a68ab3614fb2b5ae84f9bec9e5638950f0446e20d5c2f7c7880c2dd
MD5 bc9eda99a7d6ac9c8bb79a0a10a7a246
SHA1 e019eaaca01667502f8a07359970870bfc2f98fb
SHA512 233d94436ab566d2570ab7eca454491646569c0c361f28d4f322df7a6e774f15b4fa5227f01a7be4fc5db6acbfb25bbe5e6501081176588be99c96c671e4fb19
TLSH
T1C4215937B3DC8625DC9A413A10CEAC1036B6C7DB419ECEAB7B84D544A42F699DE60560
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 05e62f0e9d5e235392638832ed75b185d66a43c0eaeb088860e15b62c8f8d606
MD5 66e2aa229ce8b32dfdbe1f2e76ea72e4
SHA1 fed857946dde166a7ff6b5d033e03ada9e00ae62
SHA512 0c932b0c55035c83ac97c09df4d396eba1678903d588d7cd781defb408ebeb0ff3ae32df845edd98b20d48f22f3b2c0871535a5312063231778eaf8e9ffb5119
TLSH
T1DD216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d6adf751a6c0c74bed0bd08508cb3078afcaaba6514718c0db9792bb6a1a02fa
MD5 b20ad66a34d257086e53a5b2b34a7b45
SHA1 65acca05f0cb24d786b137cdb05f8af99ccbf9b7
SHA512 4fe111c650bbe2fb71c9be6826f810c97faa9f05e84c2d31c41f1651f91575fa66dc6bb5c2d85cddb9861b3864bbe52823e1bb46971b1e34dfa34dadf40cd558
TLSH
T181219833B3DC8614C89A003A10CDAC1036B6CBCB40DECE5B6B80E655A43F698CE60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dd8fb238c5ec9091f7c4eb163abeed9bfb59bdcabe3be9dedd6baf626cc9d941
MD5 e291846fc0a47f168f27a94ee1073d8d
SHA1 fb6ae067a88d612cee6da50c856456c0f4874a79
SHA512 9a5525dee474c3647541c218a158b30d5eaf70e3ad7f74ea5a19bc4d78f653c2ea5f151e50197744719d2c1c600265f5490a507d0b04a735af79311360736896
TLSH
T165219833B3CC8614CC9A003A10CDAC1036B6CBCB40DECE5B6B80E655A43F698CE60060
MD5 SHA1 SHA512 TLSH

Submit Download

E368.bat

Path C:\Users\Admin\AppData\Local\Temp\E366.tmp\E367.tmp\E368.bat
Size 189B
SHA256 e87588321343d49f9472ee53ca7567bc08cb52c7e81852f5f492fcdc29834c67
MD5 cffd3e45e94ae939eb396bf36d4edf81
SHA1 b2d21c46580e6a4144f962d464ee27fed9ed6158
SHA512 2f352aca98bbaee2e70fba3b03eaa2aa595d561e101910e726b5fd9f869e7c9ff49022bf881fc1cc4a55287d35f6ffb792bc1b09138d246306262c517f5343f4
TLSH
T126C022352858B46BEB54C223209A570AFAAA1143000B041715AAA42D7B800CBC3C8C10
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_a4m2v05q.dfb.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a4m2v05q.dfb.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

DlpUserAgent.exe

Path C:\Users\Admin\AppData\Roaming\DlpUserAgent.exe
Size 264KB
SHA256 a9cab3703ef08bacc6eb5b977417c5f9f7ba872ebccf5969ee3573de10b7b5ae
MD5 4cfa21530b0359fc7478c2dff8b2405f
SHA1 690af1387a7fc2208e5532d252b1ab825eeda927
SHA512 305c6fba163a8b6a1fcef7d99ad9f9393d26f9ec0cf4e6e2d5f41eac31b75598c27b44ca991c48c63999ec1383a8a230915b089996d538bb4b152b914b0a465d
SSDEEP 6144:Oi5n7EbrGim2iTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVVOVVUVI:D7pic
TLSH
T17244A791CF88148BDC399F31E2B0B6A54B7BEAD0B8D99F6D206D3D2D7C549409C027B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Power.ico

Path C:\Users\Admin\AppData\Roaming\Icons\Power.ico
Size 361KB
SHA256 b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
MD5 e3143e8c70427a56dac73a808cba0c79
SHA1 63556c7ad9e778d5bd9092f834b5cc751e419d16
SHA512 74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
SSDEEP 768:0nnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZZZZZZZZZZaaa0KaaILjeuFgZ:Rkccckccccct
TLSH
T18E74051CB53AFC87E85A9E727E42E77588BE2C135F608841F604FFBE9639505A3D8811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Roaming\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Raton.exe

Path C:\Users\Admin\AppData\Roaming\Raton.exe
Size 15.5MB
SHA256 9017749ca3bf56d30e657478655ef56d6a657575d02836420cc963a54144faff
MD5 bea270c04c76c1848469e57b8f0db34a
SHA1 5a71479194f615735d86cc56d10ad9b848a4ca52
SHA512 3044fbfe52d2291ea6c1af48b38ffdf903b1ec30993890ee7e60464739ae5474a5dd18a06db49aee7b7033acdb17c4053e22ce79fba4e6687a525e8aefaaaa78
SSDEEP 393216:9IurGIdEZ3WEVso96vyKy6X5msvyKy6X5mO7n9evZoJTwCW:muqoemEsypuypwx7JTwZ
TLSH
T1E8F6230232E3EF1AC93F46F505A1168193A3536995A5DFFDF85186882CDA3E0B9C53E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 3f48dca002aa8fb3ea465734ff69be819dcfa676c4d264065c35ce3ca3a780a7
MD5 0240aaa8435eaa89dbda8f573f06cc46
SHA1 77ff7d3878b953479a449b2578a10bab6abe5a43
SHA512 5327434f720aeaad5d630b1b40e9aabf740e587f1f6c4d954d20c68297e72865b86444db2fb6571443c422f99af6559fa145961563496770d213fb81b0b046dd
SSDEEP 3:MsEllllkEthXllkl2zExlGwJ/:/M/xT02zl6
TLSH
T1FC440244EF840405C5105030405983600360D4130A19574B79511412ACCA6600C04100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\Default\Extension Scripts\000003.log
Size 38B
SHA256 1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
MD5 51a2cbb807f5085530dec18e45cb8569
SHA1 7ad88cd3de5844c7fc269c4500228a630016ab5b
SHA512 b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\Default\Login Data For Account
Size 42KB
SHA256 06ab298edd12857cc70f080af232c29ff4cc2196f26ace01c13849fddc1f00e4
MD5 6233c4622861892a62b3cc83eca79df3
SHA1 fc694979e3a10dff53162cd74a718b1be236a73e
SHA512 b2bbe4099ffc2f6bcab9f3078fd9007891923edfe2f7a7269c6f106dd085a39e08e407211b3eed9901555ce48056659e807457f8c3106e722fa7bbf3715fbcd2
SSDEEP 96:Gr2eymweCn8MouB6w9fUnFlXqiEqUvJKLuyn:Gr6eG7Iw9f0Fqidn
TLSH
T1C613340F2B682401C8AD8632BCB114B66D7CA13F8B639FD12CB114659D75C63B42E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 651cd57b7d07ed03e46eda31168817ee2ca77d8c082e5ad0c50daa2e376fed6d
MD5 122442ca7c4809ac445cf50448e55789
SHA1 7d6779796ae11de76f0ec9f8a8a633ad110f35b4
SHA512 0ca12cb562227eaba14a87596511f84b9db30df18503339b3f2b8ae4cf1a9d1b3d3275a3e245125d19298303c55691307ae28f36c8ba65333d2a34367545a39e
SSDEEP 24:TL9LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:TxLopFMatSaw/auUOt8B
TLSH
T1E4928A4E5F346221C0F44B36EDD189672F7C212CD3B72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_000008
Size 16KB
SHA256 500d85e30d563bcd5a3ce12d49632db1ef5b6970d166618c8ee9c1f95e122b8a
MD5 4f4da5dfb96b7b691031f68fa6f8c608
SHA1 187ef9b89de01b732d905c0f921f7b052413b172
SHA512 9e724a4e26e31a35db8491c3cf43c0f34c42e6b8dc03b7c95a5a3c11ecef0d86b07983132eb1f0c7132b56bb904f6aa1b5816c166814dd7b42099d59a3988447
SSDEEP 192:oavrT8mlFa+xEpAlZSlHCOmHbrDYZyoYY1zf68rID/kpgWaRjic/cUDTNcxdEGWT:o6NzZsRrIoSjn8
TLSH
T15A72320567608D36DD2DB27C9CCB0A04737EC8E59FE6470BBE4C52020E973DA1AA79D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_000009
Size 24KB
SHA256 d8533caa693feb1ee74b8fe7e7a84916066d2de7c7bb5ace2eb277c8c655363c
MD5 e486644496b6f429fc96ed0c1b062c12
SHA1 c0361ba19f44570c841344b8fd3219a92369600f
SHA512 365398bd563d16a19ee3d07c691d185f0cde162fd00fe7ba81ce52c940f946090192ec23ff837cfe06fc7c9adf194f2755f01b61fcf142f6824f52cc9f5011bd
SSDEEP 192:0ionFyQrtTw8maWbm+xEwIeiqOTGO6dtzSdza4IlB2/TN/jo0oM2W613XF1qJ8U:0Qdvbdwdza4INnx+lJMbSt4EZvT9
TLSH
T171B252057671D832CD1DB37C8CC74A48777A9CE54EE2870B7A4C630A0E6339F1AA6AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_00000a
Size 16KB
SHA256 3857201a636b2d47050980a7f155b344072fb2baf7b0bbf139c4cbd51cefa0d8
MD5 11c86f0525609aee2fcfe7bb8d5725d7
SHA1 08d7ec2756bdd5dafef7da398a52f3a0a4464692
SHA512 031780902c6e56c2d70e8222fc029becaa31d82b37b153298119cbfd35b0b7f605d5d020f2fcd84bceee094d94404fa6513b2b086806bb8c39c5401ef93dd143
SSDEEP 192:KtFofmgaTwVdVLBog+xEmFYIqk/TN/jo0oM2W613XF1eJ8UEE0CRpMAuDFsc0Iu1:EOBofYIWnt+/Mj6c03T9
TLSH
T11B7211457671C922CE1EB27C8D8386892739BCD64ED29307314C771E0E372AF4AA6EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_00000b
Size 16KB
SHA256 13a47445744294f71eb69751e758dc7132c065baa79f3bd65f2d60a111c761a2
MD5 6b2be65a6e211cd64b6642704d71d11b
SHA1 4da89f9d86cf082e2088c51bd2bdb89fd225d6cb
