quasar | 1bfb2dc7443c52100097ab60a0974f29c146503a941d6d1775efe9ff8f120c97

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 14:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
Size 1.4MB
Sample240404-r79vvaae9w
SHA256 1bfb2dc7443c52100097ab60a0974f29c146503a941d6d1775efe9ff8f120c97
MD5 bb27b01d9b62ebf119188334800da221
SHA1 2824178425e8d139f3254a10bd44589d5ea36b20
SHA512 3ab66310d8909daac270fa93cd4435bb2d5dc3232311d482c1677bca50984a5ff8ff8f63f05d92e09475706cdd6d1b53878b08de0c4d163083f9d08cb1a4da5e
SSDEEP 24576:mSSgTVF85TFDZDsIFmtaHTmLv5DI3LZr9bdWOLvRxCPbGG:mTzTkIFVzmL5kLZldlN8iG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar brod persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

BROD

sommerishere.sytes.net:61537
ommerishere.sytes.net:61537

Mutex

QSR_MUTEX_HblVPifA3qZwz1UNVx

Attributes

encryption_key
qEMtrXI36duggEwkopaa
install_name
Updater.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
Windows

Signatures

Quasar RAT 3 IoCs

Quasar is an open source Remote Access Tool.

trojan spyware quasar

flow	ioc	pid	Process
		4404	PING.EXE
41	ip-api.com		Process not Found
55	ip-api.com		Process not Found

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4984-10-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cssr = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\cssr\\cssr.exe\""	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cssr = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\cssr\\cssr.exe\""	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cssr = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\cssr\\cssr.exe\""	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
41	ip-api.com
55	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4584 set thread context of 4984	4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	96
PID 1056 set thread context of 4324	1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	106
PID 1476 set thread context of 4928	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4372	4984	WerFault.exe	96
4748	4324	WerFault.exe	106
2888	4928	WerFault.exe	116

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
4404	PING.EXE
5068	PING.EXE
1908	PING.EXE

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
Token: SeDebugPrivilege	4984	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
Token: SeDebugPrivilege	1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
Token: SeDebugPrivilege	4324	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
Token: SeDebugPrivilege	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
Token: SeDebugPrivilege	4928	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4984	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
4324	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
4928	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 3484	4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	95
PID 4584 wrote to memory of 3484	4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	95
PID 4584 wrote to memory of 3484	4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	95
PID 4584 wrote to memory of 4984	4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	96
PID 4584 wrote to memory of 4984	4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	96
PID 4584 wrote to memory of 4984	4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	96
PID 4584 wrote to memory of 4984	4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	96
PID 4584 wrote to memory of 4984	4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	96
PID 4584 wrote to memory of 4984	4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	96
PID 4584 wrote to memory of 4984	4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	96
PID 4584 wrote to memory of 4984	4584	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	96
PID 4984 wrote to memory of 816	4984	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	97
PID 4984 wrote to memory of 816	4984	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	97
PID 4984 wrote to memory of 816	4984	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	97
PID 816 wrote to memory of 4728	816	cmd.exe	101
PID 816 wrote to memory of 4728	816	cmd.exe	101
PID 816 wrote to memory of 4728	816	cmd.exe	101
PID 816 wrote to memory of 4404	816	cmd.exe	102
PID 816 wrote to memory of 4404	816	cmd.exe	102
PID 816 wrote to memory of 4404	816	cmd.exe	102
PID 816 wrote to memory of 1056	816	cmd.exe	104
PID 816 wrote to memory of 1056	816	cmd.exe	104
PID 816 wrote to memory of 1056	816	cmd.exe	104
PID 1056 wrote to memory of 4600	1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	105
PID 1056 wrote to memory of 4600	1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	105
PID 1056 wrote to memory of 4600	1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	105
PID 1056 wrote to memory of 4324	1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	106
PID 1056 wrote to memory of 4324	1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	106
PID 1056 wrote to memory of 4324	1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	106
PID 1056 wrote to memory of 4324	1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	106
PID 1056 wrote to memory of 4324	1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	106
PID 1056 wrote to memory of 4324	1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	106
PID 1056 wrote to memory of 4324	1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	106
PID 1056 wrote to memory of 4324	1056	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	106
PID 4324 wrote to memory of 4624	4324	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	107
PID 4324 wrote to memory of 4624	4324	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	107
PID 4324 wrote to memory of 4624	4324	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	107
PID 4624 wrote to memory of 3884	4624	cmd.exe	111
PID 4624 wrote to memory of 3884	4624	cmd.exe	111
PID 4624 wrote to memory of 3884	4624	cmd.exe	111
PID 4624 wrote to memory of 5068	4624	cmd.exe	112
PID 4624 wrote to memory of 5068	4624	cmd.exe	112
PID 4624 wrote to memory of 5068	4624	cmd.exe	112
PID 4624 wrote to memory of 1476	4624	cmd.exe	113
PID 4624 wrote to memory of 1476	4624	cmd.exe	113
PID 4624 wrote to memory of 1476	4624	cmd.exe	113
PID 1476 wrote to memory of 3944	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	114
PID 1476 wrote to memory of 3944	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	114
PID 1476 wrote to memory of 3944	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	114
PID 1476 wrote to memory of 592	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	115
PID 1476 wrote to memory of 592	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	115
PID 1476 wrote to memory of 592	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	115
PID 1476 wrote to memory of 4928	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	116
PID 1476 wrote to memory of 4928	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	116
PID 1476 wrote to memory of 4928	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	116
PID 1476 wrote to memory of 4928	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	116
PID 1476 wrote to memory of 4928	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	116
PID 1476 wrote to memory of 4928	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	116
PID 1476 wrote to memory of 4928	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	116
PID 1476 wrote to memory of 4928	1476	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	116
PID 4928 wrote to memory of 3052	4928	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	117
PID 4928 wrote to memory of 3052	4928	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	117
PID 4928 wrote to memory of 3052	4928	bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe	117
PID 3052 wrote to memory of 4260	3052	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
  2⤵
  PID:3484
- C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WxRnvwcowdb4.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:4728
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Quasar RAT
      Runs ping.exe
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe"
      4⤵
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4324
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vFHo0MdJ3mI4.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe"
        7⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
        8⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
        8⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
        
