Analysis

  • max time kernel
    145s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    08-04-2024 08:08

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    43d43e073f37fcbce4db2a8efea58450

  • SHA1

    24014a045dfda1401b81e63435fdf46963967fd4

  • SHA256

    e4c6e99ac6e6ddb98b3f0fea20d97c067b593ffdce6d2909ff693d03868e605b

  • SHA512

    9c8ca9dee9c24431ea98ce9743cf826b5ba844c339b0cc94ef4261af68f2bf89b7251e1884011e8ff58be5afbebe98b699a243d1cacf83272018baac439ca9bf

  • SSDEEP

    49152:3v1t62XlaSFNWPjljiFa2RoUYI4xDEDwNk/JxSoGdk+THHB72eh2NT:3vH62XlaSFNWPjljiFXRoUYI4xWQU

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

IPv4:4782

Mutex

865ecc2b-abfd-4e2c-92cb-d87fb0c27dfe

Attributes
  • encryption_key

    4EC818ABEB58692E09D25328E09F987FEC20E0DF

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 6 IoCs
  • Executes dropped EXE 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 13 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:2860
    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Windows\system32\schtasks.exe
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:2584
      • C:\Windows\system32\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Ag7RosmhjHvA.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2408
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:2164
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            4⤵
            • Runs ping.exe
            PID:2440
          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
            "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2404
            • C:\Windows\system32\schtasks.exe
              "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
              5⤵
              • Creates scheduled task(s)
              PID:2784
            • C:\Windows\system32\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\Ps7FYjZLdHoq.bat" "
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:344
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:1616
                • C:\Windows\system32\PING.EXE
                  ping -n 10 localhost
                  6⤵
                  • Runs ping.exe
                  PID:1504
                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2308
                  • C:\Windows\system32\schtasks.exe
                    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                    7⤵
                    • Creates scheduled task(s)
                    PID:2692
                  • C:\Windows\system32\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\eMuzochL1ULn.bat" "
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1212
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      8⤵
                        PID:1800
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        8⤵
                        • Runs ping.exe
                        PID:1660
                      • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1864
                        • C:\Windows\system32\schtasks.exe
                          "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                          9⤵
                          • Creates scheduled task(s)
                          PID:1464
                        • C:\Windows\system32\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\lXMkkZMFQC7E.bat" "
                          9⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3028
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            10⤵
                              PID:2224
                            • C:\Windows\system32\PING.EXE
                              ping -n 10 localhost
                              10⤵
                              • Runs ping.exe
                              PID:1084
                            • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                              "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                              10⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              PID:1148
                              • C:\Windows\system32\schtasks.exe
                                "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                11⤵
                                • Creates scheduled task(s)
                                PID:1516
                              • C:\Windows\system32\cmd.exe
                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\YysqV1BWNefK.bat" "
                                11⤵
                                  PID:2144
                                  • C:\Windows\system32\chcp.com
                                    chcp 65001
                                    12⤵
                                      PID:784
                                    • C:\Windows\system32\PING.EXE
                                      ping -n 10 localhost
                                      12⤵
                                      • Runs ping.exe
                                      PID:456
                                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                      12⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2888
                                      • C:\Windows\system32\schtasks.exe
                                        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                        13⤵
                                        • Creates scheduled task(s)
                                        PID:2864
                                      • C:\Windows\system32\cmd.exe
                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\4klWBfhPkcin.bat" "
                                        13⤵
                                          PID:2924
                                          • C:\Windows\system32\chcp.com
                                            chcp 65001
                                            14⤵
                                              PID:664
                                            • C:\Windows\system32\PING.EXE
                                              ping -n 10 localhost
                                              14⤵
                                              • Runs ping.exe
                                              PID:924
                                            • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                              "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                              14⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2340
                                              • C:\Windows\system32\schtasks.exe
                                                "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                15⤵
                                                • Creates scheduled task(s)
                                                PID:2260
                                              • C:\Windows\system32\cmd.exe
                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\s8RxB61IVTer.bat" "
                                                15⤵
                                                  PID:900
                                                  • C:\Windows\system32\chcp.com
                                                    chcp 65001
                                                    16⤵
                                                      PID:2216
                                                    • C:\Windows\system32\PING.EXE
                                                      ping -n 10 localhost
                                                      16⤵
                                                      • Runs ping.exe
                                                      PID:3064
                                                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                      16⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1972
                                                      • C:\Windows\system32\schtasks.exe
                                                        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                        17⤵
                                                        • Creates scheduled task(s)
                                                        PID:2080
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\n76Puo8ELHhy.bat" "
                                                        17⤵
                                                          PID:2716