SHA512 9906e99f6a29a3972667df43765187825a6e843968f1c4e05094d1c01934170453b4b9e2f29d3ab5da4ef68d12085fc3d741e75656a78056eb2eb2eb617dabee
SSDEEP 192:/C72cTwVaW++xEdZhIju/Tbjo4wW5rrHX3XF1ZJ8UEE0CAlo++I9MGI67g/+PIU3:hEhIknw+AlodI9MAnPX
TLSH
T1CB7201017672C812CE5EB27C8C8387892B76BCD64D928707354C771E0E772AB4AE6ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_00000c
Size 17KB
SHA256 4f6c26f941bd3b58e779aaa6ba79a6cdda75ff52536388cd89ef7aec8890367d
MD5 7bad4ba8742e795fae2fb3a75f1dfc0b
SHA1 16c5a3bfdd333c608a71d601d9255ab8db16c825
SHA512 450c6bb4f63d3161f42b14a30dcfa815b72753b21685d2bb2fa1dfe19c7d7b2a227171d075054b80cb5706a10415f6791a6694f2780b131155fc4b56f0c6d200
SSDEEP 192:QC7R0TwVaWH+xE91hIRW/TN/jo4wW5rrHX3XF1xJ8UEE0CMh2MlYFY/+LmYUcno4:p5hIkno+Mh2MM7Lmwp
TLSH
T1767211017671D852CE1EB27C8C8386896B75FCD68DA28307354C771E0E732AB4BA6ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_000015
Size 16KB
SHA256 82f8db1bec715f89d119db228e617e23d8fe1a009da5d503ff844e6052eb126a
MD5 119f4222258ee292ddad834ffcd7a7ee
SHA1 63e5783f18a0610e08b46d02fed8ab1e8724df49
SHA512 f4c54706f9661d0dffc7602988241e2bef4ac5db6b5a935e04095f8fb864a7e819091534dc8fec35086b48fbb6614a8a5dd5846b32aa86c3a96a858d659df14b
SSDEEP 192:WFofmYaTwVdVVog+xEmFYIPk/TN/jo0oM2W613XFQJ8UEE0CRpMAuDFsc0IuVTTn:W+ofYI71+/Mj6c03T9
TLSH
T1297221457771C922CE1EB27C8D8386892739BCD64E929307714C771E0E372AF4AA6EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_000016
Size 16KB
SHA256 fa67425109d2d728c3b18cfd10c05b12f0792246f05c0b211a18d91dbd5c76d7
MD5 939a50b6619428769491d3d8ae951f4b
SHA1 e74cf80b131131f89c8caf6232fc9fdb45194ceb
SHA512 b81d3697c556e90ee9eec8452f47d4d37a76423fd64406d0e346df61ac667d03ebb2e547e8650796122e56a2ea2ae98f6b276f089c579939a99999c032f8e920
SSDEEP 192:aC7c0TwVa4+xE91hI+W/TN/jo4wW5rrHX3XFfJ8UEE0CM32MlYFY/+LmYUL1ogH4:whIlQ+M32MM7Lm5pH
TLSH
T1617201017671D852CE1E727C8C8386896B76BCD68D968307354C771E0E372AB4BA6EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_000017
Size 16KB
SHA256 3e04a4231da2cc771e402e9c36c6d5abb33d2dea42e0aa709ad3d8f92b0214d0
MD5 cc64ba971ff18e4f4bddb4c61d93e54a
SHA1 f4584c583e2928ba026c4cd644a091bb00770ad9
SHA512 a6368c08476b65ca652c85a9601bc81ac396509e2225323545a9d8350ace479cde357d19cad6dae73a68d64dccbc0d2200d4fb1eaa7d4dce2925e1ca67a9e220
SSDEEP 192:8C7+cTwVaR+xEdZhIwu/Tbjo4wW5rrHX3XFnJ8UEE0CARo++I9MGI67g/+PIUM8+:PhIp4+ARodI9MAnPh
TLSH
T1117202017671C812CE5EB27C8CC386492B36BCD64D928707354C771E0E772AB4AA6ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_000018
Size 16KB
SHA256 d86d93f7b116cfd65f6f5a6343a9695b22844a9c185201ee186f3c69a5d1af59
MD5 7ac9fe8a67c6c3ac5d217ff9da35eb12
SHA1 52d1c56a27542378a5fca4aad1f038dfcfdb63e4
SHA512 89b319009aa2e9bdca8f755501ca61b4bcea841dba26d69f43125c91a91d5e4015d7a613c46033691df3d9ccbed2679ebff7a9e538292f1fa802213189a474cf
SSDEEP 192:lC7+cTwVaR+xEdZhIru/Tbjo4wW5rrHX3XFnJ8UEE0CAlo++I9MGI67g/+PIUbFV:EhIs4+AlodI9MAnPX
TLSH
T12872F1017672C852CE5EB37C8C8386893B36BCD64D928307754C771E0E772AB4AA6ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_000019
Size 18KB
SHA256 dc94c6cd4874858f57c43d6049fc8b59ee21f83d2808d42c357fad8e3c3aab6d
MD5 53319c251ab0f5bebab08051eabe3df9
SHA1 d388fc11b56cb622d25b782f969850ebaa7bcbc2
SHA512 0caca357dc9a72db8619db910d1710d8746d2d225a659217f6e75ecbe77eeeca7cf159109a185945be0880c23652a3b9c5c08800b009dd76b7c3619cc4c018ef
SSDEEP 192:KnP3jcTwVaR+xEdZhIWu/TbjolVR8I0ESQR3XFnJ8UEE0QQDUfwhhhlrMAI67g/4:AOhIm4rDUchlrMynP5gMB
TLSH
T19682DA017662C962CE4E733C8C8387886B36ACD64DE29707354C771E0E7326F4AA2ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_00001a
Size 16KB
SHA256 7f9763b8b2a845a27d957cb4b156ea44dfbff83705126e3313d4921435f61987
MD5 d5a7368ef684529f01c85a3d9b1bd12b
SHA1 2ca0bc041b4b87fc138176b0214ffdbff4816fe1
SHA512 f46bf7c62268604403073a96afc4422ac76d55b107ab9ece9c799b9bac0c2e9cace0dbd1c2232cbaa7b05a2062a8d64cbd73300de170140de2d805cd20825a69
SSDEEP 192:qaKorT8mTa+xEzAlZSlHCOmHbrDYZyoYY1zf68rIh1fg3ERFTH6icm/UDTNcxdEP:qazZsRrIB6+lY
TLSH
T1CE7224055B508936DD2EB27CDCC70A04737EC8E99FE2470BBE4C52020E573DA1AA79D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000021

