Analysis
-
max time kernel
3s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 19:59
Behavioral task
behavioral1
Sample
4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe
Resource
win10v2004-20240226-en
General
-
Target
4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe
-
Size
2.0MB
-
MD5
5c0df4a7294cacdab88a72ffa4ba72e3
-
SHA1
f9f097e6976cf0d6376a2fcad99db5355dcffa18
-
SHA256
4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b
-
SHA512
9b07a660d1037d444f6e370bbe481a33dcc572aeb0388fd8a6bb3403335a1ab9e9d40d5decfef9102c809115153276721e25ceb2c8aa736f406dc8fd32cbdeab
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYW:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YQ
Malware Config
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Extracted
azorult
http://0x21.in:8000/_az/
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 8 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar behavioral2/memory/3804-26-0x0000000000A90000-0x0000000000AEE000-memory.dmp family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar -
Detects Windows executables referencing non-Windows User-Agents 8 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3804-26-0x0000000000A90000-0x0000000000AEE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables containing common artifacts observed in infostealers 8 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_GENInfoStealer C:\Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_GENInfoStealer behavioral2/memory/3804-26-0x0000000000A90000-0x0000000000AEE000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe INDICATOR_SUSPICIOUS_GENInfoStealer C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe INDICATOR_SUSPICIOUS_GENInfoStealer C:\Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_GENInfoStealer C:\Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_GENInfoStealer C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe INDICATOR_SUSPICIOUS_GENInfoStealer -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe -
Executes dropped EXE 2 IoCs
Processes:
vnc.exewindef.exepid process 1420 vnc.exe 3804 windef.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exedescription ioc process File opened (read-only) \??\a: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\e: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\g: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\j: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\v: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\p: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\s: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\u: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\y: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\b: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\h: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\i: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\k: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\m: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\n: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\t: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\z: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\l: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\o: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\q: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\r: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\w: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe File opened (read-only) \??\x: 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ip-api.com -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exedescription pid process target process PID 2100 set thread context of 1328 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4356 1420 WerFault.exe vnc.exe 2828 3576 WerFault.exe vnc.exe 1632 4964 WerFault.exe winsock.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3924 schtasks.exe 3596 schtasks.exe 2532 schtasks.exe 4496 schtasks.exe 4540 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exepid process 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
windef.exedescription pid process Token: SeDebugPrivilege 3804 windef.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exevnc.exedescription pid process target process PID 2100 wrote to memory of 1420 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe vnc.exe PID 2100 wrote to memory of 1420 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe vnc.exe PID 2100 wrote to memory of 1420 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe vnc.exe PID 2100 wrote to memory of 3804 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe windef.exe PID 2100 wrote to memory of 3804 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe windef.exe PID 2100 wrote to memory of 3804 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe windef.exe PID 1420 wrote to memory of 4420 1420 vnc.exe svchost.exe PID 1420 wrote to memory of 4420 1420 vnc.exe svchost.exe PID 1420 wrote to memory of 4420 1420 vnc.exe svchost.exe PID 2100 wrote to memory of 1328 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe PID 2100 wrote to memory of 1328 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe PID 2100 wrote to memory of 1328 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe PID 2100 wrote to memory of 1328 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe PID 2100 wrote to memory of 1328 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe PID 2100 wrote to memory of 2532 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe schtasks.exe PID 2100 wrote to memory of 2532 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe schtasks.exe PID 2100 wrote to memory of 2532 2100 4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe"C:\Users\Admin\AppData\Local\Temp\4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 5483⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uGMzgdNxgLPR.