ratonrat | 36baceb78fcf6aa37b3340bdf9c52fb9ddd848c8ea334c7d75ca03193f4e6116

Analysis

user interaction
yes
max time kernel
151s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/10/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EldoradoLauncher.exe
Size 73.4MB
Sample261025-dpy4qsft4p
SHA256 36baceb78fcf6aa37b3340bdf9c52fb9ddd848c8ea334c7d75ca03193f4e6116
MD5 5651caca5fb4106f2261677ec11ae58f
SHA1 d9afac3be65fe12378c8243f8a14db33a0cc7745
SHA512 d9dcf933dc1640b6d5a0db0bbc9a4c093708c5dbc0c17b55ee9f79dc951e64e717d45685fdaf724cb5e3cfb0b65590eaacbca5fbdad70d0a0c150b60dcf2926d
SSDEEP 1572864:sbwJrNSakN74Ut8xpeotJL2Fx/k3uQIOTX55PWoEr/GUECI/JCc:sybkNXAEotd6xs3lD5U/0lBCc
TLSH
T1C2F7339A822E4121D64733BF923810B7491CF2B5E907B5BE91D08F554A7221E0FFDB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution ratonrat xworm persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

https://pastebin.com/raw/5qULffW2:1605
83.38.28.160:1605

Mutex

VyiOiTj2mTosKEAj

Attributes

Install_directory
%AppData%
install_file
notepads.exe
pastebin_url
https://pastebin.com/raw/5qULffW2,83.38.28.160

aes.plain

Extracted

Family

ratonrat

Version

Free

83.38.28.160:1603

Mutex

xNUBYqpnNgoYPPFcePE12Yh

Attributes

assist
true
box
false
box_icon
No icon
box_msg
empty
box_title
empty
defender
true
delay
0
hide_file
true
open_website
false
process_critical
true
raw
https://txt-share-taupe.vercel.app/raw/Nuevo_Documento_de_texto.txt
reconnect
3
startup
true
tag
Infected
uac
true
vm
false
website
https://t.me/sillyisafed

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2692-67-0x00000000009F0000-0x0000000000A00000-memory.dmp	family_xworm
behavioral2/files/0x000f00000001c50c-66.dat	family_xworm

Detects RatonRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/1476-96-0x00000191959C0000-0x0000019195C96000-memory.dmp	family_ratonrat
behavioral2/files/0x000f00000001c513-95.dat	family_ratonrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6084	powershell.exe
4752	powershell.exe
5512	powershell.exe
4576	powershell.exe
2744	powershell.exe
6084	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepads.lnk	notepads.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepads.lnk	notepads.exe

Executes dropped EXE 11 IoCs

pid	Process
2440	notepadu.exe
2372	notepadu.exe
2692	notepads.exe
4488	schost.exe
1476	ondrive.exe
4624	notepads.exe
4216	ondrive.exe
5820	schost.exe
1616	ondrive.exe
468	ondrive.exe
2832	ondrive.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\ondrive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ondrive.exe"	EldoradoLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\notepadu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\notepadu.exe"	EldoradoLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\notepads = "C:\\Users\\Admin\\AppData\\Local\\Temp\\notepads.exe"	EldoradoLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\schost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\schost.exe"	EldoradoLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4424	cmd.exe
4844	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ondrive.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ondrive.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	notepadu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	notepadu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	notepads.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	notepadu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	notepadu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	notepads.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepadu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepadu.exe