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_000021
Size 16KB
SHA256 29b17fa63bbc9b63cb0ee338d5189a665e9417c8c7a2d231e3f146367d06e4ee
MD5 458302e8a0d4825887864912eb652653
SHA1 146dcf67e5ba1399a754870c4da59630702adb18
SHA512 e5359d27fae9114efea66b5040b256cabae97a7292a04e6d4f5537520f3a400969a06f08c20966254badec1430fbb65593e35a01b56289f45065cf87540c9fb0
SSDEEP 192:gFofmYaTwVdVVog+xEmFYIPk/TN/jo0oM2W613XFQJ8UEE0CRpMAuDFsc0IuVTTn:g+ofYI71+/Mj6c03T9
TLSH
T1417221457771C922CE1EB27C8D8386892739BCD64E929307714C771E0E372AF4AA6EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_000022
Size 16KB
SHA256 19947e7caf938fe1ac30e72efc0af7ad01cc7f48b3206a62b3262af62c52fd07
MD5 20ec79d47702523dff9627be282a6540
SHA1 0d40c8e257da0519b078c82d17a03152f3b85350
SHA512 9a5efd55d4bb4ec9ffab7b515498315c5e7901047ef3abfee48c6f49e44307977caeee9be93f627559045dfee80706aca16f394c34205a723cac47a84646445e
SSDEEP 192:sC7c0TwVa4+xE91hI+W/TN/jo4wW5rrHX3XFfJ8UEE0CM32MlYFY/+LmYUL1ogH4:+hIlQ+M32MM7Lm5pH
TLSH
T1AA7201017671D852CE1E727C8C8386896B76BCD68D968307354C771E0E372AB4BA6EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000023

