Analysis
-
max time kernel
5s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
03-05-2024 01:48
Behavioral task
behavioral1
Sample
a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe
Resource
win10v2004-20240419-en
General
-
Target
a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe
-
Size
2.0MB
-
MD5
4a19e3a1b37267e44d0eb478a766f211
-
SHA1
28d0bc2dfe3affc380fe0bfdcd668801ddb72719
-
SHA256
a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6
-
SHA512
45881f60fd71a2c40738a56c3b9815319234f72cde21e0bdf24b34b669d02e3604bf373ac94a81a3bf270142240c89a86828454813bcb93e8c16759d9f09edca
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYq:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yg
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar behavioral2/memory/3600-30-0x0000000000110000-0x000000000016E000-memory.dmp family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar -
Detects Windows executables referencing non-Windows User-Agents 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3600-30-0x0000000000110000-0x000000000016E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables containing common artifacts observed in infostealers 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_GENInfoStealer behavioral2/memory/3600-30-0x0000000000110000-0x000000000016E000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe INDICATOR_SUSPICIOUS_GENInfoStealer -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe -
Executes dropped EXE 3 IoCs
Processes:
vnc.exewindef.exewinsock.exepid process 4728 vnc.exe 3600 windef.exe 4488 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exedescription ioc process File opened (read-only) \??\i: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\j: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\n: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\x: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\y: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\e: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\g: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\m: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\q: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\r: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\z: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\a: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\b: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\t: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\u: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\v: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\w: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\h: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\k: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\p: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\s: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\l: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe File opened (read-only) \??\o: a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 9 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exedescription pid process target process PID 2132 set thread context of 4544 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 396 4728 WerFault.exe vnc.exe 372 4488 WerFault.exe winsock.exe 948 3088 WerFault.exe vnc.exe 2296 680 WerFault.exe winsock.exe -
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1348 schtasks.exe 3048 schtasks.exe 1268 schtasks.exe 3968 schtasks.exe 1452 schtasks.exe 3544 schtasks.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exepid process 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
windef.exewinsock.exedescription pid process Token: SeDebugPrivilege 3600 windef.exe Token: SeDebugPrivilege 4488 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winsock.exepid process 4488 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exevnc.exewindef.exewinsock.exedescription pid process target process PID 2132 wrote to memory of 4728 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe vnc.exe PID 2132 wrote to memory of 4728 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe vnc.exe PID 2132 wrote to memory of 4728 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe vnc.exe PID 4728 wrote to memory of 2568 4728 vnc.exe svchost.exe PID 4728 wrote to memory of 2568 4728 vnc.exe svchost.exe PID 2132 wrote to memory of 3600 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe windef.exe PID 2132 wrote to memory of 3600 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe windef.exe PID 2132 wrote to memory of 3600 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe windef.exe PID 