Delays execution with timeout.exe 5 IoCs

defense_evasion

pid	Process
4780	timeout.exe
672	timeout.exe
108	timeout.exe
3896	timeout.exe
2772	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4800	schtasks.exe
1452	schtasks.exe
3248	schtasks.exe
5916	schtasks.exe
5260	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4752	powershell.exe
4752	powershell.exe
4752	powershell.exe
5512	powershell.exe
5512	powershell.exe
5512	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
2744	powershell.exe
2744	powershell.exe
2744	powershell.exe
6084	powershell.exe
6084	powershell.exe
6084	powershell.exe
468	ondrive.exe
468	ondrive.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeIncreaseQuotaPrivilege	4752	powershell.exe
Token: SeSecurityPrivilege	4752	powershell.exe
Token: SeTakeOwnershipPrivilege	4752	powershell.exe
Token: SeLoadDriverPrivilege	4752	powershell.exe
Token: SeSystemProfilePrivilege	4752	powershell.exe
Token: SeSystemtimePrivilege	4752	powershell.exe
Token: SeProfSingleProcessPrivilege	4752	powershell.exe
Token: SeIncBasePriorityPrivilege	4752	powershell.exe
Token: SeCreatePagefilePrivilege	4752	powershell.exe
Token: SeBackupPrivilege	4752	powershell.exe
Token: SeRestorePrivilege	4752	powershell.exe
Token: SeShutdownPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeSystemEnvironmentPrivilege	4752	powershell.exe
Token: SeRemoteShutdownPrivilege	4752	powershell.exe
Token: SeUndockPrivilege	4752	powershell.exe
Token: SeManageVolumePrivilege	4752	powershell.exe
Token: 33	4752	powershell.exe
Token: 34	4752	powershell.exe
Token: 35	4752	powershell.exe
Token: 36	4752	powershell.exe
Token: SeDebugPrivilege	5512	powershell.exe
Token: SeIncreaseQuotaPrivilege	5512	powershell.exe
Token: SeSecurityPrivilege	5512	powershell.exe
Token: SeTakeOwnershipPrivilege	5512	powershell.exe
Token: SeLoadDriverPrivilege	5512	powershell.exe
Token: SeSystemProfilePrivilege	5512	powershell.exe
Token: SeSystemtimePrivilege	5512	powershell.exe
Token: SeProfSingleProcessPrivilege	5512	powershell.exe
Token: SeIncBasePriorityPrivilege	5512	powershell.exe
Token: SeCreatePagefilePrivilege	5512	powershell.exe
Token: SeBackupPrivilege	5512	powershell.exe
Token: SeRestorePrivilege	5512	powershell.exe
Token: SeShutdownPrivilege	5512	powershell.exe
Token: SeDebugPrivilege	5512	powershell.exe
Token: SeSystemEnvironmentPrivilege	5512	powershell.exe
Token: SeRemoteShutdownPrivilege	5512	powershell.exe
Token: SeUndockPrivilege	5512	powershell.exe
Token: SeManageVolumePrivilege	5512	powershell.exe
Token: 33	5512	powershell.exe
Token: 34	5512	powershell.exe
Token: 35	5512	powershell.exe
Token: 36	5512	powershell.exe
Token: SeDebugPrivilege	2692	notepads.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeIncreaseQuotaPrivilege	4576	powershell.exe
Token: SeSecurityPrivilege	4576	powershell.exe
Token: SeTakeOwnershipPrivilege	4576	powershell.exe
Token: SeLoadDriverPrivilege	4576	powershell.exe
Token: SeSystemProfilePrivilege	4576	powershell.exe
Token: SeSystemtimePrivilege	4576	powershell.exe
Token: SeProfSingleProcessPrivilege	4576	powershell.exe
Token: SeIncBasePriorityPrivilege	4576	powershell.exe
Token: SeCreatePagefilePrivilege	4576	powershell.exe
Token: SeBackupPrivilege	4576	powershell.exe
Token: SeRestorePrivilege	4576	powershell.exe
Token: SeShutdownPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeSystemEnvironmentPrivilege	4576	powershell.exe
Token: SeRemoteShutdownPrivilege	4576	powershell.exe
Token: SeUndockPrivilege	4576	powershell.exe
Token: SeManageVolumePrivilege	4576	powershell.exe
Token: 33	4576	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2196	2332	EldoradoLauncher.exe	88
PID 2332 wrote to memory of 4752	2332	EldoradoLauncher.exe	89
PID 2332 wrote to memory of 3248	2332	EldoradoLauncher.exe	92
PID 2332 wrote to memory of 2440	2332	EldoradoLauncher.exe	94
PID 2332 wrote to memory of 5512	2332	EldoradoLauncher.exe	95
PID 2332 wrote to memory of 5916	2332	EldoradoLauncher.exe	99
PID 2332 wrote to memory of 2692	2332	EldoradoLauncher.exe	101
PID 2332 wrote to memory of 4576	2332	EldoradoLauncher.exe	102
PID 2332 wrote to memory of 5260	2332	EldoradoLauncher.exe	104
PID 2332 wrote to memory of 4488	2332	EldoradoLauncher.exe	106
PID 2332 wrote to memory of 2744	2332	EldoradoLauncher.exe	107
PID 2332 wrote to memory of 4800	2332	EldoradoLauncher.exe	109
PID 2332 wrote to memory of 1476	2332	EldoradoLauncher.exe	111
PID 1476 wrote to memory of 4424	1476	ondrive.exe	112
PID 4424 wrote to memory of 3224	4424	cmd.exe	114
PID 4424 wrote to memory of 4780	4424	cmd.exe	115
PID 4424 wrote to memory of 672	4424	cmd.exe	123
PID 4216 wrote to memory of 4844	4216	ondrive.exe	124
PID 4844 wrote to memory of 2348	4844	cmd.exe	126
PID 4844 wrote to memory of 108	4844	cmd.exe	127
PID 4844 wrote to memory of 1616	4844	cmd.exe	128
PID 4424 wrote to memory of 468	4424	cmd.exe	129
PID 4844 wrote to memory of 3896	4844	cmd.exe	131
PID 4424 wrote to memory of 2772	4424	cmd.exe	130
PID 468 wrote to memory of 6084	468	ondrive.exe	132
PID 468 wrote to memory of 1452	468	ondrive.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\EldoradoLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\EldoradoLauncher.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\EldoradoLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\EldoradoLauncher.exe"
  2⤵
  PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\notepadu.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /F /TN "notepadu" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\notepadu.exe" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3248
- C:\Users\Admin\AppData\Local\Temp\notepadu.exe
  "C:\Users\Admin\AppData\Local\Temp\notepadu.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\notepads.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5512
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /F /TN "notepads" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\notepads.exe" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5916
- C:\Users\Admin\AppData\Local\Temp\notepads.exe
  "C:\Users\Admin\AppData\Local\Temp\notepads.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\schost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /F /TN "schost" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\schost.exe" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5260
- C:\Users\Admin\AppData\Local\Temp\schost.exe
  "C:\Users\Admin\AppData\Local\Temp\schost.exe"
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ondrive.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2744
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /F /TN "ondrive" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\ondrive.exe" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4800
- C:\Users\Admin\AppData\Local\Temp\ondrive.exe
  "C:\Users\Admin\AppData\Local\Temp\ondrive.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_e9lNRkVxZ28Ne5axt8ItV0SnKTOAkH.bat""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3224
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4780
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:672
  - - C:\Users\Admin\AppData\Roaming\PlatformRuntime\ondrive.exe
      "C:\Users\Admin\AppData\Roaming\PlatformRuntime\ondrive.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ondrive.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6084
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ondrive" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ondrive.exe\"" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1452
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2772