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_000023
Size 16KB
SHA256 3ffdf00a3b014b819c567731dffcd872259b51ae88a7f783b9dfcddf16f9c590
MD5 161269552934a94770c08993be2dbae5
SHA1 d9b27876d7c77d91f02eb7eee1bf3dcfde72f5fa
SHA512 376a420e4598462ccb3658a7da3f51d97fcda25a5be9edf8e86fefe1f3eaf235992e5595e72090ae6443cb3b8698cf3bb5667a172f67f1af9739da1635eeb583
SSDEEP 192:mC7+cTwVaR+xEdZhIwu/Tbjo4wW5rrHX3XFnJ8UEE0CARo++I9MGI67g/+PIUM8+:5hIp4+ARodI9MAnPh
TLSH
T1BF7202017671C812CE5EB27C8CC386492B36BCD64D928707754C771E0E772AB4AA6ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_000024
Size 16KB
SHA256 2345452025901bed4daba0cde86e19e48febf765441154504450bc5b3b2ad5b2
MD5 f1caa308b662de8f0130c1d4f331efc0
SHA1 4a5f7c907f4db5baecfad565bb512c59b84019c1
SHA512 d247ac14102003ff95b42e511740e4a1f980812c1f22efd50a3dba0c123f968ab05fff5035e8fc83082dce6c5b6cd7b7677f00337b7ed448acfb2c7e8f6cba18
SSDEEP 192:vC7+cTwVaR+xEdZhIru/Tbjo4wW5rrHX3XFnJ8UEE0CAlo++I9MGI67g/+PIUbFV:+hIs4+AlodI9MAnPX
TLSH
T12A72F1017672C852CE5EB37C8C8386893B36BCD64D928307754C771E0E772AB4AA6ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_000025
Size 18KB
SHA256 c7c85b835dc75f4abea0d995a91359903222ab399198b94017efa3b1e3f34554
MD5 97bdd4515c0fbe77328113d850d55c0e
SHA1 cbdb053a1f78408accccfb5c1f6ee363468430d7
SHA512 aa62cffcc6512637e6e1287fb5daef4ac7c35665fbdc8e6d1bf5792be0daaa6edaa47a16a8147c0815f2683474b6c8cd3b48af4de22898b466f743a0f5371c5c
SSDEEP 192:QnP3jcTwVaR+xEdZhIWu/TbjolVR8I0ESQR3XFnJ8UEE0QQDUfwhhhlrMAI67g/4:uOhIm4rDUchlrMynP5gMB
TLSH
T11982DA017662C962CE4E733C8C8387886B36ACD64DE29707354C771E0E7326F4AA2ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Roaming\Raton.exe.WebView2\EBWebView\GrShaderCache\f_000026
Size 16KB
SHA256 7c9139c0e2c7fa74fc70409598c672054f377fd6dfd245cca3fd7f99045ec99c
MD5 322d903da59dab855c46b02448864d3e
SHA1 c04a97bf39786f9e9c43b1ea04128bdc7fb8f2e4
SHA512 bf8334da4aeaacdeeb7fc81ac82560e1b94181bc09f236c5c452deed5a5ab1e31c5877dc37c69a0ed998d7c00fbf7f3133c33865f0258c5e2472e9f6581a6034
SSDEEP 192:gaKorT8mTa+xEzAlZSlHCOmHbrDYZyoYY1zf68rIh1fg3ERFTH6icm/UDTNcxdEP:gazZsRrIB6+lY
TLSH
T1A27224055B608936DD2DB27CDCC70A04737EC8E99FE2470BBE4C52020E573DA1AA79D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Raton.exe.config

