Analysis
-
max time kernel
8s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 09:03
Static task
static1
Behavioral task
behavioral1
Sample
f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe
Resource
win10-en-20210920
General
-
Target
f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe
-
Size
2.0MB
-
MD5
fd67c26dcd41f98c693ab2d9b9a36aed
-
SHA1
d23f1539abbc98b0a29837e6884db1731d961e00
-
SHA256
f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563
-
SHA512
6ec19f9f9d5e56edb62146d787f3a2e46e60e51a3a5ceb8e524672a769e4a02987cd730070c84e6f313a180181c4b2b420ab3e93bc461920775806d621070e2b
Malware Config
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Extracted
azorult
http://0x21.in:8000/_az/
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar Payload 11 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe family_quasar C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe family_quasar C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar behavioral2/memory/2936-180-0x0000000005580000-0x0000000005A7E000-memory.dmp family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar -
Executes dropped EXE 3 IoCs
Processes:
vnc.exewindef.exewinsock.exepid process 3704 vnc.exe 4036 windef.exe 3196 winsock.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exedescription ioc process File opened (read-only) \??\h: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\j: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\q: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\e: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\g: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\k: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\n: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\o: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\s: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\t: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\u: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\v: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\a: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\b: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\f: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\l: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\p: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\w: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\x: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\z: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\i: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\m: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\r: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe File opened (read-only) \??\y: f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ip-api.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exevnc.exedescription pid process target process PID 3320 set thread context of 4048 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe PID 3704 set thread context of 424 3704 vnc.exe svchost.exe -
autoit_exe 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe behavioral2/memory/4240-185-0x0000000000B4A1F8-mapping.dmp autoit_exe C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1132 3196 WerFault.exe winsock.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4456 schtasks.exe 3108 schtasks.exe 4168 schtasks.exe 3484 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exepid process 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
vnc.exepid process 3704 vnc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
windef.exewinsock.exedescription pid process Token: SeDebugPrivilege 4036 windef.exe Token: SeDebugPrivilege 3196 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winsock.exepid process 3196 winsock.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exevnc.exewindef.exewinsock.exedescription pid process target process PID 3320 wrote to memory of 3704 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe vnc.exe PID 3320 wrote to memory of 3704 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe vnc.exe PID 3320 wrote to memory of 3704 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe vnc.exe PID 3704 wrote to memory of 424 3704 vnc.exe svchost.exe PID 3704 wrote to memory of 424 3704 vnc.exe svchost.exe PID 3320 wrote to memory of 4036 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe windef.exe PID 3320 wrote to memory of 4036 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe windef.exe PID 3320 wrote to memory of 4036 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe windef.exe PID 3320 wrote to memory of 4048 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe PID 3320 wrote to memory of 4048 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe PID 3320 wrote to memory of 4048 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe PID 3320 wrote to memory of 4048 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe PID 3320 wrote to memory of 4048 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe PID 3704 wrote to memory of 424 3704 vnc.exe svchost.exe PID 3320 wrote to memory of 3484 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe schtasks.exe PID 3320 wrote to memory of 3484 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe schtasks.exe PID 3320 wrote to memory of 3484 3320 f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe schtasks.exe PID 3704 wrote to memory of 424 3704 vnc.exe svchost.exe PID 3704 wrote to memory of 424 3704 vnc.exe svchost.exe PID 4036 wrote to memory of 4456 4036 windef.exe schtasks.exe PID 4036 wrote to memory of 4456 4036 windef.exe schtasks.exe PID 4036 wrote to memory of 4456 4036 windef.exe schtasks.exe PID 4036 wrote to memory of 3196 4036 windef.exe winsock.exe PID 4036 wrote to memory of 3196 4036 windef.exe winsock.exe PID 4036 wrote to memory of 3196 4036 windef.exe winsock.exe PID 3196 wrote to memory of 3108 3196 winsock.exe schtasks.exe PID 3196 wrote to memory of 3108 3196 winsock.exe schtasks.exe PID 3196 wrote to memory of 3108 3196 winsock.