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 65001
                                                            18⤵
                                                              PID:2516
                                                            • C:\Windows\system32\PING.EXE
                                                              ping -n 10 localhost
                                                              18⤵
                                                              • Runs ping.exe
                                                              PID:2472
                                                            • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                              "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                              18⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2600
                                                              • C:\Windows\system32\schtasks.exe
                                                                "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                19⤵
                                                                • Creates scheduled task(s)
                                                                PID:2160
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\L6FqclHmcAV9.bat" "
                                                                19⤵
                                                                  PID:2380
                                                                  • C:\Windows\system32\chcp.com
                                                                    chcp 65001
                                                                    20⤵
                                                                      PID:2552
                                                                    • C:\Windows\system32\PING.EXE
                                                                      ping -n 10 localhost
                                                                      20⤵
                                                                      • Runs ping.exe
                                                                      PID:2320
                                                                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                                      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                                      20⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:1740
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                        21⤵
                                                                        • Creates scheduled task(s)
                                                                        PID:2276
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\CZfHO9YT2IIk.bat" "
                                                                        21⤵
                                                                          PID:2332
                                                                          • C:\Windows\system32\chcp.com
                                                                            chcp 65001
                                                                            22⤵
                                                                              PID:2192
                                                                            • C:\Windows\system32\PING.EXE
                                                                              ping -n 10 localhost
                                                                              22⤵
                                                                              • Runs ping.exe
                                                                              PID:2180
                                                                            • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                                              "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                                              22⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of SendNotifyMessage
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1648
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                23⤵
                                                                                • Creates scheduled task(s)
                                                                                PID:2564
                                                                              • C:\Windows\system32\cmd.exe
                                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\UZjXizOEhkwd.bat" "
                                                                                23⤵
                                                                                  PID:1212
                                                                                  • C:\Windows\system32\chcp.com
                                                                                    chcp 65001
                                                                                    24⤵
                                                                                      PID:1604
                                                                                    • C:\Windows\system32\PING.EXE
                                                                                      ping -n 10 localhost
                                                                                      24⤵
                                                                                      • Runs ping.exe
                                                                                      PID:1464
                                                                                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                                                      24⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:1948
                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                        25⤵
                                                                                        • Creates scheduled task(s)
                                                                                        PID:1552
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\E5obhvPzWCN8.bat" "
                                                                                        25⤵
                                                                                          PID:624
                                                                                          • C:\Windows\system32\chcp.com
                                                                                            chcp 65001
                                                                                            26⤵
                                                                                              PID:1784
                                                                                            • C:\Windows\system32\PING.EXE
                                                                                              ping -n 10 localhost
                                                                                              26⤵
                                                                                              • Runs ping.exe
                                                                                              PID:2104

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Temp\4klWBfhPkcin.bat

                                            Filesize

                                            207B

                                            MD5

                                            c19bff39f1a90ac50216678d5d6ec352

                                            SHA1

                                            8fd3aba7c1ab7b08e5cadc8263f4b79d35027c0f

                                            SHA256

                                            1e5050a3fa4efd9055cabdb95d685613ead61cce7186f4176df08ae0e3e3ad1c

                                            SHA512

                                            ac62c026679b57f4cdc7837107e8f88653982a982f3406e0443468211da88648de7715481248d448e8e75cf80011c32cc8a4343cd6ff0a86f943b2693ac1d74a

                                          • C:\Users\Admin\AppData\Local\Temp\Ag7RosmhjHvA.bat

                                            Filesize

                                            207B

                                            MD5

                                            a59eff0476167bc5b4d1a3a020fa277c

                                            SHA1

                                            f450d556334c179a8330310d4186514f76d0fc30

                                            SHA256

                                            64ad06dc7383f0690467a9cca85b2e37f5adfae0ff968a645af28f345407f270

                                            SHA512

                                            8079e4c0e4d6085010d7ed84249ebdab0b9323630e351494f269daa9f5f50c001d587158f9532432e9dfba29bc9f86e0a5b8640da829dec8ce408bb53c476c13

                                          • C:\Users\Admin\AppData\Local\Temp\CZfHO9YT2IIk.bat

                                            Filesize

                                            207B

                                            MD5

                                            975e2bab28cad418e98922384e35d859

                                            SHA1

                                            bf67923cd864d823f086dc5f7b36660ceeb6c935

                                            SHA256

                                            56f125ebd0b70f179d830fed8ecbbd7f068a1cb39ebd973e0e7391ea8be9877a

                                            SHA512

                                            d981abe427f1ca0485b5bff4a4ec35bedcd028cdc14e85b9642cc90324bcdef45680e985c5c76cf8f7dc94c520c46ffc6d1cc64f84a8732fc6f19f922b26d3fa

                                          • C:\Users\Admin\AppData\Local\Temp\E5obhvPzWCN8.bat

                                            Filesize

                                            207B

                                            MD5

                                            e8252b1f2b0a7990e6a1814ad6ddf292

                                            SHA1

                                            8669f12399063b881aca17631f4af7d2ab0a5e63

                                            SHA256

                                            f8871dd3bc28dd9f561194202527a15abf8d02c4b020ce7d247aa001c8334a34

                                            SHA512

                                            fcefc9949ed544ab855fa466da58a2c0113e2ad8bb6946acd812f1d4d0aafb2b2bff84d471b7e4095641c06d3a3390cea6cccdeadddc50ff904238a0eb8ae6c5

                                          • C:\Users\Admin\AppData\Local\Temp\L6FqclHmcAV9.bat

                                            Filesize

                                            207B

                                            MD5

                                            1c9fb7293f87b6f984f5c60550bf53fb

                                            SHA1

                                            37f58e8944de488bccd790fb61b99610da693bf6

                                            SHA256

                                            a23fe5d1be5d99a9ae8f26bf8ae464ad953f629baac977632bf7c67534596770

                                            SHA512

                                            523065249067a1f0363342876401571ad3829bac809b7a7eda62d0c59a2ccb0386b49bf1920c5fdb36ee705913ad215a1f8ac8e15ea4e32dbeadb1d38fba9bfa

                                          • C:\Users\Admin\AppData\Local\Temp\Ps7FYjZLdHoq.bat

                                            Filesize

                                            207B

                                            MD5

                                            a4f2bef145460860066d6d60522c27a6

                                            SHA1

                                            ae4ed931348147c041b1708c3cbe2f4bfaff4ceb

                                            SHA256

                                            44406f3a923c1f181ca29e0780ca47c4f366de4b35ff2e649c781c8e0a2afc03

                                            SHA512

                                            91128395d3ce7e695c49c5b989aaa92795353bf0dc41566043359a0d63ad3902151e63356c7bee352120c95dbccede6163f76f9a8ccfa00999d8d8ca9c7d6371

                                          • C:\Users\Admin\AppData\Local\Temp\UZjXizOEhkwd.bat

                                            Filesize

                                            207B

                                            MD5

                                            875fc53972024bc746dceac7e6829724

                                            SHA1

                                            cc2d325949e5d383bdbd3775cd0ec64060d3cf25

                                            SHA256

                                            d028ec8c759422969e1d98414724c12358adfba77d5cd56bb8a7aff7a6066d9b

                                            SHA512

                                            a3561d53dbe8338d15756ea2648e8b02045261994b20407946cc73a1ac23e7e2ddf18f1fbfd70278d32986be195b12a0bf6396a3bd51382b6b62b5888b0fc5e3

                                          • C:\Users\Admin\AppData\Local\Temp\YysqV1BWNefK.bat

                                            Filesize

                                            207B

                                            MD5

                                            a965a673c66c7569d3e14626d02349e4

                                            SHA1

                                            7798ae0bb352220f27e8d15b169c9cdec6b04a1d

                                            SHA256

                                            8740d93c9c1d0b8d02cea73ef95d82a157b521af92d54c6ac64d6861b4a03923

                                            SHA512

                                            da5bbc497267526b080ac98cb667800dbcc440ee2da7849e368067d3f475664aafadb9ab997ebc9c8f27059f857b0c27725e369a18f4f22b28fdecd09f588bfb

                                          • C:\Users\Admin\AppData\Local\Temp\eMuzochL1ULn.bat

                                            Filesize

                                            207B

                                            MD5

                                            243a8ffc4c0ff1c27dbe42d976cb2f71

                                            SHA1

                                            c6752a0e6c7a1c7d7f2e583a642394e6617916ec

                                            SHA256

                                            c9c3424822b412617d41177adc07b5a670608aa8bd12938858497ee2ee7adbed

                                            SHA512

                                            1f4ab8e91e2cd654ea7e4551240e69dbe3281ce24825610ecff4739db3d431998380c30f6b3839495f98f773a9dcd44a627a24ee8dc6e347d6fcb3069963982c

                                          • C:\Users\Admin\AppData\Local\Temp\lXMkkZMFQC7E.bat

                                            Filesize

                                            207B

                                            MD5

                                            fa363f439834d9f8d364722f51344a3c

                                            SHA1

                                            ea2ce55bfd1a0364998d9b65b3a40f6baf55eb1d

                                            SHA256

                                            9fcd18fe13b1c49b94e8d4e1d03052c944a5e99ace4c29d1e8e5bf16d55f4cfe

                                            SHA512

                                            cf65fece60d87b4592e84ccaa65c6209888f8a0e559fe3d71b76839a0309dd52779f67e6408f3b077c20aeb48bc5476b0c1f42cd0d1551f1e47ea7beb6353a96

                                          • C:\Users\Admin\AppData\Local\Temp\n76Puo8ELHhy.bat

                                            Filesize

                                            207B

                                            MD5

                                            be6828338d5c68ce1e30d5ef4e45c2d8

                                            SHA1

                                            f2b330f6f356977dad8e9f9e69f2241bc910fd78

                                            SHA256

                                            d006be4db3c01670a3eefd531d78cd376691eba3834c8485ca08a5bb601881a6

                                            SHA512

                                            1b657bf57cbb84721377114efb7645aac867c945aace5d28bef8e75b8bfe419d16683f45117068beb7af376aa1ba328b8c38c35adde91d90dddc6aa262289853

                                          • C:\Users\Admin\AppData\Local\Temp\s8RxB61IVTer.bat

                                            Filesize

                                            207B

                                            MD5

                                            87960fb5a69bbf35be1f0693918e2cd1

                                            SHA1

                                            74bce7ef7341e729ebb426dc355b7a0007d5d9c7

                                            SHA256

                                            6dc49b5b8fcddaeab0dbcc750067c145fd7ce2e1ff006639e9a7b8c34fc54762

                                            SHA512

                                            965381383267cc0e37eb2b7c911f1d913f84752d12bbb91d7625b644ebff45c56e0751636ee7fec4e6da761416cd74a1a2fdb38e61145459b3a722bd31e1dcf9