C:\Users\Admin\AppData\Local\Temp\notepadu.exe
C:\Users\Admin\AppData\Local\Temp\notepadu.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2372

C:\Users\Admin\AppData\Local\Temp\notepads.exe
C:\Users\Admin\AppData\Local\Temp\notepads.exe
1⤵
- Executes dropped EXE
PID:4624

C:\Users\Admin\AppData\Local\Temp\ondrive.exe
C:\Users\Admin\AppData\Local\Temp\ondrive.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_E4geP1r5MPhP0up64m4JvDowio2fNw.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2348
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:108
- - C:\Users\Admin\AppData\Roaming\PlatformRuntime\ondrive.exe
    "C:\Users\Admin\AppData\Roaming\PlatformRuntime\ondrive.exe"
    3⤵
    - Executes dropped EXE
    PID:1616
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3896

C:\Users\Admin\AppData\Local\Temp\schost.exe
C:\Users\Admin\AppData\Local\Temp\schost.exe
1⤵
- Executes dropped EXE
PID:5820

C:\Users\Admin\AppData\Roaming\PlatformRuntime\ondrive.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\ondrive.exe"
1⤵
- Executes dropped EXE
PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 193b00cc53c510d2c0c06c5c9d9f6e7f8fa4a84a28b0eebc81a0de68401b0ef6
MD5 e1809737e7d60104cb4493a022d6d659
SHA1 67f5e1972b4050cceba9ea8c4f74c110f0c13a54
SHA512 212d7c0793a2a911a523b0ea5c375d7790f5e8939a4e0319b5acb476c61814d12be53be272a6f5b00cf1e0a50a012cbcd7f4d2b2d78d1225221ac4e2eef90b3a
TLSH
T155216833F3DD8614C89A413A10CDAC1036B6C7DB40DECEAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 070e2dc002fee5d6c6ae0611713bb24a9f01d741d964e7f1ece4f61789724a94
MD5 95e9928464a1f3425068f7e64a74060a
SHA1 9bdbd59bea34afd0aebf4d0c3d3cfe0317aa4d57
SHA512 a150525324ebe4a0dc28577f089c1f45ef0902355ecd9d5f10c91d45fe57d44d09c6d133a92c3f32dca0c73b97b259d5ad7ff4316edafa2cb00e38d64e043f06
TLSH
T1E9216833F3DD8654C899413A10CEAC1035B7C7DB40DECEDB6B84D559A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

aforge.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.dll
Size 17KB
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.directshow.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.directshow.dll
Size 60KB
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.dll
Size 20KB
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

