Malware Analysis Report

2024-10-23 21:29

Sample ID 240309-2elbwscf49
Target bcf82013e39cef4310eb312625ab8598
SHA256 088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0
Tags
quasar games persistence spyware trojan revengerat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0

Threat Level: Known bad

The file bcf82013e39cef4310eb312625ab8598 was found to be: Known bad.

Malicious Activity Summary

quasar games persistence spyware trojan revengerat

Quasar family

Quasar payload

Quasar RAT

RevengeRAT

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Enumerates physical storage devices

Unsigned PE

Program crash

Runs ping.exe

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-09 22:29

Signatures

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-09 22:29

Reported

2024-03-09 22:35

Platform

win10v2004-20240226-en

Max time kernel

164s

Max time network

171s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Firefox Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bcf82013e39cef4310eb312625ab8598.exe\"" C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3132 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Windows\SysWOW64\schtasks.exe
PID 3132 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Windows\SysWOW64\schtasks.exe
PID 3132 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Windows\SysWOW64\schtasks.exe
PID 3132 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 3132 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 3132 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 3148 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\schtasks.exe
PID 3148 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\schtasks.exe
PID 3148 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\schtasks.exe
PID 3148 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\cmd.exe
PID 3148 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\cmd.exe
PID 3148 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\cmd.exe
PID 4640 wrote to memory of 4484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4640 wrote to memory of 4484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4640 wrote to memory of 4484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4640 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4640 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4640 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe

"C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Firefox Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe

"C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Firefox Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yrLIMI8veaKB.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

Network

Country Destination Domain Proto
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 45.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 61.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 88.16.208.104.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 services18.dns.army udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
N/A 13.107.42.16:443 tcp

Files

memory/3132-0-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/3132-1-0x0000000000D80000-0x0000000000DAE000-memory.dmp

memory/3132-2-0x0000000005720000-0x000000000576C000-memory.dmp

memory/3132-3-0x00000000082A0000-0x0000000008844000-memory.dmp

memory/3132-4-0x0000000007D90000-0x0000000007E22000-memory.dmp

memory/3132-5-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/3132-6-0x0000000005960000-0x0000000005970000-memory.dmp

memory/3132-7-0x0000000007CF0000-0x0000000007D56000-memory.dmp

memory/3132-8-0x0000000005960000-0x0000000005970000-memory.dmp

memory/3132-9-0x0000000008270000-0x0000000008282000-memory.dmp

memory/3132-10-0x0000000008F70000-0x0000000008FAC000-memory.dmp

C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe

MD5 bcf82013e39cef4310eb312625ab8598
SHA1 96f423ba66892855a6d67e96a23bdba885f63944
SHA256 088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0
SHA512 1cddb94d23d6387dcb0650a74ae2028e6a9744788ce7fe5f4bb98afa41c9670e7097fe1be9b323b2c061742a2c026ea710ff294a3b169085fecdb417beb95ac3

memory/3148-15-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/3148-16-0x0000000005450000-0x0000000005460000-memory.dmp

memory/3132-18-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/3148-20-0x0000000008F60000-0x0000000008F6A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\yrLIMI8veaKB.bat

MD5 2cf01e9d86ebd0e30b6e8a26f169422e
SHA1 c6ab9f2d51252057c590ec0a28da175a95ec45cc
SHA256 c4a23b3de8331112447c45fe4007d4d5e9895b7563efbe3aefe7be78bfbf839c
SHA512 d37b196e011383309d7cf9051a61101b1fafe5fb1710095a70024446e0f413f0f284dbaf0ce5f214ad6afb933c01eb1666aa0b46aa5ace9fb7d567e24a1edefa

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-09 22:29

Reported

2024-03-09 22:34

Platform

win7-20240221-en

Max time kernel

120s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RevengeRAT

trojan revengerat

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1812 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Windows\SysWOW64\schtasks.exe
PID 1812 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Windows\SysWOW64\schtasks.exe
PID 1812 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Windows\SysWOW64\schtasks.exe
PID 1812 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Windows\SysWOW64\schtasks.exe
PID 1812 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 1812 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 1812 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 1812 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 1812 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 1812 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 1812 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 2640 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\schtasks.exe
PID 2640 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\schtasks.exe
PID 2640 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\schtasks.exe
PID 2640 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\schtasks.exe
PID 2640 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\cmd.exe
PID 2640 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\cmd.exe
PID 2640 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\cmd.exe
PID 2640 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\cmd.exe
PID 2472 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2472 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2472 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2472 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2640 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\WerFault.exe
PID 2640 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\WerFault.exe
PID 2640 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\WerFault.exe
PID 2640 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe C:\Windows\SysWOW64\WerFault.exe
PID 2472 wrote to memory of 2500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2472 wrote to memory of 2500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2472 wrote to memory of 2500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2472 wrote to memory of 2500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2472 wrote to memory of 2976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 2472 wrote to memory of 2976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 2472 wrote to memory of 2976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 2472 wrote to memory of 2976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 2472 wrote to memory of 2976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 2472 wrote to memory of 2976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
PID 2472 wrote to memory of 2976 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe

"C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Firefox Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe

"C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Firefox Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\0EPIBWDmBjQw.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 1492

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe

"C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 services18.dns.army udp

Files

memory/1812-0-0x0000000000160000-0x000000000018E000-memory.dmp

memory/1812-1-0x0000000074470000-0x0000000074B5E000-memory.dmp

memory/1812-2-0x0000000001D60000-0x0000000001DAC000-memory.dmp

memory/1812-3-0x0000000004950000-0x0000000004990000-memory.dmp

\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe

MD5 bcf82013e39cef4310eb312625ab8598
SHA1 96f423ba66892855a6d67e96a23bdba885f63944
SHA256 088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0
SHA512 1cddb94d23d6387dcb0650a74ae2028e6a9744788ce7fe5f4bb98afa41c9670e7097fe1be9b323b2c061742a2c026ea710ff294a3b169085fecdb417beb95ac3

memory/2640-10-0x0000000074470000-0x0000000074B5E000-memory.dmp

memory/2640-12-0x0000000000C00000-0x0000000000C2E000-memory.dmp

memory/1812-11-0x0000000074470000-0x0000000074B5E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0EPIBWDmBjQw.bat

MD5 3be8d4a1fd7a726dfa34a9566cad25db
SHA1 2f3bbc1db68b662572bd4f0130225bd60f79363a
SHA256 04d97a0f0230637e659531ec71875766b92445fd491ac4bc621b0b782a4f9b8b
SHA512 4d423109524fa9894205444cf465caa3ff47a53655ecdbc4d46e3625286e667b400798e6ac9e28a4ee0b07f8dc75df137b1898673730de0cde7d71fc1c5669c3

memory/2976-30-0x0000000074470000-0x0000000074B5E000-memory.dmp

memory/2976-31-0x0000000074470000-0x0000000074B5E000-memory.dmp

memory/2640-32-0x0000000074470000-0x0000000074B5E000-memory.dmp

memory/2640-33-0x0000000004940000-0x0000000004980000-memory.dmp