                                          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

                                            Filesize

                                            3.1MB

                                            MD5

                                            43d43e073f37fcbce4db2a8efea58450

                                            SHA1

                                            24014a045dfda1401b81e63435fdf46963967fd4

                                            SHA256

                                            e4c6e99ac6e6ddb98b3f0fea20d97c067b593ffdce6d2909ff693d03868e605b

                                            SHA512

                                            9c8ca9dee9c24431ea98ce9743cf826b5ba844c339b0cc94ef4261af68f2bf89b7251e1884011e8ff58be5afbebe98b699a243d1cacf83272018baac439ca9bf

                                          • \??\PIPE\srvsvc

                                            MD5

                                            d41d8cd98f00b204e9800998ecf8427e

                                            SHA1

                                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                                            SHA256

                                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                            SHA512

                                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                          • memory/1148-74-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/1148-65-0x000000001B020000-0x000000001B0A0000-memory.dmp

                                            Filesize

                                            512KB

                                          • memory/1148-64-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/1648-154-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/1648-144-0x000000001AF60000-0x000000001AFE0000-memory.dmp

                                            Filesize

                                            512KB

                                          • memory/1648-143-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/1740-141-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/1740-130-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/1740-131-0x000000001B390000-0x000000001B410000-memory.dmp

                                            Filesize

                                            512KB

                                          • memory/1864-50-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/1864-49-0x00000000013D0000-0x00000000016F4000-memory.dmp

                                            Filesize

                                            3.1MB

                                          • memory/1864-61-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/1864-51-0x000000001B3A0000-0x000000001B420000-memory.dmp

                                            Filesize

                                            512KB

                                          • memory/1948-169-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/1948-157-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/1948-156-0x00000000001F0000-0x0000000000514000-memory.dmp

                                            Filesize

                                            3.1MB

                                          • memory/1948-158-0x000000001B1B0000-0x000000001B230000-memory.dmp

                                            Filesize

                                            512KB

                                          • memory/1972-103-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/1972-114-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/1972-104-0x000000001B4E0000-0x000000001B560000-memory.dmp

                                            Filesize

                                            512KB

                                          • memory/2036-0-0x0000000000F40000-0x0000000001264000-memory.dmp

                                            Filesize

                                            3.1MB

                                          • memory/2036-7-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/2036-2-0x000000001B160000-0x000000001B1E0000-memory.dmp

                                            Filesize

                                            512KB

                                          • memory/2036-1-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/2308-36-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/2308-46-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/2308-37-0x0000000000490000-0x0000000000510000-memory.dmp

                                            Filesize

                                            512KB

                                          • memory/2340-91-0x000000001B3C0000-0x000000001B440000-memory.dmp

                                            Filesize

                                            512KB

                                          • memory/2340-101-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/2340-90-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/2404-24-0x0000000000C90000-0x0000000000D10000-memory.dmp

                                            Filesize

                                            512KB

                                          • memory/2404-33-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/2404-22-0x0000000000E10000-0x0000000001134000-memory.dmp

                                            Filesize

                                            3.1MB

                                          • memory/2404-23-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/2600-116-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/2600-117-0x000000001B210000-0x000000001B290000-memory.dmp

                                            Filesize

                                            512KB

                                          • memory/2600-127-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/2888-87-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/2888-77-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/2888-78-0x000000001B280000-0x000000001B300000-memory.dmp

                                            Filesize

                                            512KB

                                          • memory/2968-20-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/2968-10-0x000000001AC90000-0x000000001AD10000-memory.dmp

                                            Filesize

                                            512KB

                                          • memory/2968-8-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

                                            Filesize

                                            9.9MB

                                          • memory/2968-9-0x0000000000A90000-0x0000000000DB4000-memory.dmp

                                            Filesize

                                            3.1MB