quasar | 4ff6da365ddd8c3f3e4c186022ab9447b2f6123adf991a81cd58bc71ecb2522a

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Remcosv4.9.3LightMOD.exe
Size

40.3MB
MD5

d3de21913cdebc1c84d668de22831d85
SHA1

2619ebb87016473c06ed820a8d26120b704b8023
SHA256

4ff6da365ddd8c3f3e4c186022ab9447b2f6123adf991a81cd58bc71ecb2522a
SHA512

bccee54ff31b9321020276c311f609951c47dac790ddfc47bcca0d19052fcd5d27340cb99d87f4c762e11c99f39a2b7cbe379d2fabdc8da91c637adccd8339cf
SSDEEP

786432:MukwgGc0LdSPyiMJj2uK0P7ts6CcEwVOgjxBdgoz8pF4zqIdvXO/:Xc0QaiYj2AP7y62wV5jxBXVPG

Score

10^/10

quasar remcos spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Remcos

team-circles.gl.at.ply.gg:25349

Mutex

109bae44-c7e4-46f2-82cd-2c3efb4dc47e

Attributes

encryption_key
78AF43F549EE55D0FC30D38EC96EAA6F3A3F5CDF
install_name
Runtime Broker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Runtime Broker
subdirectory
WD Defender

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe	family_quasar
behavioral2/memory/2548-26-0x0000000000F10000-0x0000000001234000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Runtime Broker.exeRuntime Broker.exeRemcosv4.9.3LightMOD.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Remcosv4.9.3LightMOD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe

Executes dropped EXE 10 IoCs

Processes:

Remcos v4.9.3 Light MOD.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exe

pid	process
1524	Remcos v4.9.3 Light MOD.exe
2548	Runtime Broker.exe
3288	Runtime Broker.exe
2072	Runtime Broker.exe
4832	Runtime Broker.exe
2176	Runtime Broker.exe
3488	Runtime Broker.exe
2792	Runtime Broker.exe
2944	Runtime Broker.exe
1916	Runtime Broker.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Remcos v4.9.3 Light MOD.exe

pid process

1524 Remcos v4.9.3 Light MOD.exe
1524 Remcos v4.9.3 Light MOD.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
916	schtasks.exe
3664	schtasks.exe
4648	schtasks.exe
624	schtasks.exe
2120	schtasks.exe
2712	schtasks.exe
2640	schtasks.exe
2244	schtasks.exe
1064	schtasks.exe

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

2200 PING.EXE
1388 PING.EXE
4396 PING.EXE
1096 PING.EXE
2900 PING.EXE
2124 PING.EXE
4468 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Remcos v4.9.3 Light MOD.exe

pid process

1524 Remcos v4.9.3 Light MOD.exe
1524 Remcos v4.9.3 Light MOD.exe

pid	process
2200	PING.EXE
1388	PING.EXE
4396	PING.EXE
1096	PING.EXE
2900	PING.EXE
2124	PING.EXE
4468	PING.EXE

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

Runtime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exe

description	pid	process
Token: SeDebugPrivilege	2548	Runtime Broker.exe
Token: SeDebugPrivilege	3288	Runtime Broker.exe
Token: SeDebugPrivilege	2072	Runtime Broker.exe
Token: SeDebugPrivilege	4832	Runtime Broker.exe
Token: SeDebugPrivilege	2176	Runtime Broker.exe
Token: SeDebugPrivilege	3488	Runtime Broker.exe
Token: SeDebugPrivilege	2792	Runtime Broker.exe
Token: SeDebugPrivilege	2944	Runtime Broker.exe
Token: SeDebugPrivilege	1916	Runtime Broker.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

Runtime Broker.exeRemcos v4.9.3 Light MOD.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exeRuntime Broker.exe

pid	process
3288	Runtime Broker.exe
1524	Remcos v4.9.3 Light MOD.exe
2072	Runtime Broker.exe
2176	Runtime Broker.exe
3488	Runtime Broker.exe
2792	Runtime Broker.exe
2944	Runtime Broker.exe
1916	Runtime Broker.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Remcosv4.9.3LightMOD.exeRuntime Broker.exeRuntime Broker.execmd.exeRuntime Broker.execmd.exeRuntime Broker.execmd.exeRuntime Broker.execmd.exeRuntime Broker.execmd.exeRuntime Broker.execmd.exe

description	pid	process	target process
PID 4820 wrote to memory of 1524	4820	Remcosv4.9.3LightMOD.exe	Remcos v4.9.3 Light MOD.exe
PID 4820 wrote to memory of 1524	4820	Remcosv4.9.3LightMOD.exe	Remcos v4.9.3 Light MOD.exe
PID 4820 wrote to memory of 1524	4820	Remcosv4.9.3LightMOD.exe	Remcos v4.9.3 Light MOD.exe
PID 4820 wrote to memory of 2548	4820	Remcosv4.9.3LightMOD.exe	Runtime Broker.exe
PID 4820 wrote to memory of 2548	4820	Remcosv4.9.3LightMOD.exe	Runtime Broker.exe
PID 2548 wrote to memory of 1064	2548	Runtime Broker.exe	schtasks.exe
PID 2548 wrote to memory of 1064	2548	Runtime Broker.exe	schtasks.exe
PID 2548 wrote to memory of 3288	2548	Runtime Broker.exe	Runtime Broker.exe
PID 2548 wrote to memory of 3288	2548	Runtime Broker.exe	Runtime Broker.exe
PID 3288 wrote to memory of 2712	3288	Runtime Broker.exe	schtasks.exe
PID 3288 wrote to memory of 2712	3288	Runtime Broker.exe	schtasks.exe
PID 3288 wrote to memory of 2012	3288	Runtime Broker.exe	cmd.exe
PID 3288 wrote to memory of 2012	3288	Runtime Broker.exe	cmd.exe
PID 2012 wrote to memory of 4880	2012	cmd.exe	chcp.com
PID 2012 wrote to memory of 4880	2012	cmd.exe	chcp.com
PID 2012 wrote to memory of 2200	2012	cmd.exe	PING.EXE
PID 2012 wrote to memory of 2200	2012	cmd.exe	PING.EXE
PID 2012 wrote to memory of 2072	2012	cmd.exe	Runtime Broker.exe
PID 2012 wrote to memory of 2072	2012	cmd.exe	Runtime Broker.exe
PID 2072 wrote to memory of 2640	2072	Runtime Broker.exe	schtasks.exe
PID 2072 wrote to memory of 2640	2072	Runtime Broker.exe	schtasks.exe
PID 2072 wrote to memory of 740	2072	Runtime Broker.exe	cmd.exe
PID 2072 wrote to memory of 740	2072	Runtime Broker.exe	cmd.exe
PID 740 wrote to memory of 1428	740	cmd.exe	chcp.com
PID 740 wrote to memory of 1428	740	cmd.exe	chcp.com
PID 740 wrote to memory of 1388	740	cmd.exe	PING.EXE
PID 740 wrote to memory of 1388	740	cmd.exe	PING.EXE
PID 740 wrote to memory of 4832	740	cmd.exe	Runtime Broker.exe
PID 740 wrote to memory of 4832	740	cmd.exe	Runtime Broker.exe
PID 4832 wrote to memory of 2244	4832	Runtime Broker.exe	schtasks.exe
PID 4832 wrote to memory of 2244	4832	Runtime Broker.exe	schtasks.exe
PID 4832 wrote to memory of 216	4832	Runtime Broker.exe	cmd.exe
PID 4832 wrote to memory of 216	4832	Runtime Broker.exe	cmd.exe
PID 216 wrote to memory of 3496	216	cmd.exe	chcp.com
PID 216 wrote to memory of 3496	216	cmd.exe	chcp.com
PID 216 wrote to memory of 4396	216	cmd.exe	PING.EXE
PID 216 wrote to memory of 4396	216	cmd.exe	PING.EXE
PID 216 wrote to memory of 2176	216	cmd.exe	Runtime Broker.exe
PID 216 wrote to memory of 2176	216	cmd.exe	Runtime Broker.exe
PID 2176 wrote to memory of 916	2176	Runtime Broker.exe	schtasks.exe
PID 2176 wrote to memory of 916	2176	Runtime Broker.exe	schtasks.exe
PID 2176 wrote to memory of 1220	2176	Runtime Broker.exe	cmd.exe
PID 2176 wrote to memory of 1220	2176	Runtime Broker.exe	cmd.exe
PID 1220 wrote to memory of 848	1220	cmd.exe	chcp.com
PID 1220 wrote to memory of 848	1220	cmd.exe	chcp.com
PID 1220 wrote to memory of 1096	1220	cmd.exe	PING.EXE
PID 1220 wrote to memory of 1096	1220	cmd.exe	PING.EXE
PID 1220 wrote to memory of 3488	1220	cmd.exe	Runtime Broker.exe
PID 1220 wrote to memory of 3488	1220	cmd.exe	Runtime Broker.exe
PID 3488 wrote to memory of 3664	3488	Runtime Broker.exe	schtasks.exe
PID 3488 wrote to memory of 3664	3488	Runtime Broker.exe	schtasks.exe
PID 3488 wrote to memory of 1636	3488	Runtime Broker.exe	cmd.exe
PID 3488 wrote to memory of 1636	3488	Runtime Broker.exe	cmd.exe
PID 1636 wrote to memory of 4984	1636	cmd.exe	chcp.com
PID 1636 wrote to memory of 4984	1636	cmd.exe	chcp.com
PID 1636 wrote to memory of 2900	1636	cmd.exe	PING.EXE
PID 1636 wrote to memory of 2900	1636	cmd.exe	PING.EXE
PID 1636 wrote to memory of 2792	1636	cmd.exe	Runtime Broker.exe
PID 1636 wrote to memory of 2792	1636	cmd.exe	Runtime Broker.exe
PID 2792 wrote to memory of 4648	2792	Runtime Broker.exe	schtasks.exe
PID 2792 wrote to memory of 4648	2792	Runtime Broker.exe	schtasks.exe
PID 2792 wrote to memory of 4036	2792	Runtime Broker.exe	cmd.exe
PID 2792 wrote to memory of 4036	2792	Runtime Broker.exe	cmd.exe
PID 4036 wrote to memory of 2348	4036	cmd.exe	chcp.com