4728 wrote to memory of 2568 4728 vnc.exe svchost.exe PID 2132 wrote to memory of 4544 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe PID 2132 wrote to memory of 4544 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe PID 2132 wrote to memory of 4544 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe PID 2132 wrote to memory of 4544 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe PID 2132 wrote to memory of 4544 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe PID 2132 wrote to memory of 1348 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe schtasks.exe PID 2132 wrote to memory of 1348 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe schtasks.exe PID 2132 wrote to memory of 1348 2132 a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe schtasks.exe PID 3600 wrote to memory of 3048 3600 windef.exe schtasks.exe PID 3600 wrote to memory of 3048 3600 windef.exe schtasks.exe PID 3600 wrote to memory of 3048 3600 windef.exe schtasks.exe PID 3600 wrote to memory of 4488 3600 windef.exe winsock.exe PID 3600 wrote to memory of 4488 3600 windef.exe winsock.exe PID 3600 wrote to memory of 4488 3600 windef.exe winsock.exe PID 4488 wrote to memory of 1268 4488 winsock.exe schtasks.exe PID 4488 wrote to memory of 1268 4488 winsock.exe schtasks.exe PID 4488 wrote to memory of 1268 4488 winsock.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe"C:\Users\Admin\AppData\Local\Temp\a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 5483⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5mo6YuOtZOn7.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 17244⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe"C:\Users\Admin\AppData\Local\Temp\a66a1d39e93ecd9d3607502284071e5708c78c1092ded28e4c815538f94bdca6.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4728 -ip 47281⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 5203⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sOmB4OcYfpeQ.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 22644⤵
- Program crash
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4488 -ip 44881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3088 -ip 30881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 680 -ip 6801⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.logFilesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
C:\Users\Admin\AppData\Local\Temp\5mo6YuOtZOn7.batFilesize
208B
MD5b3a528aa660d6421e91638ae0cf38ed9
SHA178cace99f08f9c345c64b9d1d6533d69f5a172cc
SHA256f5efebed4f0b5ed23d16b9a1f6fcc1aedb0444372312ececbabf898106bea69e
SHA51282b8b24728a735ff73942c08fb441a9cb8de9943885cb61e0f4cbe41460f28a0b0c090f2c6345394bf1ab30f5ab80fbc2eafb811f59f9fb6feab215825c9c7fb
-
C:\Users\Admin\AppData\Local\Temp\sOmB4OcYfpeQ.batFilesize
208B
MD5d0b4f5c04efffa40009620901485f12d
SHA15f671772717e0570ea6bcfa71ab357f088e6d0fe
SHA256c5c9a156ca780970837730e07c6125f5a56faf208679ffdd1db08ff2ac17ea47
SHA51268d6f9913b58624c15e1ccad8f63eefae37c1a1f47c931b098fe1ade240d1a0b3ae3099edaaa730b4ddba5f9743723cdd473efb5cc80cddaf8cfe0c146e08fdc
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\Logs\05-03-2024Filesize
224B
MD5b1f320a9384c63d39f69d959c5df1cb7
SHA1a936b88d234e6c99fab41392dd8e76b4714850ff
SHA256b8eb739605f8eed1704b11045a0bbffdda6219ed2439c216b81203313d3c228b
SHA512e5b64c09fc0664a82b5170611df93998be4f3c7aafd6924516d8515ee01d82e1c8d2115c82aa5d86dcf1b8017bf6baf843c7e97fc3f60cd1462d5a852a85a0da
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD5d3048b335b472475a7983c204d5308a4
SHA111bf01d647344f7a18a892f466d80f2ac76d3a9b
SHA256a7c0bb14d3431b5013fd7909e03b31a02da4045bbd3bab0f4edba80528cbb6ef
SHA512446115385816314c5a5d98237a7d5c77364645d9c9876d6e05f48026bdd66d276751c8c5d9fd240666a6a357326d2b50099d865f572bc7d27919cd3dd281a3cc
-
memory/2132-19-0x00000000048E0000-0x00000000048E1000-memory.dmpFilesize
4KB
-
memory/3600-34-0x0000000004A70000-0x0000000004B02000-memory.dmpFilesize
584KB
-
memory/3600-35-0x0000000004B40000-0x0000000004BA6000-memory.dmpFilesize
408KB
-
memory/3600-36-0x0000000005750000-0x0000000005762000-memory.dmpFilesize
72KB
-
memory/3600-37-0x0000000005C90000-0x0000000005CCC000-memory.dmpFilesize
240KB
-
memory/3600-31-0x0000000004F80000-0x0000000005524000-memory.dmpFilesize
5.6MB
-
memory/3600-30-0x0000000000110000-0x000000000016E000-memory.dmpFilesize
376KB
-
memory/3600-29-0x0000000072B1E000-0x0000000072B1F000-memory.dmpFilesize
4KB
-
memory/4488-45-0x0000000006B20000-0x0000000006B2A000-memory.dmpFilesize
40KB
-
memory/4544-28-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4544-20-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB