Analysis
-
max time kernel
5s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231201-en -
resource tags
arch:x64arch:x86image:win10v2004-20231201-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2023 21:12
Behavioral task
behavioral1
Sample
577f103acc44e9245230bcbe53b1fa60.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
577f103acc44e9245230bcbe53b1fa60.exe
Resource
win10v2004-20231201-en
General
-
Target
577f103acc44e9245230bcbe53b1fa60.exe
-
Size
2.0MB
-
MD5
577f103acc44e9245230bcbe53b1fa60
-
SHA1
a9584b8f6da16d6c04f2c81453bb6124e02bf298
-
SHA256
3bc70bb955946279917fd36c56593c235c07d8e55f1ddcd254da0fe16c826736
-
SHA512
09eae7dd1814bb5efeea7fa0f9f0c551a38e042e69e04843f2b7dadacfa2759d640c620a064ca1fac1cbf03db2010d649ae7324e33c455df1f9cb3ce28387c79
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYD:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YV
Malware Config
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Extracted
azorult
http://0x21.in:8000/_az/
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 12 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar behavioral2/memory/2676-29-0x00000000004A0000-0x00000000004FE000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe family_quasar C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe family_quasar C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
577f103acc44e9245230bcbe53b1fa60.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\Control Panel\International\Geo\Nation 577f103acc44e9245230bcbe53b1fa60.exe -
Executes dropped EXE 3 IoCs
Processes:
vnc.exewindef.exewinsock.exepid process 1540 vnc.exe 2676 windef.exe 1748 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
577f103acc44e9245230bcbe53b1fa60.exedescription ioc process File opened (read-only) \??\k: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\o: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\r: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\y: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\e: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\b: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\j: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\s: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\u: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\v: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\a: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\m: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\n: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\q: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\w: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\z: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\h: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\i: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\l: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\p: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\t: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\x: 577f103acc44e9245230bcbe53b1fa60.exe File opened (read-only) \??\g: 577f103acc44e9245230bcbe53b1fa60.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
577f103acc44e9245230bcbe53b1fa60.exedescription pid process target process PID 2512 set thread context of 1304 2512 577f103acc44e9245230bcbe53b1fa60.exe 577f103acc44e9245230bcbe53b1fa60.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3832 1540 WerFault.exe vnc.exe 4620 1748 WerFault.exe winsock.exe 4696 3592 WerFault.exe vnc.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3616 schtasks.exe 2976 schtasks.exe 2220 schtasks.exe 4112 schtasks.exe 2780 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
577f103acc44e9245230bcbe53b1fa60.exepid process 2512 577f103acc44e9245230bcbe53b1fa60.exe 2512 577f103acc44e9245230bcbe53b1fa60.exe 2512 577f103acc44e9245230bcbe53b1fa60.exe 2512 577f103acc44e9245230bcbe53b1fa60.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
windef.exewinsock.exedescription pid process Token: SeDebugPrivilege 2676 windef.exe Token: SeDebugPrivilege 1748 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winsock.exepid process 1748 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
577f103acc44e9245230bcbe53b1fa60.exevnc.exewindef.exewinsock.exedescription pid process target process PID 2512 wrote to memory of 1540 2512 577f103acc44e9245230bcbe53b1fa60.exe vnc.exe PID 2512 wrote to memory of 1540 2512 577f103acc44e9245230bcbe53b1fa60.exe vnc.exe PID 2512 wrote to memory of 1540 2512 577f103acc44e9245230bcbe53b1fa60.exe vnc.exe PID 2512 wrote to memory of 2676 2512 577f103acc44e9245230bcbe53b1fa60.exe windef.exe PID 2512 wrote to memory of 2676 2512 577f103acc44e9245230bcbe53b1fa60.exe windef.exe PID 2512 wrote to memory of 2676 2512 577f103acc44e9245230bcbe53b1fa60.exe windef.exe PID 1540 wrote to memory of 4440 1540 vnc.exe svchost.exe PID 1540 wrote to memory of 4440 1540 vnc.exe svchost.exe PID 1540 wrote to memory of 4440 1540 vnc.exe svchost.exe PID 2512 wrote to memory of 1304 2512 577f103acc44e9245230bcbe53b1fa60.exe 577f103acc44e9245230bcbe53b1fa60.exe PID 2512 wrote to memory of 1304 2512 577f103acc44e9245230bcbe53b1fa60.exe 577f103acc44e9245230bcbe53b1fa60.exe PID 2512 wrote to memory of 1304 2512 577f103acc44e9245230bcbe53b1fa60.exe 577f103acc44e9245230bcbe53b1fa60.exe PID 2512 wrote to memory of 1304 2512 577f103acc44e9245230bcbe53b1fa60.exe 577f103acc44e9245230bcbe53b1fa60.exe PID 2512 wrote to memory of 1304 2512 577f103acc44e9245230bcbe53b1fa60.exe 577f103acc44e9245230bcbe53b1fa60.exe PID 2512 wrote to memory of 3616 2512 577f103acc44e9245230bcbe53b1fa60.exe schtasks.exe PID 2512 wrote to memory of 3616 2512 577f103acc44e9245230bcbe53b1fa60.exe schtasks.exe PID 2512 wrote to memory of 3616 2512 577f103acc44e9245230bcbe53b1fa60.exe schtasks.exe PID 2676 wrote to memory of 2976 2676 windef.exe schtasks.exe PID 2676 wrote to memory of 2976 2676 windef.exe schtasks.exe PID 2676 wrote to memory of 2976 2676 windef.exe schtasks.exe PID 2676 wrote to memory of 1748 2676 windef.exe winsock.exe PID 2676 wrote to memory of 1748 2676 windef.exe winsock.exe PID 2676 wrote to memory of 1748 2676 windef.exe winsock.exe PID 1748 wrote to memory of 2220 1748 winsock.exe schtasks.exe PID 1748 wrote to memory of 2220 1748 winsock.exe schtasks.exe PID 1748 wrote to memory of 2220 1748 winsock.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\577f103acc44e9245230bcbe53b1fa60.exe"C:\Users\Admin\AppData\Local\Temp\577f103acc44e9245230bcbe53b1fa60.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 5483⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xawXeOs0Mvn9.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 19884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\577f103acc44e9245230bcbe53b1fa60.exe"C:\Users\Admin\AppData\Local\Temp\577f103acc44e9245230bcbe53b1fa60.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1540 -ip 15401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1748 -ip 17481⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 5203⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3592 -ip 35921⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.logFilesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\xawXeOs0Mvn9.batFilesize
208B
MD5b75c9571318173f081fc7929c8fd0418
SHA1f4334fde2a6bc60f37f25b9fd73df6299b95490d
SHA256347463254255fadccfa352c11e154ab4810a103c6f977bbc88ab5a8ed0a5ced1
SHA51278a2bb2ac116d9c9ec5a90b963ecc0120e43ef9318804020b1fb15c98d77e5d2e7dcdd27ee603a7413bb4076260116d78e9e3a39a6962e08286ce5450debe468
-
C:\Users\Admin\AppData\Roaming\Logs\12-06-2023Filesize
224B
MD509bc9154ab8a54e8f9f07f150fd4ef16
SHA18f6bfce37684e3fd122286eb756415a35ddf74c7
SHA256503b640ef474da446dfdf7b4c8396f052dc04c9bbc54fd81a5c6963efc2b31ae
SHA5123a080649b2448fbd4b68e64e461f5064a528ed892e2d1653279d5084ffc23b1c4426af9cb2a7711489c32337ff62468dc3a329d0ac262619442fe6c15484ec1d
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD57c0b78424ce5dc75915743e54f968bb6
SHA1c74f02a66f1b6c6a8943bbad8fe00461c839b036
SHA256738db4091b9834a49f722261fb9f18ba69eb6ad741b745f02c814450e8eb2913
SHA51247075046bab5cb5785b4e5151772c8fac5ed0e5d3d226fc19ff988d8485ab1ca14a4a415caff0a507827379bd24cc9568a7ffa96029b01c6278014ae77892e7a
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD57c0b78424ce5dc75915743e54f968bb6
SHA1c74f02a66f1b6c6a8943bbad8fe00461c839b036
SHA256738db4091b9834a49f722261fb9f18ba69eb6ad741b745f02c814450e8eb2913
SHA51247075046bab5cb5785b4e5151772c8fac5ed0e5d3d226fc19ff988d8485ab1ca14a4a415caff0a507827379bd24cc9568a7ffa96029b01c6278014ae77892e7a
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD57c0b78424ce5dc75915743e54f968bb6
SHA1c74f02a66f1b6c6a8943bbad8fe00461c839b036
SHA256738db4091b9834a49f722261fb9f18ba69eb6ad741b745f02c814450e8eb2913
SHA51247075046bab5cb5785b4e5151772c8fac5ed0e5d3d226fc19ff988d8485ab1ca14a4a415caff0a507827379bd24cc9568a7ffa96029b01c6278014ae77892e7a
-
memory/1304-28-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1304-19-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1748-46-0x0000000072A60000-0x0000000073210000-memory.dmpFilesize
7.7MB
-
memory/1748-47-0x0000000004F50000-0x0000000004F60000-memory.dmpFilesize
64KB
-
memory/1748-49-0x0000000006470000-0x000000000647A000-memory.dmpFilesize
40KB
-
memory/1748-50-0x0000000072A60000-0x0000000073210000-memory.dmpFilesize
7.7MB
-
memory/1748-51-0x0000000004F50000-0x0000000004F60000-memory.dmpFilesize
64KB
-
memory/1748-56-0x0000000072A60000-0x0000000073210000-memory.dmpFilesize
7.7MB
-
memory/1880-96-0x0000000072A60000-0x0000000073210000-memory.dmpFilesize
7.7MB
-
memory/1880-84-0x00000000053C0000-0x00000000053D0000-memory.dmpFilesize
64KB
-
memory/1880-83-0x0000000072A60000-0x0000000073210000-memory.dmpFilesize
7.7MB
-
memory/2512-21-0x0000000004010000-0x0000000004011000-memory.dmpFilesize
4KB
-
memory/2676-36-0x0000000004DC0000-0x0000000004E26000-memory.dmpFilesize
408KB
-
memory/2676-37-0x0000000005AE0000-0x0000000005AF2000-memory.dmpFilesize
72KB
-
memory/2676-35-0x0000000004D40000-0x0000000004D50000-memory.dmpFilesize
64KB
-
memory/2676-34-0x0000000004E60000-0x0000000004EF2000-memory.dmpFilesize
584KB
-
memory/2676-33-0x0000000005410000-0x00000000059B4000-memory.dmpFilesize
5.6MB
-
memory/2676-30-0x0000000072A60000-0x0000000073210000-memory.dmpFilesize
7.7MB
-
memory/2676-29-0x00000000004A0000-0x00000000004FE000-memory.dmpFilesize
376KB
-
memory/2676-38-0x0000000006020000-0x000000000605C000-memory.dmpFilesize
240KB
-
memory/2676-45-0x0000000072A60000-0x0000000073210000-memory.dmpFilesize
7.7MB
-
memory/4228-59-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4228-58-0x0000000072A60000-0x0000000073210000-memory.dmpFilesize
7.7MB
-
memory/4228-87-0x0000000072A60000-0x0000000073210000-memory.dmpFilesize
7.7MB