Malware Analysis Report

2024-10-23 21:29

Sample ID 240414-q5j1zaha32
Target Client.exe
SHA256 0aadcb147077d657fd68e222689a25d93c40144d54922c83b4171a5e801235c5
Tags
office04 quasar spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0aadcb147077d657fd68e222689a25d93c40144d54922c83b4171a5e801235c5

Threat Level: Known bad

The file Client.exe was found to be: Known bad.

Malicious Activity Summary

office04 quasar spyware trojan

Quasar family

Quasar RAT

Quasar payload

Checks computer location settings

Executes dropped EXE

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-14 13:50

Signatures

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-14 13:50

Reported

2024-04-14 13:54

Platform

win10-20240404-en

Max time kernel

134s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4296 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4296 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4296 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe
PID 4296 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe
PID 1656 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\SYSTEM32\schtasks.exe
PID 1656 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\SYSTEM32\schtasks.exe
PID 1656 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\SYSTEM32\schtasks.exe
PID 1656 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\SYSTEM32\schtasks.exe
PID 1656 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\system32\cmd.exe
PID 1656 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\system32\cmd.exe
PID 5080 wrote to memory of 4704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 5080 wrote to memory of 4704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 5080 wrote to memory of 4736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 5080 wrote to memory of 4736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Client.exe

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "Windows Boot Menu" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe

"C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "Windows Boot Menu" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe" /rl HIGHEST /f

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /delete /tn "Windows Boot Menu" /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8gXGxH3HWzdY.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\PING.EXE

ping -n 10 localhost

Network

Country Destination Domain Proto
GB 140.238.91.110:34309 tcp
US 8.8.8.8:53 110.91.238.140.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 ipwho.is udp
DE 195.201.57.90:443 ipwho.is tcp
US 8.8.8.8:53 90.57.201.195.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 106.246.116.51.in-addr.arpa udp

Files

memory/4296-0-0x00000000007C0000-0x0000000000AE4000-memory.dmp

memory/4296-1-0x00007FFD6FBC0000-0x00007FFD705AC000-memory.dmp

memory/4296-2-0x000000001B7E0000-0x000000001B7F0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe

MD5 1109da1db2b4175b38ae1bc7c881db9a
SHA1 02b92b5e6aa54ae040bc5cd5e845287be01c9562
SHA256 0aadcb147077d657fd68e222689a25d93c40144d54922c83b4171a5e801235c5
SHA512 44cc1ee0e92159f4d41b4b1c9ae52a7b208b7888c5864795f1e815725d26677e2c7f4fce6410a8cfa8e07c8ee19c3f07f4110c64f1eca62d2f6bbf4cdda8f952

memory/4296-8-0x00007FFD6FBC0000-0x00007FFD705AC000-memory.dmp

memory/1656-9-0x00007FFD6FBC0000-0x00007FFD705AC000-memory.dmp

memory/1656-10-0x000000001AF30000-0x000000001AF40000-memory.dmp

memory/1656-11-0x000000001BBF0000-0x000000001BC40000-memory.dmp

memory/1656-12-0x000000001BD00000-0x000000001BDB2000-memory.dmp

memory/1656-15-0x000000001BC70000-0x000000001BC82000-memory.dmp

memory/1656-16-0x000000001C3F0000-0x000000001C42E000-memory.dmp

memory/1656-17-0x00007FFD6FBC0000-0x00007FFD705AC000-memory.dmp

memory/1656-18-0x000000001AF30000-0x000000001AF40000-memory.dmp

memory/1656-23-0x00007FFD6FBC0000-0x00007FFD705AC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8gXGxH3HWzdY.bat

MD5 f940aa548b2e28d4f5bc893f5f44e6a1
SHA1 79dfdf13de4b2d0164f7b6bc133e878ea0ddf470
SHA256 0a907e37abffb8dc1bc467fe49303d6b9fabaefcce258cf5b737160ed7b2ff78
SHA512 08ff236c12a02f5dc2f4aa61af5bdd5df0c558924e6952eaae5ae943a4548680ef1b87cf53ce3761aa892abe66f9228b6cf8b775cb86533b3ffcd51b6ce3f488

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-14 13:50

Reported

2024-04-14 13:54

Platform

win10v2004-20240412-en

Max time kernel

93s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2316 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\SYSTEM32\schtasks.exe
PID 2316 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\SYSTEM32\schtasks.exe
PID 2316 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe
PID 2316 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe
PID 4536 wrote to memory of 436 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4536 wrote to memory of 436 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4536 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4536 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4536 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\system32\cmd.exe
PID 4536 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\system32\cmd.exe
PID 5004 wrote to memory of 3264 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 5004 wrote to memory of 3264 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 5004 wrote to memory of 1112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 5004 wrote to memory of 1112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Client.exe

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "Windows Boot Menu" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe

"C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "Windows Boot Menu" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe" /rl HIGHEST /f

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /delete /tn "Windows Boot Menu" /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zQetchivhJ7H.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\PING.EXE

ping -n 10 localhost

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
GB 140.238.91.110:34309 tcp
US 8.8.8.8:53 ipwho.is udp
DE 195.201.57.90:443 ipwho.is tcp
US 8.8.8.8:53 110.91.238.140.in-addr.arpa udp
US 8.8.8.8:53 90.57.201.195.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp

Files

memory/2316-0-0x0000000000E90000-0x00000000011B4000-memory.dmp

memory/2316-1-0x00007FFA382A0000-0x00007FFA38D61000-memory.dmp

memory/2316-2-0x000000001C030000-0x000000001C040000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe

MD5 1109da1db2b4175b38ae1bc7c881db9a
SHA1 02b92b5e6aa54ae040bc5cd5e845287be01c9562
SHA256 0aadcb147077d657fd68e222689a25d93c40144d54922c83b4171a5e801235c5
SHA512 44cc1ee0e92159f4d41b4b1c9ae52a7b208b7888c5864795f1e815725d26677e2c7f4fce6410a8cfa8e07c8ee19c3f07f4110c64f1eca62d2f6bbf4cdda8f952

memory/2316-8-0x00007FFA382A0000-0x00007FFA38D61000-memory.dmp

memory/4536-9-0x00007FFA382A0000-0x00007FFA38D61000-memory.dmp

memory/4536-10-0x000000001B4B0000-0x000000001B4C0000-memory.dmp

memory/4536-11-0x000000001C110000-0x000000001C160000-memory.dmp

memory/4536-12-0x000000001C220000-0x000000001C2D2000-memory.dmp

memory/4536-13-0x000000001C180000-0x000000001C192000-memory.dmp

memory/4536-14-0x000000001C1E0000-0x000000001C21C000-memory.dmp

memory/4536-15-0x00007FFA382A0000-0x00007FFA38D61000-memory.dmp

memory/4536-16-0x000000001B4B0000-0x000000001B4C0000-memory.dmp

memory/4536-21-0x00007FFA382A0000-0x00007FFA38D61000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zQetchivhJ7H.bat

MD5 8d802fa906b51673297f3731a5c3c156
SHA1 5697abe42f0f5c4993a2bba594e2ab28212478b3
SHA256 7e2a870bd957452a5b0112ac55753baaacfde3891a6efe3ea905809152b13522
SHA512 2572994767e5dc4061b15d2f67f47cf154e76324df657572ee4b6cff43eb274672012dd0ee0d3337271774e39f87f726a3905a2880019e959cd571e5af384d7b

Analysis: behavioral3

Detonation Overview

Submitted

2024-04-14 13:50

Reported

2024-04-14 13:54

Platform

win11-20240412-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4388 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4388 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4388 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe
PID 4388 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe
PID 4300 wrote to memory of 656 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4300 wrote to memory of 656 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4300 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4300 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4300 wrote to memory of 3932 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\system32\cmd.exe
PID 4300 wrote to memory of 3932 N/A C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe C:\Windows\system32\cmd.exe
PID 3932 wrote to memory of 1152 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 3932 wrote to memory of 1152 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 3932 wrote to memory of 3220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 3932 wrote to memory of 3220 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Client.exe

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "Windows Boot Menu" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe

"C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "Windows Boot Menu" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe" /rl HIGHEST /f

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /delete /tn "Windows Boot Menu" /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UofcyMV9JYEc.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\PING.EXE

ping -n 10 localhost

Network

Country Destination Domain Proto
GB 140.238.91.110:34309 tcp
US 8.8.8.8:53 ipwho.is udp
DE 195.201.57.90:443 ipwho.is tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 90.57.201.195.in-addr.arpa udp

Files

memory/4388-0-0x0000000000AB0000-0x0000000000DD4000-memory.dmp

memory/4388-1-0x00007FF8C6C30000-0x00007FF8C76F2000-memory.dmp

memory/4388-2-0x000000001BA60000-0x000000001BA70000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows\dllhostx64.exe

MD5 1109da1db2b4175b38ae1bc7c881db9a
SHA1 02b92b5e6aa54ae040bc5cd5e845287be01c9562
SHA256 0aadcb147077d657fd68e222689a25d93c40144d54922c83b4171a5e801235c5
SHA512 44cc1ee0e92159f4d41b4b1c9ae52a7b208b7888c5864795f1e815725d26677e2c7f4fce6410a8cfa8e07c8ee19c3f07f4110c64f1eca62d2f6bbf4cdda8f952

memory/4388-8-0x00007FF8C6C30000-0x00007FF8C76F2000-memory.dmp

memory/4300-9-0x00007FF8C6C30000-0x00007FF8C76F2000-memory.dmp

memory/4300-10-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

memory/4300-11-0x000000001C3C0000-0x000000001C410000-memory.dmp

memory/4300-12-0x000000001C4D0000-0x000000001C582000-memory.dmp

memory/4300-13-0x000000001C430000-0x000000001C442000-memory.dmp

memory/4300-14-0x000000001C490000-0x000000001C4CC000-memory.dmp

memory/4300-15-0x00007FF8C6C30000-0x00007FF8C76F2000-memory.dmp

memory/4300-16-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\UofcyMV9JYEc.bat

MD5 8f3ec340fecd690814b6525be23f661e
SHA1 825c874188b531c34ce9c684dbc72f45c6a8e20f
SHA256 e67ed1a9cf1190a40b356307d9da05de7503a6bfa562f29b1f0711a2dd5f784a
SHA512 7cb7f175ccd13857d249ea2f566ca07c44cbc29ee6de45952bad96e13081e6b873ec5bb7ecbc3fb68254755af73d12d880a1a5fb1c9d1c1a790fdc825993cb3b

memory/4300-22-0x00007FF8C6C30000-0x00007FF8C76F2000-memory.dmp