costura.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\costura.dll
Size 5KB
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.win32.registry.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\microsoft.win32.registry.dll
Size 22KB
SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
MD5 da40f3db8b34571684c0cb5bcecd2a79
SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
TLSH
T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.asio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.asio.dll
Size 33KB
SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
MD5 01a76191d31b3d6042484e452bd66ce0
SHA1 c84ecf4875c17d9cc91c911feabca640c7ffc661
SHA512 09fa738e43b1a4272a9e16045bcc0fd00858f4367d41b1f9fe3cf97589379b5fcd1fcbd1a24bca74a08187f080941cb575332d3725f620f93fd0b414dea0a9bd
SSDEEP 768:EehRrWpB5henH0HTYdpVCYKo9coe6ttHjBR/:EehRr68U47QGtHFx
TLSH
T10BF22B71EBD84A27C92E2779A0F2040407B5F191F623EB4F9A4C94A96FE73594790373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.core.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.core.dll
Size 183KB
SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
MD5 4e4302ce791e48f985a3a221a19a272b
SHA1 d2b0fd622daf57a012c3cf5bdf4b187f27d5d080
SHA512 1685a17be6d64c222ec606488e3f8e9707a8b7709054e9e99cb53c7b438f5b993820e2e9773e02455525ee06e18aa65ae150420224311f6c69d795c3d129e312
SSDEEP 3072:6lnWpdQWUY6GwfIGsnlLieRT0TWsPtt3RBntgqK2QlVEOPkk6uSYsM+S70I:FpdQJY6GwfIGOLi7tt3RBntgn2QlVEEO
TLSH
T151045B2563E48266E66F9BB5F0F204178BF0F4463437DB4E5E806AE92A07B01C592F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.dll
Size 7KB
SHA256 5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 e90ac3063409ef6876e26422dc61d0eb
SHA1 3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
SHA512 a04dc95e234652c8f4a8ddec88ee3ebd87e68d826eac008625f994323e569d3a3026c7cd7ce2d790ae2ac3018fadf10e600e7ba13cab9bbcc49192263a32fe6a
SSDEEP 96:QDBFskeJHnqvjZkcLqED5Iyr2T7AVUhkon1MrtrRGc5pkQrESd2uYO:QD7kHnqNkcLWyr2T7zSon1MRlwQoStY
TLSH
T1FDF1D724A398CA77CE6347B1A86706401379FA80A917CB2E0D8CA18FBD537594BB27D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.midi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.midi.dll
Size 45KB
SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 f6940019dad6c782bcb645c2f7d52db5
SHA1 1bbe492757bf99840d923fdd44c6a3f34b336cf7
SHA512 1da566cd9f7b0a81f9d858b48306111b0791991f867e77d24f87f26badf93ca6e6414b12669d83b4d3f0b96959c48172f4a77119dbd12e6d8b9e0d0b48caa006
SSDEEP 768:xwuDUaOqgwjYpA2knmsbS+O/RXgQPODHM0Mx7hlEmmyFyaetiWvmYRMUQ6LUOu5r:xwuDU7fwT2kmsbRMZgQP6HM0Mx7DP3eT
TLSH
T15C232A15A3F8861AE2BF3779FC7056110BB2B9867A32D74F0AD468AD1D237844C61773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winforms.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winforms.dll
Size 33KB
SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 115137414b41a26d6e73738cd94c036c
SHA1 e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SHA512 d30fd0043bb483e67700de48283d632811d45e89564ea6d9454b6a38dc3fee5440719224ec4085c70d21c665222f27dbb482ac5f578326a7698ecb7b46599b4c
SSDEEP 768:qNMJ4j7TupqLC+VHDvtiT8dMRrvCPRtbQDmZ1RnT+Geh:8uiCP8dIvMzbQDmcV
TLSH
T188E228195398CBBBC77E0E7944A211060376EA81B501FBED5EC8B1DD8D937520B60BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winmm.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winmm.dll
Size 56KB
SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 c1b78af3d6402be8f259dbbe9250e7fb
SHA1 98e2c38597c50390852801d46ff342889c7351ae