        C:\Users\Admin\AppData\Local\Temp\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe
        8⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XdmR5rYL0NpH.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:1908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 1968
        9⤵
        Program crash
        
        PID:2888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 2232
        6⤵
        Program crash
        
        PID:4748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 2244
    3⤵
    - Program crash
    PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4984 -ip 4984
1⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4324 -ip 4324
1⤵
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4928 -ip 4928
1⤵
PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bb27b01d9b62ebf119188334800da221_JaffaCakes118.exe.log
Size 701B
SHA256 364123cc7acd0e2904f0fb507139b211f587364654fc66a61a2772ff156e6eae
MD5 18bac70b62088318394848d9f81c3f5e
SHA1 2a047886bbbb4be47ca8c8f2f7b243055b5f3fa2
SHA512 28e980a3d2c65ea8fd7e1e3b5aeb75384dd1430296257258a4ed1e81cb84fe8a4184a7e5d1c44bf77a4bb8f60f40553c3e3b187b8c99d2bc0660fb208f225c71
MD5 SHA1 SHA512

Submit Download

WxRnvwcowdb4.bat

Path C:\Users\Admin\AppData\Local\Temp\WxRnvwcowdb4.bat
Size 243B
SHA256 cceb99f8dfd7f196a6e58819b5a9f531255260274e101c8690c7e6b74d9aa218
MD5 390de0c9429c8313bd56b189904b24db
SHA1 38a48fde4a71506e2bdb15ecaf371647eeb60c77
SHA512 6999d8cccea385878bd302a1cee7a803ab64fc4e9711aad0722a110a85f6a1e316828b594409fde2a8000f1b9fe22dfec43c724660db61b3e674b0a347d473b1
MD5 SHA1 SHA512

