Analysis

  • max time kernel
    27s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2023, 05:30

General

  • Target

    2e7c387a3c04f747451cb1849b3a08d5ec20bfd257edd43becfa836d17b5c248.exe

  • Size

    1.4MB

  • MD5

    4b88ac972fcc2a20d45c26e514b61950

  • SHA1

    a7256224abb038d5ddd6e4b5d0f4350b5dbd2707

  • SHA256

    2e7c387a3c04f747451cb1849b3a08d5ec20bfd257edd43becfa836d17b5c248

  • SHA512

    227bc4762f4adeafd0f29c6e26b8086e649f738cb147dc1b6f78f44d9d4690903b8b5b1709a58de3ad250cf9d58254c9e71fc92c4728bb61aae82d48e3c9e905

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

-

C2

94.131.105.161:12344

Mutex

QSR_MUTEX_UEgITWnMKnRP3EZFzK

Attributes
  • encryption_key

    5Q0JQBQQfAUHRJTcAIOF

  • install_name

    lient.exe

  • log_directory

    Lugs

  • reconnect_delay

    3000

  • startup_key

    itartup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e7c387a3c04f747451cb1849b3a08d5ec20bfd257edd43becfa836d17b5c248.exe
    "C:\Users\Admin\AppData\Local\Temp\2e7c387a3c04f747451cb1849b3a08d5ec20bfd257edd43becfa836d17b5c248.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3664
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4160
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup myip.opendns.com. resolver1.opendns.com
          4⤵
            PID:3260
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3820
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic ComputerSystem get Domain
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1724
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2460
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3776
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3028
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
          3⤵
            PID:4568
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1056
          • C:\Users\Admin\AppData\Local\Temp\7z.exe
            7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4704
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1016
            • C:\Windows\SysWOW64\netsh.exe
              "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4568
            • C:\Windows\SysWOW64\netsh.exe
              "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              PID:992
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe"
              4⤵
                PID:2892
                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                  wmic computersystem where name="MSXGLQPS" set AutomaticManagedPagefile=False
                  5⤵
                    PID:3132
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe"
                  4⤵
                    PID:208
                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                      wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
                      5⤵
                        PID:1356
                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
                      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                      4⤵
                        PID:4992
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                          5⤵
                            PID:4084
                            • C:\Windows\SysWOW64\PING.EXE
                              ping 127.0.0.1 -n 9
                              6⤵
                              • Runs ping.exe
                              PID:1236
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                              6⤵
                                PID:2316
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd" /c ping 127.0.0.1 -n 18 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 18 > nul && "C:\Users\Admin\Music\rot.exe"
                              5⤵
                                PID:4280
                                • C:\Windows\SysWOW64\PING.EXE
                                  ping 127.0.0.1 -n 18
                                  6⤵
                                  • Runs ping.exe
                                  PID:1404
                            • C:\Windows\SysWOW64\attrib.exe
                              "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                              4⤵
                              • Views/modifies file attributes
                              PID:224
                          • C:\Windows\SysWOW64\reg.exe
                            REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
                            3⤵
                              PID:4544
                            • C:\Users\Admin\AppData\Local\Temp\ratt.exe
                              "ratt.exe"
                              3⤵
                                PID:2856
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                                  4⤵
                                    PID:1556
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping 127.0.0.1 -n 10
                                      5⤵
                                      • Runs ping.exe
                                      PID:2040
                                    • C:\Windows\SysWOW64\reg.exe
                                      REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                                      5⤵
                                        PID:4784
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "cmd" /c ping 127.0.0.1 -n 8 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 8 > nul && "C:\Users\Admin\Music\rot.exe"
                                      4⤵
                                        PID:2096
                                        • C:\Windows\SysWOW64\PING.EXE
                                          ping 127.0.0.1 -n 8
                                          5⤵
                                          • Runs ping.exe
                                          PID:3996
                                        • C:\Windows\SysWOW64\PING.EXE
                                          ping 127.0.0.1 -n 8
                                          5⤵
                                          • Runs ping.exe
                                          PID:3944
                                        • C:\Users\Admin\Music\rot.exe
                                          "C:\Users\Admin\Music\rot.exe"
                                          5⤵
                                            PID:5104
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                              6⤵
                                                PID:2004

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

                                            Filesize

                                            308.6MB

                                            MD5

                                            b8adc71b1bb7c93ee632084041662fd0

                                            SHA1

                                            bb214725ac327d46ae274b18a4060babae806309

                                            SHA256

                                            cbad9d88ef3276949e0b7c8509dc580fed2db40fceaa22039ea7d7bc1d542875

                                            SHA512

                                            67b4121cfb6d10f5e2933200bc4797756204b81dd00ce114a8feb1a55dd6422fff8fb1e9ceb96ac7f544c50adc43df4b073ddf8e37fae7a5c41adf3907ab16c4

                                          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

                                            Filesize

                                            252.7MB

                                            MD5

                                            f4c6ce54fbe62f9dab6450e77a488881

                                            SHA1

                                            584632c4a562253c0a1811d028d2322b506afb63

                                            SHA256

                                            96658cdd318fafb9ed886da1297d35c1ab42e47c344009bf206d55e8a4c59a58

                                            SHA512

                                            2e874b8e6f26b6a272daa110ec27d50180db005e34bb2342abfcec41ccafd865877e92ed64e5c4fd94f0087022bbce2ab956aeecc6a101b4dcff8a1613833aa0

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                            Filesize

                                            1KB

                                            MD5

                                            33b19d75aa77114216dbc23f43b195e3

                                            SHA1

                                            36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                            SHA256

                                            b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                            SHA512

                                            676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ratt.exe.log

                                            Filesize

                                            1KB

                                            MD5

                                            9a2d0ce437d2445330f2646472703087

                                            SHA1

                                            33c83e484a15f35c2caa3af62d5da6b7713a20ae

                                            SHA256

                                            30ea2f716e85f8d14a201e3fb0897d745a01b113342dfb7a9b7ac133c4ef150c

                                            SHA512

                                            a61d18d90bfad9ea8afdfa37537cfea3d5a3d0c161e323fa65840c283bdc87c3de85daaff5519beea2f2719eec1c68398eea8679b55ff733a61052f073162d5d

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            11KB

                                            MD5

                                            76f03d1e503c2f8043357495464acede

                                            SHA1

                                            fb0474aa6ff9bae5a88d93c1e92c6b36c694b50b

                                            SHA256

                                            5ae84995870495a39d4da71c6496e1e5eef213c2ee2f6580362cbb0821c165c1

                                            SHA512

                                            46b27886e83e1889d3f4adefd215a32183abdc253edc92ac2431b66f5fe9030c2c050d6fcf1aaffa2c19b92413ae01cf72a39799bc2f5f802e7cc618f372ad5f

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            11KB

                                            MD5

                                            76022c19dff5c4ec92a061d074788f1c

                                            SHA1

                                            c2b681fb714537b5a4b86abe2acf989a2363642b

                                            SHA256

                                            12624e7da6d7244ec1bb9b26900817788ae891aa5556caf850564c257991634b

                                            SHA512

                                            69eb277b93c324572578dd681717892b6b6ad8d10905875eccfdfa8c0fb8d19006e7b8aaa42e852a9276d1942e6ac1e4432c4ecdcccda313f8eafc8233860dc8

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            11KB

                                            MD5

                                            2bd984118001a46fb0d40a60d234de17

                                            SHA1

                                            23bfb9acb360f05fd500b58b8f1136217b3ef36c

                                            SHA256

                                            3a687faa662b8dfca9546c3c2319ec7c1f829a99155c5489cad0fda4a40cf92a

                                            SHA512

                                            2e5ec3fd45939c8d70527d21a1985b81d94c521e06db52bed17efc6d05f91e157087d146c8220aee04e4204238cf2ec1868e8a6978e392bd6621be51351753d8

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            11KB

                                            MD5

                                            055732093ce39749c79ea1f7c5085f9a

                                            SHA1

                                            00f3bd41f6a2b1088c4f5ef67d650343260d0eb9

                                            SHA256

                                            177fd770f50753b89720b886e6eab6c2f0186c3c512905011408b59aa4700909

                                            SHA512

                                            f624f98b506f1a3eeff865901db16fd6b1bdd494417a21948f97239d056fa01114a06d50c2f47c0c1866d4beec094b9f2e1485afe947a2b395cb4d96ac4aad61

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            11KB

                                            MD5

                                            1849306c656450f508c7ea953ff573c8

                                            SHA1

                                            45e6f09214af5283926992358d87ae8252f9ab5e

                                            SHA256

                                            2cab788a739893a084e1ba106363caedceefc1d85bdbbbc59145948055721f35

                                            SHA512

                                            1f4a0731e91eb5945a7d052f26aa90a83979639114a7e65ff15885c96069d9daf8aac4c44d681b80180022abd19c4e9a60177b84e0ce1ab9f276de98ceb15d09

                                          • C:\Users\Admin\AppData\Local\Temp\7z.dll

                                            Filesize

                                            328KB

                                            MD5

                                            15bbbe562f9be3e5dcbb834e635cc231

                                            SHA1

                                            7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

                                            SHA256

                                            ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

                                            SHA512

                                            769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

                                          • C:\Users\Admin\AppData\Local\Temp\7z.dll

                                            Filesize

                                            328KB

                                            MD5

                                            15bbbe562f9be3e5dcbb834e635cc231

                                            SHA1

                                            7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

                                            SHA256

                                            ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

                                            SHA512

                                            769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

                                          • C:\Users\Admin\AppData\Local\Temp\7z.exe

                                            Filesize

                                            71KB

                                            MD5

                                            8ba2e41b330ae9356e62eb63514cf82e

                                            SHA1

                                            8dc266467a5a0d587ed0181d4344581ef4ff30b2

                                            SHA256

                                            ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

                                            SHA512

                                            2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

                                          • C:\Users\Admin\AppData\Local\Temp\7z.exe

                                            Filesize

                                            71KB

                                            MD5

                                            8ba2e41b330ae9356e62eb63514cf82e

                                            SHA1

                                            8dc266467a5a0d587ed0181d4344581ef4ff30b2

                                            SHA256

                                            ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

                                            SHA512

                                            2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

                                          • C:\Users\Admin\AppData\Local\Temp\Add.ps1

                                            Filesize

                                            1KB

                                            MD5

                                            0df43097e0f0acd04d9e17fb43d618b9

                                            SHA1

                                            69b3ade12cb228393a93624e65f41604a17c83b6

                                            SHA256

                                            c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

                                            SHA512

                                            01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bwgny5mg.4nu.ps1

                                            Filesize

                                            60B

                                            MD5

                                            d17fe0a3f47be24a6453e9ef58c94641

                                            SHA1

                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                            SHA256

                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                            SHA512

                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                          • C:\Users\Admin\AppData\Local\Temp\ratt.7z

                                            Filesize

                                            693KB

                                            MD5

                                            7de6fdf3629c73bf0c29a96fa23ae055

                                            SHA1

                                            dcb37f6d43977601c6460b17387a89b9e4c0609a

                                            SHA256

                                            069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

                                            SHA512

                                            d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

                                          • C:\Users\Admin\AppData\Local\Temp\ratt.bat

                                            Filesize

                                            1KB

                                            MD5

                                            7ea1fec84d76294d9256ae3dca7676b2

                                            SHA1

                                            1e335451d1cbb6951bc77bf75430f4d983491342

                                            SHA256

                                            9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

                                            SHA512

                                            ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

                                          • C:\Users\Admin\AppData\Local\Temp\ratt.exe

                                            Filesize

                                            352.4MB

                                            MD5

                                            22e3e350fbdfcf5d7645500727a96a95

                                            SHA1

                                            266394da57ad3891917256bd52e1396400a04d01

                                            SHA256

                                            5fb1af74c501da0dbed20d805f62838a51f733b718c4159994de98c9f4a8cc9e

                                            SHA512

                                            a58185f22c30ddccca1c62ba61af7915f313b482cf534b0ab91e182782088975b4951407a8b6aaa559bcd2a744ceebf0c5ab20141c72f4ec190ce99817930a4a

                                          • C:\Users\Admin\AppData\Local\Temp\ratt.exe

                                            Filesize

                                            238.3MB

                                            MD5

                                            f1c4aebee91bb4f69817a7b338930aa7

                                            SHA1

                                            8405d0eaadc6ad7bf356b69a9c1b43f125805db2

                                            SHA256

                                            c4f0d0aff68a4a72c459fe264c291c43a60344e89550f04b489530861d5af740

                                            SHA512

                                            9994c8147ea24842cdd89e9186630e385e32177553957280fdd1972531006b4278731c1f1a11fa342ad94d1af3cff2cfbe9d35f5a05534a80fd6024fed219764

                                          • C:\Users\Admin\Music\rot.exe

                                            Filesize

                                            134.9MB

                                            MD5

                                            fd87ffb89bc32976f5d64a04c69a2529

                                            SHA1

                                            8d5dc1cc1cdff764bf65cb8b96aafb9522eabcd2

                                            SHA256

                                            65548983a29e15e5082b6ef38eb8dacc73f713040841ad2ba20b402acbbe809b

                                            SHA512

                                            c8d658f446e15d1329bfe8a7b3fb83de0dcfadb698a491516cf93b1be322111d0ef35d7f91ac4a610c1e1502d5aea3414ba2ce57b843979b87bbec67aa82f6d7

                                          • C:\Users\Admin\Music\rot.exe

                                            Filesize

                                            92.2MB

                                            MD5

                                            e9ca626e77ad44230e83fe27d9d6666e

                                            SHA1

                                            9747b3d6f30f33d71b929d3dc96037e350f7cc66

                                            SHA256

                                            4ae1ea59beefc8e4c3f93e3b7ed2aa37ce9230b144bd07987f922b310a15ac1a

                                            SHA512

                                            19070b7e52d93394b84386e53a749a0b9f4b05daf10e5138bbcc86b5b4329b56d7f172c9f1bdc875495b019ccbe18405e0b027a8a5f835dcd48785e86f63dd06

                                          • C:\Users\Admin\Music\rot.exe

                                            Filesize

                                            91.1MB

                                            MD5

                                            ba84d4f4c91a7fe7a8c55af12d509427

                                            SHA1

                                            e74f0aafa1f929c03445dfea9d81fe2bb7312fc6

                                            SHA256

                                            06cbb2b5e5f50d98ca83d8107a0da26c131ae2e9f64a727c5123f31f97c9098b

                                            SHA512

                                            350a9e7c402c1b50d967829703e9dbd48ac17b97957834ff271f3749bf06d8cbd7a615687c611104610aba293fb07036b97c740c98bb14da835eae8c11efc30f

                                          • memory/1016-284-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/1016-272-0x0000000007720000-0x000000000773A000-memory.dmp

                                            Filesize

                                            104KB

                                          • memory/1016-283-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/1016-282-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/1016-280-0x0000000074770000-0x0000000074F20000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/1016-279-0x0000000008970000-0x0000000008F14000-memory.dmp

                                            Filesize

                                            5.6MB

                                          • memory/1016-278-0x0000000007AB0000-0x0000000007AD2000-memory.dmp

                                            Filesize

                                            136KB

                                          • memory/1016-277-0x0000000007970000-0x0000000007978000-memory.dmp

                                            Filesize

                                            32KB

                                          • memory/1016-276-0x0000000007A40000-0x0000000007A5A000-memory.dmp

                                            Filesize

                                            104KB

                                          • memory/1016-275-0x0000000007920000-0x000000000792E000-memory.dmp

                                            Filesize

                                            56KB

                                          • memory/1016-274-0x00000000079A0000-0x0000000007A36000-memory.dmp

                                            Filesize

                                            600KB

                                          • memory/1016-273-0x0000000007770000-0x000000000777A000-memory.dmp

                                            Filesize

                                            40KB

                                          • memory/1016-271-0x0000000007D40000-0x00000000083BA000-memory.dmp

                                            Filesize

                                            6.5MB

                                          • memory/1016-270-0x00000000069B0000-0x00000000069CE000-memory.dmp

                                            Filesize

                                            120KB

                                          • memory/1016-260-0x0000000070590000-0x00000000705DC000-memory.dmp

                                            Filesize

                                            304KB

                                          • memory/1016-259-0x00000000069D0000-0x0000000006A02000-memory.dmp

                                            Filesize

                                            200KB

                                          • memory/1016-258-0x000000007FBD0000-0x000000007FBE0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/1016-257-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/1016-289-0x0000000074770000-0x0000000074F20000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/1016-245-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/1016-285-0x000000007FBD0000-0x000000007FBE0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/1016-243-0x0000000074770000-0x0000000074F20000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/1016-244-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/1056-228-0x0000000074840000-0x0000000074FF0000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/1056-215-0x0000000074840000-0x0000000074FF0000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/1056-227-0x00000000025B0000-0x00000000025C0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/2004-317-0x0000000000400000-0x000000000045E000-memory.dmp

                                            Filesize

                                            376KB

                                          • memory/2460-148-0x0000000002CF0000-0x0000000002D26000-memory.dmp

                                            Filesize

                                            216KB

                                          • memory/2460-147-0x0000000004F40000-0x0000000004F50000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/2460-166-0x0000000074840000-0x0000000074FF0000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/2460-146-0x0000000074840000-0x0000000074FF0000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/2460-157-0x0000000005C90000-0x0000000005CF6000-memory.dmp

                                            Filesize

                                            408KB

                                          • memory/2460-162-0x0000000006300000-0x000000000631E000-memory.dmp

                                            Filesize

                                            120KB

                                          • memory/2460-150-0x0000000005340000-0x0000000005362000-memory.dmp

                                            Filesize

                                            136KB

                                          • memory/2460-151-0x0000000005C20000-0x0000000005C86000-memory.dmp

                                            Filesize

                                            408KB

                                          • memory/2460-149-0x0000000005580000-0x0000000005BA8000-memory.dmp

                                            Filesize

                                            6.2MB

                                          • memory/2460-163-0x0000000004F40000-0x0000000004F50000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/2856-298-0x0000000000240000-0x00000000003F6000-memory.dmp

                                            Filesize

                                            1.7MB

                                          • memory/2856-303-0x0000000074770000-0x0000000074F20000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/2856-299-0x0000000074770000-0x0000000074F20000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/3028-185-0x0000000004810000-0x0000000004820000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3028-198-0x0000000074840000-0x0000000074FF0000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/3028-196-0x0000000004810000-0x0000000004820000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3028-184-0x0000000074840000-0x0000000074FF0000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/3776-170-0x0000000002EA0000-0x0000000002EB0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3776-182-0x0000000002EA0000-0x0000000002EB0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3776-169-0x0000000002EA0000-0x0000000002EB0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3776-168-0x0000000074840000-0x0000000074FF0000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/3776-183-0x0000000074840000-0x0000000074FF0000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/4568-199-0x0000000074840000-0x0000000074FF0000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/4568-201-0x00000000046D0000-0x00000000046E0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/4568-200-0x00000000046D0000-0x00000000046E0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/4568-212-0x00000000046D0000-0x00000000046E0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/4568-214-0x0000000074840000-0x0000000074FF0000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/4704-231-0x0000000000400000-0x0000000000432000-memory.dmp

                                            Filesize

                                            200KB

                                          • memory/4704-235-0x0000000010000000-0x00000000100E2000-memory.dmp

                                            Filesize

                                            904KB

                                          • memory/4704-239-0x0000000000400000-0x0000000000432000-memory.dmp

                                            Filesize

                                            200KB

                                          • memory/4992-297-0x0000000074770000-0x0000000074F20000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/4992-295-0x00000000054D0000-0x00000000054DA000-memory.dmp

                                            Filesize

                                            40KB

                                          • memory/4992-300-0x0000000005550000-0x0000000005560000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/4992-302-0x0000000074770000-0x0000000074F20000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/4992-294-0x0000000005550000-0x0000000005560000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/4992-293-0x00000000052E0000-0x0000000005372000-memory.dmp

                                            Filesize

                                            584KB

                                          • memory/4992-292-0x0000000005240000-0x00000000052DC000-memory.dmp

                                            Filesize

                                            624KB

                                          • memory/4992-290-0x0000000000100000-0x00000000002B6000-memory.dmp

                                            Filesize

                                            1.7MB

                                          • memory/4992-291-0x0000000074770000-0x0000000074F20000-memory.dmp

                                            Filesize

                                            7.7MB