Path C:\Users\Admin\AppData\Roaming\Raton.exe.config
Size 2KB
SHA256 5c17129a4dcda12e2aca3f1959a8aeeca931b631be838f658bbafa6fc0d608a0
MD5 26fba13095ab4745ff71512b8cedc7b0
SHA1 25dc6d78fe3ce6ec3642b999aeb4c335958e7bf2
SHA512 cc1ae4aa640de1b605c13ce0aa070fa2b2c7852f3423e51e377b662fa6d6303df9b9708ddd4e0a9a84bdf88debb910a3ac3d4d0fea4332fc08528efab11b3264
TLSH
T1E8419DB485CD9EBD053109537979C490C7ED43A3E4990889B4DE25ABCBA3CC52317366
MD5 SHA1 SHA512 TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Roaming\System.Memory.dll
Size 137KB
SHA256 8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7
MD5 6fb95a357a3f7e88ade5c1629e2801f8
SHA1 19bf79600b716523b5317b9a7b68760ae5d55741
SHA512 293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0
SSDEEP 3072:IUGrszKKLBFa9DvrJGeesIf3afNs2AldfI:jBFd3/aFs2
TLSH
T136D37D6857C6DE56DB5FEC70E02062056631C52F5742BBEE1DC8B8F036923DA29093FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Users\Admin\AppData\Roaming\System.Text.Json.dll
Size 285KB
SHA256 c363ffd829feb879158a3118df583955ad43b1f64ef417328292f5153e47119d
MD5 1b8e1b9da913a7d40c7288d1a433b658
SHA1 e273ddadf02bfb4556beb58ed46d191c55e8d770
SHA512 1bb86cc8bda1e1284fcc07a476f816d97d26331920d3b818bcaa566601552d0178dc45b201d826fda0e0593d2e41d566e2b9278b5feeaabca9028ec60bb3c9a1
SSDEEP 3072:+trBeoPMc1zg/BZyooUhEBfhrwrHUPd5gJYkh6iaLVZTrjxN/wYWiKW4BA3Rbdnc:wkoPdfBfhrwrf2wLVW4BA3RJkl7vInlk
TLSH
T1B8543A2463ECA65BEACF4674E0348802DF79F1AA7B5BF34D040858FD5883B85D8566B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mono.Cecil.Mdb.dll