Submit Download

XdmR5rYL0NpH.bat

Path C:\Users\Admin\AppData\Local\Temp\XdmR5rYL0NpH.bat
Size 243B
SHA256 e2d921ef70b4bb112d12735fb4a18f338779b4a3b5b68437b1592b581c37c46e
MD5 0cb206865b1e19894284ceed81fd3aea
SHA1 3db786aea352975461c482da79a9a180520a6337
SHA512 4c52c2d1aeda0a3a638f6bdfafc9ebf03852ba534c20d720e76610df1fa2c5bc82c8a45650a0755dcf3ec89fd7ad8a407aa8d61ce47c9d7f1582d89f6462615f
MD5 SHA1 SHA512

Submit Download

vFHo0MdJ3mI4.bat

Path C:\Users\Admin\AppData\Local\Temp\vFHo0MdJ3mI4.bat
Size 243B
SHA256 b6b21a97e7d12fc1103f5538841ade4abcc0b897a21dcd9cf05e429b640a70ac
MD5 a26338ed843c33e84b865105f02c61c0
SHA1 9f433f5badef05c1db2211bbd8bd7a72eba1625f
SHA512 5bbe9e7c701b67d51b325ddcec138aeb1804cea4753eb30458e8b9058cb2bed4980ece78b18c5ef46a0af6fcfca90be1bd7345e7325a2751f52f3a947899cd82
MD5 SHA1 SHA512

Submit Download

04-04-2024

Path C:\Users\Admin\AppData\Roaming\Logs\04-04-2024
Size 224B
SHA256 733f6ac4e1930ba072891b0144e2011e6fec8c483a91e5c3c6814415cb739f26
MD5 896a3320dfc9d851e47488ab4fd48382
SHA1 5b849c3c58ec7aca8dc66442613171655ae11e30
SHA512 317b908aafaaefbb6c4d8f043badaa30c1a7916f411fb4047e5b1428dc2c2ce710a1289ed8af935d29b035f41e045debcacafbc616186745ef51442b94a42923
MD5 SHA1 SHA512

Submit Download

memory/1056-31-0x00000000749C0000-0x0000000075170000-memory.dmp

Download

memory/1056-27-0x0000000003060000-0x0000000003070000-memory.dmp

Download

memory/1056-26-0x00000000749C0000-0x0000000075170000-memory.dmp

Download

memory/1056-25-0x00000000749C0000-0x0000000075170000-memory.dmp

Download

memory/1476-41-0x00000000749C0000-0x0000000075170000-memory.dmp

Download

memory/1476-46-0x00000000749C0000-0x0000000075170000-memory.dmp

Download

memory/1476-42-0x0000000004C00000-0x0000000004C10000-memory.dmp

Download

memory/1476-40-0x00000000749C0000-0x0000000075170000-memory.dmp

Download

memory/4324-32-0x00000000749C0000-0x0000000075170000-memory.dmp

Download

memory/4324-39-0x00000000749C0000-0x0000000075170000-memory.dmp

Download

memory/4584-7-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Download

memory/4584-13-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/4584-0-0x0000000000540000-0x00000000006A2000-memory.dmp

Download

memory/4584-9-0x0000000005B10000-0x0000000005B4E000-memory.dmp

Download

memory/4584-6-0x0000000005620000-0x0000000005686000-memory.dmp

Download

memory/4584-5-0x0000000005B60000-0x0000000006104000-memory.dmp

Download

memory/4584-4-0x0000000005510000-0x00000000055A2000-memory.dmp

Download

memory/4584-3-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/4584-2-0x0000000004FF0000-0x00000000050E8000-memory.dmp

Download

memory/4584-1-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/4928-47-0x00000000749C0000-0x0000000075170000-memory.dmp

Download

memory/4928-48-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Download

memory/4928-55-0x00000000749C0000-0x0000000075170000-memory.dmp

Download

memory/4984-10-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4984-24-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/4984-19-0x0000000006F80000-0x0000000006F8A000-memory.dmp

Download

memory/4984-17-0x0000000006C00000-0x0000000006C3C000-memory.dmp

Download

memory/4984-16-0x0000000006580000-0x0000000006592000-memory.dmp

Download

memory/4984-15-0x0000000005990000-0x00000000059A0000-memory.dmp

Download

memory/4984-14-0x0000000074920000-0x00000000750D0000-memory.dmp

Download