SHA512 776d15d506798eb4a66d5cb5b45591e1767f4030f14aa91198fdf0bcad2e689835418629a1cd3f2af36add4809adb04dd3a850d9d8f2594b0737e72cecc437cf
SSDEEP 768:jpQFu52mn7eYuo4OzgyA90g01OcjDHvgxLMgGd8GbIDrXa8Rcer+7bE:lQ8hexo4QguNHvgxLufIDudE
TLSH
T1BA433B017BDD427AD2FE1B3DA0F30A524734A892756BFB4F1998F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
Size 12KB
SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 f8d5274e3368aa40cc0fd5798d19c783
SHA1 87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SHA512 fa3f106d4ab31c0d516b4623f3108b29c05993a6e65e6e1f1a49e7d101860f78c63843743c3e560c2891fccade27e6024e7b1566d4b99dd0fa90480c1d1a45bc
SSDEEP 192:cl/e0xEXKl04vygxTppSYgDnWgdCpZ8u8u8u8u8u8u8u8u2JHqW6LvEX6KSf5V00:cl/nxEXKl04vygkJ9dddddddBAW6AX6d
TLSH
T15D42192DB784866FD96C0B3EB86622541772EA30AE63DF8F1CC4B03E7D6735885505B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.memory.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.numerics.vectors.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.numerics.vectors.dll
Size 113KB
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.resources.extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.resources.extensions.dll
Size 78KB
SHA256 b69c9547c7bf0d6e357993d41228b6cef033f4f2e0ecba9f07325c7e980139ae
MD5 058062075dae2f0db660018d899358da
SHA1 4489f30223d4f80ad7c220615be2047afa82f085
SHA512 d2a568d19a0dfe06f9d9916c335fa1d752ed7ca78844124079e41b34c2342cbe3486f1d77a68c6cdd576d30fe84d03b12a7c7a5aabd09ee98174b0a167af01c7
SSDEEP 1536:PElSh0fXNlYQRZLj2O5xEMXfy6lNQYjLTb+G8uNsHQEispJnuFvTbp6wy/ei+zq9:PlLQCpuh6wMs+9
TLSH
T12973B51173FC5319F6FB2FB865F151118A3ABDA2A931D62D198160DE1AB2BC08D70B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.runtime.compilerservices.unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.runtime.compilerservices.unsafe.dll
Size 16KB
SHA256 70868cd40021b6df1195ba764a6672d8e19ab58b86a263992986361f316a51ce
MD5 b78649f583f2b905c1cbf79ab90cc108
SHA1 847ec2fefaddbd2420e20065193497fa1ef2b489
SHA512 e9e99c5e60388956ac7cc8c2ae963364ad74a89432c5fae514648a68e24c13a684577313056ac9b6a264729f5c99de68bc809c14482d4f9dd12835f3cd13522d
SSDEEP 192:9Y4tIhywFXXbxfxdPWg9hWMW65FdQHnhWgN7aJeWPLyFqnajRRuvp7:9Y8ItFXXb/dPWg9hWOQHRN7WrolVRuvF
TLSH
T178723B999BA81103EE631F3096A5C943FE3CB3D61902D31D3985F7785C9E7D4AE20638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.accesscontrol.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.accesscontrol.dll
Size 30KB
SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
MD5 2d3e0b4ddf8628b41057b2aceef296eb
SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
TLSH
T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.principal.windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.principal.windows.dll
Size 14KB
SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
MD5 b40bda63658a012d46f930c243b77056
SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
TLSH
T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpFCE4.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpFCE4.tmp
Size 2KB
SHA256 d9891619114bdc9c06f0c6708672f16abe55473b33d3d4d2f46984c12471a536
MD5 6d7d21c9a96cab015c1894e4d339cc47
SHA1 c6680801ba63293af20a3e6b49644cf4a422e533
SHA512 d92a61430cd2bc658f231104de9681e146fbf274817effc884aed0a7364f833df42a9b4fa07c018899eb791e566865e121cbf8f6823d16638ca35f2e2e9db665
TLSH
T124413D0BF1FA5705F18CDE6328DC0E990668FFC9A9E6414EE47704641D72B2154AC117
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rwnmbx52.5s0.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rwnmbx52.5s0.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

