Analysis
-
max time kernel
7s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2022 01:00
Behavioral task
behavioral1
Sample
537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe
Resource
win10v2004-20220812-en
General
-
Target
537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe
-
Size
2.0MB
-
MD5
d1e02ef0942353ad42b74ac49b31a680
-
SHA1
1206e864fff96eb16d1a5dd1226c27dc315ee61f
-
SHA256
537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87
-
SHA512
3e09c113a9d602dd5c331f0f65e442b0e743e722c9c0eaac711b3962b4655b51c10e98d4bf8c24c13f0833bdfe3395ad32c628bff4bf1fff020470cce0015b07
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKY3:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yx
Malware Config
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Extracted
azorult
http://0x21.in:8000/_az/
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 13 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar behavioral2/memory/4180-145-0x0000000000CA0000-0x0000000000CFE000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe family_quasar C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe family_quasar C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe family_quasar C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe family_quasar -
Executes dropped EXE 3 IoCs
Processes:
vnc.exewindef.exewinsock.exepid process 4764 vnc.exe 4180 windef.exe 1092 winsock.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exedescription ioc process File opened (read-only) \??\s: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\t: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\z: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\b: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\f: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\l: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\n: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\p: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\x: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\y: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\g: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\i: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\k: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\o: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\v: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\e: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\r: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\w: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\u: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\a: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\h: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\j: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\m: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe File opened (read-only) \??\q: 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 svchost.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exevnc.exedescription pid process target process PID 692 set thread context of 4972 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe PID 4764 set thread context of 4080 4764 vnc.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4908 1092 WerFault.exe winsock.exe 5076 2364 WerFault.exe winsock.exe 752 3020 WerFault.exe winsock.exe 4156 2476 WerFault.exe winsock.exe -
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2872 schtasks.exe 1976 schtasks.exe 216 schtasks.exe 5008 schtasks.exe 4288 schtasks.exe 4000 schtasks.exe 4560 schtasks.exe -
Runs ping.exe 1 TTPs 4 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEpid process 1020 PING.EXE 4076 PING.EXE 4912 PING.EXE 3236 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exepid process 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
vnc.exepid process 4764 vnc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
windef.exewinsock.exedescription pid process Token: SeDebugPrivilege 4180 windef.exe Token: SeDebugPrivilege 1092 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winsock.exepid process 1092 winsock.