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 22484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe"C:\Users\Admin\AppData\Local\Temp\4d76ac906021bbc02781841d340f03eaae289d58ce4ed1457e5b539717afb30b.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1420 -ip 14201⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 5203⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3576 -ip 35761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4964 -ip 49641⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.logFilesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
C:\Users\Admin\AppData\Local\Temp\uGMzgdNxgLPR.batFilesize
208B
MD548025b23267574e2f9c6a3bc34d80426
SHA17d26cfd137aba8911dcbf953baee67a984fffe8d
SHA256ed6e7f5952f22a6f6d66aa1bacfc9285394cee708bf49ac24598f17257d13c02
SHA512bde1df50bd0a646555a35d47174403c5ed23bb85513c115f1219d4e19d0482455496ef38ed0d1ad03d4bbfa654b05c7e93ed5effa8146a173ca5a96ea91442a5
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
313KB
MD5eee7f966ba589b70604495c2fa56a19d
SHA1a63d10708c5060190aa7786ad4318b198878e82f
SHA25605b51afec2a127e94f28dbe8b2e4e91fc7c3f936953ee6e0ae777cd3fe69ffa1
SHA512233618d80dd8d58fec1445871c65982bea4ba40921b49d1d5acac010dccee249a4825345209decd52fe21b714fc3dd6f04601f0cc47f50b814059f94dc7d83db
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
29KB
MD5d8d3cee32ad434a9b56883cc1508f53c
SHA1aca7265f24f42056ace6c1420b3c1e37d5cc3d05
SHA25663f239f07baf0a72523dc8bea06b407d879a5195170f80ee610e44b80d9d2dd5
SHA5128a87e936a4f3be599646febbdd8e863a15fef984c36b29995e7ec914aaa3d0425a5883a27f04fa78e04556e7c6b67a177fdfbf23fe3f10a3e82da303552d82bd
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
213KB
MD5a6745dbe1e0fd432a4fb5c6a25603057
SHA1908bfaebdbb38d79d4814d789a3fcbc7aceffc35
SHA256e1baa6b409ad0365421bab33b6a4770584a9d1e98584a9e62c1c2b0a5acaa4ee
SHA512458be042f649c1a324ce490d04815b0e71712f3d2a639f94c8609433238d0bfdb7e75bb1e3c7288d188f9cf7ace105d2d6ec1e92d543e29c1e0e3a6f4c794444
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
47KB
MD5e3003c545b2650ceac01b94547e6adb9
SHA1bde4126fc060e2938240eac6db18a08d4a8f0979
SHA256ad7efe1757410a9b09490e9e80b30ada78baf00638c785b888646de6bd8c330f
SHA5125ec6e1276af5bd766d6452890bf66a9484ad34f0cd366eed2fad9f97c537eaf653f4115e2aa445974b461e6695556cc99847535214845d1ed8a71d5d4df8d0d0
-
C:\Users\Admin\AppData\Roaming\Logs\03-19-2024Filesize
224B
MD551f95458e402df51098c260f4c5694e5
SHA1d83bbaead0a5a1ee99957914e7f86fc1c67e1713
SHA256cfe636bbc49b755fcb29053bb324c552192dcafa6e98649c5e051cd896ee19c7
SHA512851d549c5690b1a2e622872dd80e99326403b0593e2d6c32c691a38fe1c3abc095826a25acf5469978a404597bbcdd862ac6763fe7c006e0d026ae08af4d1366
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
1.6MB
MD53bc88002ee0c6dc3678d75e34faa7068
SHA1e67113f376936b7e975c4d40c745c7d4cfefee2d
SHA2569e16f307d052dfb5af1d3634a8913a24dcf37e756f8f002dbe1e215435ddcd46
SHA512d6c0a363be71ae45607b60273344c824d24c011c5a7174994a8202a8d33540e9eba8d9906cb806962eab1bf23daf6f1b7cfbd54c01d27b3335212dfd6ac6a6d7
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
922KB
MD5225611c9ffc13c80257e8b4e76515d40
SHA10c9147e25ad7fa6b668cb469ba671668f2c13940
SHA256368586103c38883079c0da26a55a885da79716dfc05e4592d4b2840423e17b01
SHA512c0a5afed9b59542f81798109de38b11805be4e8b0d4b4c3ae152bbd4d9df61a891a0acd851333f0c3e22c4ad0c57067741b44324aa2ee0ad4ecc26cc06dc982b
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD50c8614efc1ec5166f64059e5ec975248
SHA19c2ed3650487d2d2ff729432c41428038529d379
SHA2562bce199386e67a0a69f1fabc18ea3cc53ca77aba14fc4fb03f1debdf7d014813
SHA512b233212550bf4b477bb2874144a7fcc87d911a081cc054dc2904c50ccca38c4d2cfae0f5317b2d2ebe94acfcf558aaa3865ecb07ec875013d7f461c36fa8bd9c
-
memory/1328-31-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1328-20-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1556-96-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB
-
memory/1556-95-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/1556-92-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB
-
memory/1556-91-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/2100-19-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/3588-69-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/3588-81-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/3588-70-0x00000000054C0000-0x00000000054D0000-memory.dmpFilesize
64KB
-
memory/3804-36-0x00000000055B0000-0x0000000005616000-memory.dmpFilesize
408KB
-
memory/3804-35-0x0000000005460000-0x0000000005470000-memory.dmpFilesize
64KB
-
memory/3804-30-0x0000000005BE0000-0x0000000006184000-memory.dmpFilesize
5.6MB
-
memory/3804-26-0x0000000000A90000-0x0000000000AEE000-memory.dmpFilesize
376KB
-
memory/3804-32-0x0000000005510000-0x00000000055A2000-memory.dmpFilesize
584KB
-
memory/3804-38-0x0000000006890000-0x00000000068CC000-memory.dmpFilesize
240KB
-
memory/3804-46-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/3804-29-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/3804-37-0x0000000005B90000-0x0000000005BA2000-memory.dmpFilesize
72KB
-
memory/4964-89-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/4964-47-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB
-
memory/4964-45-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/4964-84-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/4964-83-0x0000000006950000-0x000000000695A000-memory.dmpFilesize
40KB