notepads.exe

Path C:\Users\Admin\AppData\Local\Temp\notepads.exe
Size 35KB
SHA256 ab07f5ebfa8343c9bb94eb4ee8375a117e475977458961912c02cbfe93ba6088
MD5 f6ee562827adda68e627178ebfa91305
SHA1 48faac89a2ff645765e402deb0d5868ebeeabc7b
SHA512 4b59968772a3f2dd7494fb47c5c75f90a2b0bfc8e7f2c00b00d8a5b55f0781c7cfc7db9605230dd8d4e9c5de2f61d2aa1df3dea6685fc4e00e472700b8eec248
SSDEEP 384:cmE7OF/kyRnX/DuZY+mLwQViurQUjeBVz58pkFyHBLTnZwYGoVvw9IkcisHuFxOm:3RVX/SwwQzQE+1VFya9F1OjhZysMr3
TLSH
T1D1F25C48B7A00216D9FEAFF16AB355064275E70BD513EB4E0CD585DA6B77AC08E013E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notepadu.exe

Path C:\Users\Admin\AppData\Local\Temp\notepadu.exe
Size 321KB
SHA256 acc0d4696d3e0f14eb7d0be7a3827e4572827163326d77c152154ed7b30717ac
MD5 f28f523457af134e016685d545dc24ee
SHA1 767b680b7ffa3c72dccd6530eee1fa1f72d53f78
SHA512 cb5fe0617882b3db70976a92589e903a2d92be1655c5e18e0afc5dd9b94b2846b7031bfd9129dd3c0a24cd22291a5ad583b3a1ba4bb6cad55efe8d5f9e0f229e
SSDEEP 6144:nY25mxBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:1pu3TCIyESY+z8WHH
TLSH
T10A648D5823ED8A26E6FE62B5E43D040D47F6B51A612EFB4F199420FD6C13F8489017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ondrive.exe

Path C:\Users\Admin\AppData\Local\Temp\ondrive.exe
Size 2.8MB
SHA256 11a6705b615bf13f7532a2cb64023ef5ec1cffc58eb3956abb503b00b7265ba4
MD5 b64630c7c3a4a36a8b8341ab8dcc0aad
SHA1 f83a70e14bd43f51c4d729082c8a69f5ba9a67e6
SHA512 974698e2cbee0204e3f0b17af2c199e59689e20bd1a0370e92fbc59a47465ea7e6d5a4e66786b09742948a3f3e97c99b25389bbced60702b10c736f9a928faab
SSDEEP 49152:GgVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw4A6WZ:GgVUuHjkDGjzqpgmwQ1GuRxzew
TLSH
T1E5D5121C33FACB18F2AF4BB4A87189664371FD578D62D76C5891399E04B6F48BA10B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schost.exe