Path C:\Users\Admin\AppData\Roaming\Tools\Mono.Cecil.Mdb.dll
Size 42KB
SHA256 570a437dea0271d1d5c8b7d6a408b0b2635bdb0e8b8d5051878f3e7fca087f89
MD5 2c39a53a61168c8a7a9f53ebdad6137a
SHA1 b10ac8325cd72c7a9018af806d75739ab862b4d8
SHA512 d1987995bb58978a063a195a18ba02908edac02a3e7808e93f8340aa968c9bd74f76d2e6fad8158f72bc3629c1382039863471d51e510bd897187ccdabae8e14
SSDEEP 768:wlUj6BAKp/zgvVucdcRsCVKcraB09THkPFtQI4CRIzZwMNTBczwDN:0h3/zgvVPcRrK09HkBAwMNTNN
TLSH
T135132A1067AD9B27C2AD8AFDF482911507F09125B623FB9B9FC4F4EB6C47B85050227B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mono.Cecil.Pdb.dll

Path C:\Users\Admin\AppData\Roaming\Tools\Mono.Cecil.Pdb.dll
Size 88KB
SHA256 50a1a1a79dc86fcfb8b51249b5325a10dd93d193c52999cf6775d25030a4e606
MD5 5f6a2f17f4e792600a13e3771d5ca5ff
SHA1 e411b8e51b201c5f389c2388d26735c1e89b3f6f
SHA512 67af09a5545c6bb0e033cfa09dfc654ce4cd4d22c418402d5a43612eaa6e60b71dca2bf4f796a6027c8e7aece88d418e6e8c469c94c327f5169608e67a3e7a39
SSDEEP 1536:TexPta15J8wWI7Kgl74TChe44tALYKXybJG3OoCkvV:TexFafB7q2hwArQJGFhvV
TLSH
T137937E3A9B98FA27C3ECAD7724A60D0907F1D126E153FB55C98959F8381BB301232797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mono.Cecil.Rocks.dll

Path C:\Users\Admin\AppData\Roaming\Tools\Mono.Cecil.Rocks.dll
Size 29KB
SHA256 842e09959084eda733aab1a5354d7af79e29594f4d8b91c8792103e5c755ed9b
MD5 e136924bb4051a462ad90bd14cb0ba41
SHA1 8cfeb4034766ce06f9216b1872703015e8ea0e09
SHA512 1baa852ffa42fd8a743661f003b90c840276b4cd864d5467b8d551454420ea46bb6c97e0dbe832de1e5e0672eb57365332dd5f86ad1df88820300504a3b1ea07
SSDEEP 768:628hQuem5RPkF+pXtRx/hRsPveQJcpAUdE3fF7Mtm3M:62gYm5RPv9jjsPveQCdEvF7Mtmc
TLSH
T1B2D229022B68CB77D6EF4575B8F0212842B1D39F6803C76E4DCC61E9A947B8567217F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mono.Cecil.dll

Path C:\Users\Admin\AppData\Roaming\Tools\Mono.Cecil.dll
Size 354KB
SHA256 c41bdb9ffd3c5f6e17d2382c1012d73703e035e3f1100245fdd4e08c8dc6eb5b
MD5 2f096535c228ab0d2082adfc01678481
SHA1 0e0dcb36aa56e7f99aa524cfb3c72e4918cc5b32
SHA512 9f54b9e85ef70afcb36569885de73bba704a8901c8ddbb5a35de6a1921d4d42f88026aea41ed77ec7a8041ee8a04efef817deda7dea0f29a716dab7a6ea7fd9e
SSDEEP 6144:LHNGIaxcvxT+2pEwMjbLmRlQ5+A45iziJCJP+pIoTtya:RRUQCmRw4szYCOI
TLSH
T165747B2167EC163BCADFA37BD06B042D46F9D015638FDB8D6D84A6F91C83FA65800267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ctx.bin

Path C:\Users\Admin\AppData\Roaming\ctx.bin
Size 131B
SHA256 8ddf2555e4d12e11f10ed348995573cd42bb3895af248d176f0c8c4db8491219
MD5 ba3a032a0b6390c669a45ebb7dedab71
SHA1 47919c12679794f3424993a789242ed788f4d79b
SHA512 2a425de435783afe0ff32fd7ca05b7bdb323d5a9fa17b4b02b7c683304003a485c9342bce765f30181185d55754bcba8e918c88ae047e09f7370080d3c30f0c8
MD5 SHA1 SHA512

Submit Download

ctx.bin

Path C:\Users\Admin\AppData\Roaming\ctx.bin
Size 131B
SHA256 5d7f018ddd2e052e2816d42ab6e1f204fd5103954102d574c6128b32fc8d56ef
MD5 555d91c31e323915b09acd85b167d656
SHA1 fbf73cc606eb4d9d89a443e9c8906fb3878bacd0
SHA512 15f5759ab5cf22f1f24316b63ee1b17987f34a7aa2217537d595bac7cc2cd619a122f53637c4d4aa10c5fb84a0a6c19475e85037f15e3d7bdbd2e7fd1d697134
MD5 SHA1 SHA512

Submit Download

defendnot-loader.exe

Path C:\Users\Admin\AppData\Roaming\defendnot-loader.exe
Size 581KB
SHA256 4776620d4a617ce96d83a3a2ae0999a9dc6ee79bd9dcefe296cd877a62aa2224
MD5 734d301654affee77396b554ccb04e0e
SHA1 7a4129e6a9180d4eb326e0c3a1f138539816cbc6
SHA512 48762065698d08366bc7413f65cc9f9577dc6099ecd8441bc48fb9a16e65d03fa6815b1000839fd4a34a5d11cebbc5a3a0505dc2d085e3e5ca424b6189490184
SSDEEP 12288:wDddddddddoCh8ahw7TLZ0yph0lhSMXliMsBk:wDddddddddoChjhw7CYh0lhSMXlns
TLSH
T18BC49D26B7E940F9D1ABC27889530A16EB737C4643616ACF03E44A675F236E05F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defendnot.dll