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Remcosv4.9.3LightMOD.exe
"C:\Users\Admin\AppData\Local\Temp\Remcosv4.9.3LightMOD.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4820

C:\Users\Admin\AppData\Local\Temp\Remcos v4.9.3 Light MOD.exe
"C:\Users\Admin\AppData\Local\Temp\Remcos v4.9.3 Light MOD.exe"
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1524

C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe
"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1064

C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\d4JRyx7MclZe.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\system32\chcp.com
chcp 65001
5⤵
PID:4880

C:\Windows\system32\PING.EXE
ping -n 10 localhost
5⤵
- Runs ping.exe
PID:2200

C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f
6⤵
- Creates scheduled task(s)
PID:2640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\II61zF3datav.bat" "
6⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\system32\chcp.com
chcp 65001
7⤵
PID:1428

C:\Windows\system32\PING.EXE
ping -n 10 localhost
7⤵
- Runs ping.exe
PID:1388

C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"
7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f
8⤵
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uKW8AKrQyRrH.bat" "
8⤵
- Suspicious use of WriteProcessMemory
PID:216

C:\Windows\system32\chcp.com
chcp 65001
9⤵
PID:3496

C:\Windows\system32\PING.EXE
ping -n 10 localhost
9⤵
- Runs ping.exe
PID:4396

C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"
9⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f
10⤵
- Creates scheduled task(s)
PID:916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UZttjw4P4z1P.bat" "
10⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\system32\chcp.com
chcp 65001
11⤵
PID:848

C:\Windows\system32\PING.EXE
ping -n 10 localhost
11⤵
- Runs ping.exe
PID:1096

C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"
11⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f
12⤵
- Creates scheduled task(s)
PID:3664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Iw0IkepjtkE4.bat" "
12⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\system32\chcp.com
chcp 65001
13⤵
PID:4984

C:\Windows\system32\PING.EXE
ping -n 10 localhost
13⤵
- Runs ping.exe
PID:2900

C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"
13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f
14⤵
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CxCIzacfbgAD.bat" "
14⤵
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\system32\chcp.com
chcp 65001
15⤵
PID:2348

C:\Windows\system32\PING.EXE
ping -n 10 localhost
15⤵
- Runs ping.exe
PID:2124

C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"
15⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2944

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f
16⤵
- Creates scheduled task(s)
PID:624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\y6PRFWzDgVPd.bat" "
16⤵
PID:4296

C:\Windows\system32\chcp.com
chcp 65001
17⤵
PID:468

C:\Windows\system32\PING.EXE
ping -n 10 localhost
17⤵
- Runs ping.exe
PID:4468

C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe"
17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1916

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WD Defender\Runtime Broker.exe" /rl HIGHEST /f
18⤵
- Creates scheduled task(s)
PID:2120

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Runtime Broker.exe.log
Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Temp\CxCIzacfbgAD.bat
Filesize
220B

MD5
bc7d5be260cce4823e4895938b6ce44b

SHA1
87a5c1cbd785b4c7f792093d637e4678ff57911d

SHA256
35245389170d2fa56a66ad41981171e8dc83df15e769604193c68f245f4119ac

SHA512
3a35697391e62c70a5bbd10594dfc17c11288763a36fdc3baed8812a4e8157379d647a037ee4fbbe464bef3ed007ba6d98d9094ca29f62238aa7ff0139b5a5db

Download Submit
C:\Users\Admin\AppData\Local\Temp\II61zF3datav.bat
Filesize
220B

MD5
dfaac48c02e84a1fff0413c1247ea532

SHA1
b3aa72d178b0c18fe19922d8efa0e14da6803eef

SHA256
7c0f620498cd3af929c830bc09ed8a8b69173eb4e448351967d02b362cb4f5a4

SHA512
1a6cb45770b37e17dddd0d6d14d9e4e82c2f7b868a59bd095c69e1722765a889f15a2fb4820c700573a09d40379d06f34f86f1b9f4847c9de3e7453894b9b0eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iw0IkepjtkE4.bat
Filesize
220B

MD5
e471c73881f70d90f33d4258f16c6009

SHA1
2f7e51d7ca6b131975b8299ccd49388e41e13c59

SHA256
3dd9b20814b3a8564dc441d8f44d838acd9539884bf19c7ae237fa0fbad55ce5

SHA512
2e13a16aecaab21948af86cb090fbfb1557c3f12016e5e9d635260bbfcb161e3d157f174734791e23b157ca44a4a895ea66c565b468432802585b6ae5658949e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Remcos v4.9.3 Light MOD.exe
Filesize
39.2MB

MD5
6eacce4a82cf898472ad2aa8b0267cca

SHA1
954def54ec22b1ade594e7f501384fe19d2bbfef

SHA256
522a915d9a78b68fee628014e4559e82bcbf137d9abc521e57b6e7aca695cec7

SHA512
3004e9f64ba6258b3780d534bd59b3c8ae611e29d846e0aaa197af892f56708379b4996295de5c777ef845a031c44915bf3faa17b137f892a81373423bd47ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe
Filesize
3.1MB

MD5
0296021acfb4f37e63df4de7461ebfd9

SHA1
14117dba6ce87cbb6561ebdfffec60cb21860800

SHA256
4fc6d003d67f0a1b3a276018516c6a0fe6301b10efe9e41fccd2e5a645a3333a

SHA512
ffff32821dc347531f6e814df23b1f848df002c33ca83c635bc2fb1d3b810e9c21ffa6da6f0beb1a207f55a9d4048828545d678a8137991d1de2266bcbe1deee

Download Submit
C:\Users\Admin\AppData\Local\Temp\UZttjw4P4z1P.bat
Filesize
220B

MD5
57f65dd6450e8f46d070c4303f249f70

SHA1
b46f3ef3d1ccc788ed040a4eaf869dff23f9202a

SHA256
51b403ea03fe3f50a1de1df2cf6e330b406d777daf50a1528f249fc8be6e7ec5

SHA512
1fbe571f323d42603d282798407c5a04ad2ac3967796f2a8e71693f3bb7ba566d738be0a408088ad32bca25912fbe0807c5c339a2e0fa6dee7e025cbc098cb06