Path C:\Users\Admin\AppData\Local\Temp\schost.exe
Size 17KB
SHA256 c4f434ab68be9037f37fcc428fbd0c29d404a35fc44cd08682fd95b05ffd10f1
MD5 9b6bc54871d75b0c7eddce1950fc3562
SHA1 997817706c5d2e65771e61211b6e882eff74d621
SHA512 91bd274811a97ed6beac92acce4c54d1fafdfb34de7b733adddf73af34a1081522b8dcf0e93bad918151839862f48e97c59458c316be3510207478cff7da7d75
SSDEEP 192:r7qO/yJuIOj9nSHLPZTnd4NRMnu2HLJ2x+cO0OQmDaevnmC10u7yl6nBUr:rAjOdSHL9dKMu2HLJd0EDprPOaBUr
TLSH
T1D972B30B73D658E9E0A7E7B885FA97315975FDA25D7AC30C0A30E2591E20EA05E25333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_E4geP1r5MPhP0up64m4JvDowio2fNw.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_E4geP1r5MPhP0up64m4JvDowio2fNw.bat
Size 530B
SHA256 a1d927dd5c8eb051a11b7f48c3c25ac6f3bb386a632c87af104eb7ac122eba0c
MD5 ca4b6a77611ad1bda111b439ea9673b2
SHA1 1dbeb54dbb50814d6ef9c18454dd30fb615137de
SHA512 c187e7c6a7f94d7b29b5ba21acc3e36ac9cab42349c05cc647dab004c1980ae70df48bc08753a93ec63729d9dbd6bbb9855831f8af82149850266f3f9e6b84ef
TLSH
T1C3F05941228E8B194430547B0EB731CDF0E5446B3FC27601BB24D44A27D241FA6C7BE2
MD5 SHA1 SHA512 TLSH

Submit Download

cleanup_e9lNRkVxZ28Ne5axt8ItV0SnKTOAkH.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_e9lNRkVxZ28Ne5axt8ItV0SnKTOAkH.bat
Size 530B
SHA256 c0e5ef8384c6b9c4da51a5f12b4e7fd07f4cee6237a2d188dcc0eebe4e3692de
MD5 d135d977f21bb251cc7fa7644757d41c
SHA1 83730b7fb0de57f66be5b1286a710ae2bf47d9d6
SHA512 fc287907b4133e05376f45e50409e9d79892d5610c89ad697ef1dde0a16dd324e3359750b39c8bfb6c5c5c1ebffa99490d2c4e2212d3282fe82504cd11680e08
TLSH
T147F05942228E8708443051770EB7318CE0D944AB7FC676417B24C01A27D201FA6C7BE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-203-0x000001E16C340000-0x000001E16C3F4000-memory.dmp

Download

memory/468-205-0x000001E16C540000-0x000001E16C572000-memory.dmp

Download

memory/468-206-0x000001E16C500000-0x000001E16C51A000-memory.dmp

Download

memory/468-204-0x000001E16C2C0000-0x000001E16C2CA000-memory.dmp

Download

memory/1476-141-0x00000191B03A0000-0x00000191B03AA000-memory.dmp

Download

memory/1476-96-0x00000191959C0000-0x0000019195C96000-memory.dmp

Download

memory/2196-5-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/2196-44-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/2196-4-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/2196-6-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/2332-0-0x00007FFF31DEF000-0x00007FFF31DF0000-memory.dmp

Download

memory/2332-118-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/2332-1-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/2332-2-0x00000000005E0000-0x0000000004F56000-memory.dmp

Download

memory/2332-3-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/2332-41-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/2372-201-0x0000000006A10000-0x0000000006FCA000-memory.dmp

Download

memory/2372-199-0x00000000063B0000-0x0000000006442000-memory.dmp

Download

memory/2372-150-0x0000000005B70000-0x0000000005BD6000-memory.dmp

Download

memory/2440-43-0x0000000005760000-0x00000000057AC000-memory.dmp

Download

memory/2440-42-0x00000000056E0000-0x00000000056F8000-memory.dmp

Download

memory/2440-40-0x0000000000DB0000-0x0000000000E04000-memory.dmp

Download

memory/2692-67-0x00000000009F0000-0x0000000000A00000-memory.dmp

Download

memory/4488-200-0x00007FF7CF820000-0x00007FF7CF82D000-memory.dmp

Download

memory/4752-12-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/4752-9-0x0000021874690000-0x00000218746B2000-memory.dmp

Download

memory/4752-10-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/4752-13-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/4752-24-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/4752-21-0x0000021874C90000-0x0000021874CAE000-memory.dmp

Download

memory/4752-23-0x00000218746D0000-0x00000218746DA000-memory.dmp

Download

memory/4752-22-0x0000021874F30000-0x0000021874FE2000-memory.dmp

Download

memory/4752-18-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/4752-25-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/4752-28-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/4752-26-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/4752-11-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/4752-17-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/4752-16-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/4752-15-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/4752-14-0x00007FFF31C60000-0x00007FFF32604000-memory.dmp

Download

memory/5820-208-0x00007FF7CF820000-0x00007FF7CF82D000-memory.dmp

Download