Path C:\Users\Admin\AppData\Roaming\defendnot.dll
Size 427KB
SHA256 45e942ba59f3876b263a03ed7e5d5b1b250e84a0a4b4093b3c13b5fca4e12b21
MD5 edcfd344d44db165aaadaa1c75499daf
SHA1 09b25238b9df51d2d390599a12f49384f815fb73
SHA512 b295f371a3f0f907d8273b83bca32e6512b08dc10215ba2ad7f8e02c1b56c7d6f579a8affb693837fec711f9ef6a0f9ab1088f8760a58a21b7a430ef0fbbbb33
SSDEEP 6144:yuax4l7odwsjYGT5Zeu14MPQEPa6/ph0lhSMXlBXBWniG77mHBR:yppTzn1bZa6/ph0lhSMXliV3
TLSH
T15094AE16B7A580B9E16B8278C8570A05EB337C414791EBCF03A4DAB66F637D15B3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notdefend.exe

Path C:\Users\Admin\AppData\Roaming\notdefend.exe
Size 53KB
SHA256 55c834f42132716ffd89bbd631b5a1bad679ed172f80abf3de36fa91562b1dd4
MD5 b39ce1914b113a702a0dc73e136b2b4c
SHA1 bbe41dbb3ec7c83ba56223a81bc1161bc4aa8acb
SHA512 144913e1bc92df47ef00e307e06e32fa7a683f548f0fee1fe4d3372ddd657365fff576c3c4b7ae01e2ab94f86b2150c37e35189f2299b9585866d8ce26456ed1
SSDEEP 1536:m4dJooh0Wa0aer344Jw/ytUqVS5EkIijQ1fTNG4:m4dzVTaer344JzthRZijQ1JG
TLSH
T1BE3301B796BDD9BCC42362B357CD0440FA2F292B5AC5172F0950AAFFC8D62E46741712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/296-658-0x0000022EFD4A0000-0x0000022EFD4EC000-memory.dmp

Download

memory/296-647-0x0000022EFC380000-0x0000022EFC39E000-memory.dmp

Download

memory/296-637-0x0000022EFD420000-0x0000022EFD496000-memory.dmp

Download

memory/296-660-0x0000022EFC3E0000-0x0000022EFC406000-memory.dmp

Download

memory/296-635-0x0000022EFC180000-0x0000022EFC232000-memory.dmp

Download

memory/296-630-0x0000022EF8AC0000-0x0000022EF9A42000-memory.dmp

Download

memory/296-661-0x0000022EFC360000-0x0000022EFC368000-memory.dmp

Download

memory/476-671-0x0000021CFA9F0000-0x0000021CFAAA2000-memory.dmp

Download

memory/2272-683-0x00000169D7E80000-0x00000169D7F32000-memory.dmp

Download

memory/4040-624-0x00000000001F0000-0x0000000000238000-memory.dmp

Download

memory/4632-698-0x0000020C21480000-0x0000020C21532000-memory.dmp

Download

memory/4672-649-0x0000022F98E20000-0x0000022F98E26000-memory.dmp

Download

memory/4672-650-0x0000022FFE090000-0x0000022FFE09A000-memory.dmp

Download

memory/4672-648-0x0000022F984E0000-0x0000022F984E8000-memory.dmp

Download

memory/4672-646-0x0000022FFE160000-0x0000022FFE17C000-memory.dmp

Download

memory/4672-645-0x0000022FFE080000-0x0000022FFE08A000-memory.dmp

Download

memory/4672-644-0x0000022FFE120000-0x0000022FFE13E000-memory.dmp

Download

memory/4672-643-0x0000022FFE070000-0x0000022FFE07A000-memory.dmp

Download

memory/4672-641-0x0000022F986F0000-0x0000022F9870E000-memory.dmp

Download

memory/4672-642-0x0000022F98710000-0x0000022F987C2000-memory.dmp

Download

memory/4672-633-0x0000022FFE0F0000-0x0000022FFE112000-memory.dmp

Download

memory/5252-664-0x0000000140000000-0x0000000140027000-memory.dmp

Download

memory/5252-610-0x0000000140000000-0x0000000140027000-memory.dmp

Download

memory/6064-691-0x000002AEF8010000-0x000002AEF80C2000-memory.dmp

Download