Download Submit
C:\Users\Admin\AppData\Local\Temp\d4JRyx7MclZe.bat
Filesize
220B

MD5
c6dbeeb59302789c2fd17ee467280be0

SHA1
8ff7a2f2a21d6f113ff01e1855b5943d30194f25

SHA256
1ba4aa48878d66d12c014c2c3267e60eb42a547eadd261f81270c0c15076b8c2

SHA512
7dd82db3fc9be769c87226bab87c21ae2d10ae9055e2f042dbc65ca341a839ba3eb8f789d6d5ed1ae804f91244c9dbde336075c404094c9ddb71a00656e21c73

Download Submit
C:\Users\Admin\AppData\Local\Temp\uKW8AKrQyRrH.bat
Filesize
220B

MD5
a86cbae20775287a30e3176469f547a3

SHA1
83dbf7dbb89e9982d51e7983647460510277fe0c

SHA256
7cf5080526ec6049d03aae088126cb8f604cc33a49f453e96e9d2a8e56e21f44

SHA512
134895067a762ccdf511e52d0ce7b70ed54f79749c5a4b57cc4e616873673b855924e02e1dc2c39cce857a6f06ab967695da4c725443098ccb524ee331925ac8

Download Submit
C:\Users\Admin\AppData\Local\Temp\y6PRFWzDgVPd.bat
Filesize
220B

MD5
1c46c31511380c92d8bbda2ddd871844

SHA1
132d2e7b29e27f739ac8e5f8f0e47fcf60c5f9b4

SHA256
2983aa8fe86bb2a321ba9b75996cbe18f34c3ca112ed920f9bc8520b2d3bbe50

SHA512
bc3027c1deee4ab3bb2221df0c5b6f3e1a535c998850bf46db5c72cedef48acd6f483b10a6d7f53b7c00d9c467b8742fe53324afb5e44778ccfb8bd1062856b7

Download Submit
memory/1524-39-0x0000000006940000-0x0000000006941000-memory.dmp

Filesize
4KB

Download
memory/1524-44-0x0000000000400000-0x000000000668E000-memory.dmp

Filesize
98.6MB

Download
memory/1524-36-0x0000000006900000-0x0000000006901000-memory.dmp

Filesize
4KB

Download
memory/1524-40-0x0000000006B70000-0x0000000006B71000-memory.dmp

Filesize
4KB

Download
memory/1524-41-0x0000000006B80000-0x0000000006B81000-memory.dmp

Filesize
4KB

Download
memory/1524-42-0x0000000006B90000-0x0000000006B91000-memory.dmp

Filesize
4KB

Download
memory/1524-43-0x0000000006BA0000-0x0000000006BA1000-memory.dmp

Filesize
4KB

Download
memory/1524-38-0x0000000006930000-0x0000000006931000-memory.dmp

Filesize
4KB

Download
memory/1524-37-0x0000000006920000-0x0000000006921000-memory.dmp

Filesize
4KB

Download
memory/2548-26-0x0000000000F10000-0x0000000001234000-memory.dmp

Filesize
3.1MB

Download
memory/3288-35-0x000000001BE30000-0x000000001BEE2000-memory.dmp

Filesize
712KB

Download
memory/3288-34-0x000000001BD20000-0x000000001BD70000-memory.dmp

Filesize
320KB

Download
memory/4820-0-0x00007FFDE6193000-0x00007FFDE6195000-memory.dmp

Filesize
8KB

Download
memory/4820-25-0x00007FFDE6190000-0x00007FFDE6C51000-memory.dmp

Filesize
10.8MB

Download
memory/4820-2-0x00007FFDE6190000-0x00007FFDE6C51000-memory.dmp

Filesize
10.8MB

Download
memory/4820-1-0x00000000003A0000-0x0000000002BF4000-memory.dmp

Filesize
40.3MB

Download