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe"C:\Users\Admin\AppData\Local\Temp\f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TGj7EdBTF68t.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 18844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe"C:\Users\Admin\AppData\Local\Temp\f699ae77419a80e03b5113a3f60b5e06a98b304db624c4d331e227555e51b563.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.logMD5
1efce85e583a7a2f123317a20f889d04
SHA160f71aa73ea2e2a48ed1c17e3c6d440abf39c914
SHA2562b5532a94879134a876b11c188ade1a61deaba6a80fe1f3a3a77cc442f1cca0d
SHA51245a5cd283e6a6ac34c3d8b1a6d73dc1cf52d8c974cf84624e8e9924eddaf354ccda929bce728b47db2b62175e47bdc3eaca6bc6b84d3565881fa87c50319d24c
-
C:\Users\Admin\AppData\Local\Temp\TGj7EdBTF68t.batMD5
08a7f5ac3ee3dd4fad69902845783ab1
SHA19e231f70163343e512c4fb9aef877754ab15c783
SHA256e0506c7cdb5d5449a95d7524e0557408e9a85aa377295a26252677b03b793bcc
SHA512f1bd0b9897f4c686e88c65892161f91135f6a1198b7930ea85c373e2d21c95ef4332a249f1e109dcc17df109a84ad52130e7e6a1fb4c710c02e994ec67dfb268
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeMD5
b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeMD5
b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeMD5
b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\windef.exeMD5
b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\windef.exeMD5
b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\windef.exeMD5
b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\windef.exeMD5
b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exeMD5
b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exeMD5
b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exeMD5
b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeMD5
328c026cac43aaad6806682f6c904668
SHA1ba8e3068f150a78ad9142253f8be800ec6f4a2fd
SHA2561a49e3ae5ced9e3acafd3437e65a75327be42737c8caaae814d60041829b3423
SHA5120788d505480621adaf97dbb2a9b29c9438a5af83a589f4e535ba4f62ddf30fe1ddfbc80541bc90dcec2bf0daf368fe13d5684a2776c4835447377fb99ac3b8de
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeMD5
328c026cac43aaad6806682f6c904668
SHA1ba8e3068f150a78ad9142253f8be800ec6f4a2fd
SHA2561a49e3ae5ced9e3acafd3437e65a75327be42737c8caaae814d60041829b3423
SHA5120788d505480621adaf97dbb2a9b29c9438a5af83a589f4e535ba4f62ddf30fe1ddfbc80541bc90dcec2bf0daf368fe13d5684a2776c4835447377fb99ac3b8de
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeMD5
328c026cac43aaad6806682f6c904668
SHA1ba8e3068f150a78ad9142253f8be800ec6f4a2fd
SHA2561a49e3ae5ced9e3acafd3437e65a75327be42737c8caaae814d60041829b3423
SHA5120788d505480621adaf97dbb2a9b29c9438a5af83a589f4e535ba4f62ddf30fe1ddfbc80541bc90dcec2bf0daf368fe13d5684a2776c4835447377fb99ac3b8de
-
memory/368-155-0x0000000000000000-mapping.dmp
-
memory/424-132-0x0000000000C90000-0x0000000000D2C000-memory.dmpFilesize
624KB
-
memory/424-126-0x0000000000000000-mapping.dmp
-
memory/424-131-0x0000000000D30000-0x0000000000D31000-memory.dmpFilesize
4KB
-
memory/676-153-0x0000000000000000-mapping.dmp
-
memory/1184-156-0x0000000000000000-mapping.dmp
-
memory/1616-163-0x0000000005800000-0x0000000005CFE000-memory.dmpFilesize
5.0MB
-
memory/1616-157-0x0000000000000000-mapping.dmp
-
memory/2456-167-0x0000000000000000-mapping.dmp
-
memory/2784-178-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/2784-179-0x0000000000070000-0x000000000010C000-memory.dmpFilesize
624KB
-
memory/2784-169-0x0000000000000000-mapping.dmp
-
memory/2936-180-0x0000000005580000-0x0000000005A7E000-memory.dmpFilesize
5.0MB
-
memory/2936-170-0x0000000000000000-mapping.dmp
-
memory/3108-151-0x0000000000000000-mapping.dmp
-
memory/3196-147-0x0000000004C30000-0x000000000512E000-memory.dmpFilesize
5.0MB
-
memory/3196-140-0x0000000000000000-mapping.dmp
-
memory/3196-152-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/3320-130-0x00000000034F0000-0x00000000034F1000-memory.dmpFilesize
4KB
-
memory/3484-127-0x0000000000000000-mapping.dmp
-
memory/3704-115-0x0000000000000000-mapping.dmp
-
memory/4036-128-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB
-
memory/4036-118-0x0000000000000000-mapping.dmp
-
memory/4036-134-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/4036-135-0x0000000005020000-0x000000000551E000-memory.dmpFilesize
5.0MB
-
memory/4036-133-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/4036-138-0x0000000006130000-0x0000000006131000-memory.dmpFilesize
4KB
-
memory/4036-137-0x0000000005D40000-0x0000000005D41000-memory.dmpFilesize
4KB
-
memory/4036-136-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/4048-125-0x000000000041A1F8-mapping.dmp
-
memory/4048-120-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4168-187-0x0000000000000000-mapping.dmp
-
memory/4240-181-0x0000000000B30000-0x0000000000B50000-memory.dmpFilesize
128KB
-
memory/4240-185-0x0000000000B4A1F8-mapping.dmp
-
memory/4456-139-0x0000000000000000-mapping.dmp