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exevnc.exewindef.exewinsock.exedescription pid process target process PID 692 wrote to memory of 4764 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe vnc.exe PID 692 wrote to memory of 4764 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe vnc.exe PID 692 wrote to memory of 4764 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe vnc.exe PID 4764 wrote to memory of 4080 4764 vnc.exe svchost.exe PID 4764 wrote to memory of 4080 4764 vnc.exe svchost.exe PID 692 wrote to memory of 4180 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe windef.exe PID 692 wrote to memory of 4180 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe windef.exe PID 692 wrote to memory of 4180 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe windef.exe PID 4764 wrote to memory of 4080 4764 vnc.exe svchost.exe PID 692 wrote to memory of 4972 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe PID 692 wrote to memory of 4972 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe PID 692 wrote to memory of 4972 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe PID 692 wrote to memory of 4972 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe PID 692 wrote to memory of 4972 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe PID 4764 wrote to memory of 4080 4764 vnc.exe svchost.exe PID 692 wrote to memory of 5008 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe schtasks.exe PID 692 wrote to memory of 5008 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe schtasks.exe PID 692 wrote to memory of 5008 692 537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe schtasks.exe PID 4764 wrote to memory of 4080 4764 vnc.exe svchost.exe PID 4180 wrote to memory of 4288 4180 windef.exe schtasks.exe PID 4180 wrote to memory of 4288 4180 windef.exe schtasks.exe PID 4180 wrote to memory of 4288 4180 windef.exe schtasks.exe PID 4180 wrote to memory of 1092 4180 windef.exe winsock.exe PID 4180 wrote to memory of 1092 4180 windef.exe winsock.exe PID 4180 wrote to memory of 1092 4180 windef.exe winsock.exe PID 1092 wrote to memory of 4000 1092 winsock.exe schtasks.exe PID 1092 wrote to memory of 4000 1092 winsock.exe schtasks.exe PID 1092 wrote to memory of 4000 1092 winsock.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe"C:\Users\Admin\AppData\Local\Temp\537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
- Maps connected drives based on registry
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ppzEKMk2urXh.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A8DOJO3Glmtj.bat" "6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"7⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f8⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qR3LsM4S9mqW.bat" "8⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650019⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost9⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"9⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f10⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dUV3Vy7cmQQR.bat" "10⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500111⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost11⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 200810⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 22368⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 22366⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 17324⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe"C:\Users\Admin\AppData\Local\Temp\537dcf9f0aaa57ac4814a06cc3dd0b0a19c036aa0ad6fcef4044e1298f07cd87.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1092 -ip 10921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2364 -ip 23641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3020 -ip 30201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2476 -ip 24761⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.logFilesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
C:\Users\Admin\AppData\Local\Temp\A8DOJO3Glmtj.batFilesize
208B
MD555dd0bf56b73aa3026adc2a38d0fd9c0
SHA1ccbaae0c778cc16524ee4fe94d79f41ca4fb5fd5
SHA256c5d97f5311e86635962a370ba75549a0b9fcb4831be64df8e6904fb650de577e
SHA512701c3278ecafa15582b5e2a90e831dc7a2ec06be2976c94746e79348375d69eacf0b7d6e63b4c7e2bd32cebee5c5a476b0398d640b019f6a2a7f8bfc9229e21f
-
C:\Users\Admin\AppData\Local\Temp\dUV3Vy7cmQQR.batFilesize
208B
MD51f7dc666a90f836cd6545b04c2a45c49
SHA15d3cd1c0e9610db355f23ff748398ba0367bfb2c
SHA2567cd939de1b3ddaef74da4424680e807bb60d9d3299911e2b22eb7cba876e448f
SHA512b3911d09147bbc017ca89bd8edb4c868f4f7611150b18af52f13516b9e0600cfda1e4d9d245ee8802cceac1bd66422634c025a9b161c88f2b546add82067e74b
-
C:\Users\Admin\AppData\Local\Temp\ppzEKMk2urXh.batFilesize
208B
MD58d2ebf16f52c5e20c86396fc8c3e01c2
SHA1192b907becc2beaa224a8ac77d6f6e4011e69f3e
SHA25688dea2baf4def577462c1b3d63d54ac49abf0ba9bfb58c37117434bb0a345a5b
SHA5124a4d8e0a58bccfbd88eec96bb62b973bc2cf7ae6a0111b29afd2c97195a9a80295056b0dacaae57d81e6c3055c9a5f3e89c9e71f89a8fbc7fca4bb1f040ba35d
-
C:\Users\Admin\AppData\Local\Temp\qR3LsM4S9mqW.batFilesize
208B
MD5547959b5b46508029d8a5af479f9eba7
SHA1009f50299d39b28ef0c3768f7e25fcc63897e299
SHA256f60ec605d3a730029cb225b80c55d36a36a9abba7eddd5d9d2f1179e77ddc276
SHA5128d642bcb5f047e04c00f9cba0c37fa44f171181ec730c9277f3e09e761281a35c40b424e78b5636cfbb3d291ef9154dbdefd62bf365e124c2e38d9c4fb825e21
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\Logs\10-18-2022Filesize
224B
MD5bd5b307db5f13c3924c30b7b016490d9
SHA18fe0089cbaad04624f9e4162d96f403de2f0cbaf
SHA2567923f3c8e3d2f4c91a6e86ced4ef7e1387248d243f96e2dce8723be97e1e1ce9
SHA512e1a071810092d2a98e908e33471769c0becfd53e6e3b1a23c0592ae676270f9dd4673b6e10d447a42905ac71831e8649c7068248d9142cb9f933a530ca5b671b
-
C:\Users\Admin\AppData\Roaming\Logs\10-18-2022Filesize
224B
MD5a3a40abf291b574ee99dadabbe5e0383
SHA153eb49c826cd75f75cab7c188ed7798ee39621e1
SHA2563725f9e9a7dadbf5905aa0af8a534d8083d0a88b9110f996e0be574e9af1244c
SHA512d1894d3fd04155d18c6ef8deea47517731e81a9dcac8eebd0cfb35666d4761ebf94ba14a2e0ad3c3124cae29a92a2d6ffd961f67a1343549c13b2debd67f7c3e
-
C:\Users\Admin\AppData\Roaming\Logs\10-18-2022Filesize
224B
MD5a82ef053d10afa5ef0ffc0abf13fb442
SHA1c50ff8b617c466911098d7f1d9771b44f94135af
SHA256dd759e334dc25877a211bf5d052367f7d0ae31c31984a73b1c2b0305c7d612d7
SHA5121d7b25f1063cd45b2fb06a31859f1b14a81a501758aee7c251b39d9c52408f5fdbd2b5e788f8b774313f3044aea0ceb37cdd1806989d4222fced65ff543acc29
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD5d3a567ed683b620d34271379d260aef6
SHA13d0a3b0cfcbd5262f6b87f970e344da8b28312cc
SHA2568a0d949aa5163efbdf3858d819a86c4ab9a8cfd66b3745096064e89c6d6cbcb0
SHA512b281ff714449ae1ddaadda92e68091cf10f778116cf489ed92948b2928dfe890e676a6857067c9d40056816a36988a23f7f29793d69c6af351e5accc2bc660ab
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD5d3a567ed683b620d34271379d260aef6
SHA13d0a3b0cfcbd5262f6b87f970e344da8b28312cc
SHA2568a0d949aa5163efbdf3858d819a86c4ab9a8cfd66b3745096064e89c6d6cbcb0
SHA512b281ff714449ae1ddaadda92e68091cf10f778116cf489ed92948b2928dfe890e676a6857067c9d40056816a36988a23f7f29793d69c6af351e5accc2bc660ab
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD5d3a567ed683b620d34271379d260aef6
SHA13d0a3b0cfcbd5262f6b87f970e344da8b28312cc
SHA2568a0d949aa5163efbdf3858d819a86c4ab9a8cfd66b3745096064e89c6d6cbcb0
SHA512b281ff714449ae1ddaadda92e68091cf10f778116cf489ed92948b2928dfe890e676a6857067c9d40056816a36988a23f7f29793d69c6af351e5accc2bc660ab
-
memory/8-173-0x0000000000000000-mapping.dmp
-
memory/216-207-0x0000000000000000-mapping.dmp
-
memory/648-168-0x0000000000000000-mapping.dmp
-
memory/1020-188-0x0000000000000000-mapping.dmp
-
memory/1092-162-0x0000000006F40000-0x0000000006F4A000-memory.dmpFilesize
40KB
-
memory/1092-158-0x0000000000000000-mapping.dmp
-
memory/1228-187-0x0000000000000000-mapping.dmp
-
memory/1388-167-0x0000000000000000-mapping.dmp
-
memory/1388-172-0x0000000000AF0000-0x0000000000B8C000-memory.dmpFilesize
624KB
-
memory/1976-199-0x0000000000000000-mapping.dmp
-
memory/2044-195-0x0000000000000000-mapping.dmp
-
memory/2212-185-0x0000000000000000-mapping.dmp
-
memory/2364-189-0x0000000000000000-mapping.dmp
-
memory/2476-205-0x0000000000000000-mapping.dmp
-
memory/2872-191-0x0000000000000000-mapping.dmp
-
memory/3020-197-0x0000000000000000-mapping.dmp
-
memory/3236-212-0x0000000000000000-mapping.dmp
-
memory/4000-161-0x0000000000000000-mapping.dmp
-
memory/4076-196-0x0000000000000000-mapping.dmp
-
memory/4080-153-0x0000000000080000-0x000000000011C000-memory.dmpFilesize
624KB
-
memory/4080-137-0x0000000000000000-mapping.dmp
-
memory/4180-145-0x0000000000CA0000-0x0000000000CFE000-memory.dmpFilesize
376KB
-
memory/4180-154-0x0000000005660000-0x00000000056C6000-memory.dmpFilesize
408KB
-
memory/4180-155-0x00000000065A0000-0x00000000065B2000-memory.dmpFilesize
72KB
-
memory/4180-156-0x00000000069C0000-0x00000000069FC000-memory.dmpFilesize
240KB
-
memory/4180-135-0x0000000000000000-mapping.dmp
-
memory/4180-152-0x00000000055C0000-0x0000000005652000-memory.dmpFilesize
584KB
-
memory/4180-151-0x0000000005AD0000-0x0000000006074000-memory.dmpFilesize
5.6MB
-
memory/4284-209-0x0000000000000000-mapping.dmp
-
memory/4288-157-0x0000000000000000-mapping.dmp
-
memory/4360-211-0x0000000000000000-mapping.dmp
-
memory/4372-165-0x0000000000000000-mapping.dmp
-
memory/4376-203-0x0000000000000000-mapping.dmp
-
memory/4560-184-0x0000000000000000-mapping.dmp
-
memory/4764-132-0x0000000000000000-mapping.dmp
-
memory/4912-204-0x0000000000000000-mapping.dmp
-
memory/4968-193-0x0000000000000000-mapping.dmp
-
memory/4972-149-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4972-140-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4972-139-0x0000000000000000-mapping.dmp
-
memory/5008-150-0x0000000000000000-mapping.dmp
-
memory/5040-201-0x0000000000000000-mapping.dmp