Analysis

  • max time kernel
    143s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    04-08-2024 01:24

General

  • Target

    6aabee552a530d63bdabc02cbe5714fcb7e1f9c826acb0b27ad267d50065cdaf.exe

  • Size

    3.1MB

  • MD5

    3cf4f19b7c69135acb3c4c9bb9cdfb90

  • SHA1

    e2b5a40dd2abfa03671fde7c4e74f9b2846f989f

  • SHA256

    6aabee552a530d63bdabc02cbe5714fcb7e1f9c826acb0b27ad267d50065cdaf

  • SHA512

    4b4237eaf8ca42456b5ce183c83ba3f0cd382dfa5ae775a9433db4f7091ac0295267e80fcd93861a1022288ebf7c3a9d3b7caa07423f75c0b685812bf97996cd

  • SSDEEP

    49152:DvehBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaxAtueYFoGdXTHHB72eh2NT:DvAt2d5aKCuVPzlEmVQ0wvwf+tuee

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

nohchy-47404.portmap.host:47404

Mutex

1a1e174b-dbf8-49ad-9b43-2cfbb233a6d9

Attributes
  • encryption_key

    795CDD46D2CDD422BE523F263B64E03D8B6AAD42

  • install_name

    SolaraExecutor.exe

  • log_directory

    Logs

  • reconnect_delay

    2000

  • startup_key

    RtkAudUService64

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 11 IoCs
  • Executes dropped EXE 15 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 15 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6aabee552a530d63bdabc02cbe5714fcb7e1f9c826acb0b27ad267d50065cdaf.exe
    "C:\Users\Admin\AppData\Local\Temp\6aabee552a530d63bdabc02cbe5714fcb7e1f9c826acb0b27ad267d50065cdaf.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1688
    • C:\Windows\system32\SubDir\SolaraExecutor.exe
      "C:\Windows\system32\SubDir\SolaraExecutor.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\system32\schtasks.exe
        "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2132
      • C:\Windows\system32\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\w8lKwKzL6O1o.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:2672
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2560
          • C:\Windows\system32\SubDir\SolaraExecutor.exe
            "C:\Windows\system32\SubDir\SolaraExecutor.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2200
            • C:\Windows\system32\schtasks.exe
              "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:636
            • C:\Windows\system32\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\s8cSGWumUXcy.bat" "
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2780
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:2436
                • C:\Windows\system32\PING.EXE
                  ping -n 10 localhost
                  6⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:2868
                • C:\Windows\system32\SubDir\SolaraExecutor.exe
                  "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:2624
                  • C:\Windows\system32\schtasks.exe
                    "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:2816
                  • C:\Windows\system32\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\9a9JatYmIKwD.bat" "
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:288
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      8⤵
                        PID:1364
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        8⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:1532
                      • C:\Windows\system32\SubDir\SolaraExecutor.exe
                        "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:2168
                        • C:\Windows\system32\schtasks.exe
                          "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                          9⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:1888
                        • C:\Windows\system32\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\kSp0LcAZqQIi.bat" "
                          9⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2076
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            10⤵
                              PID:2908
                            • C:\Windows\system32\PING.EXE
                              ping -n 10 localhost
                              10⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:324
                            • C:\Windows\system32\SubDir\SolaraExecutor.exe
                              "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                              10⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:1248
                              • C:\Windows\system32\schtasks.exe
                                "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                                11⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:908
                              • C:\Windows\system32\cmd.exe
                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\ookcGWi0iaCr.bat" "
                                11⤵
                                  PID:1892
                                  • C:\Windows\system32\chcp.com
                                    chcp 65001
                                    12⤵
                                      PID:1720
                                    • C:\Windows\system32\PING.EXE
                                      ping -n 10 localhost
                                      12⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:2416
                                    • C:\Windows\system32\SubDir\SolaraExecutor.exe
                                      "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                                      12⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:1444
                                      • C:\Windows\system32\schtasks.exe
                                        "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                                        13⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2236
                                      • C:\Windows\system32\cmd.exe
                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\2Gs52dFuOOAc.bat" "
                                        13⤵
                                          PID:2344
                                          • C:\Windows\system32\chcp.com
                                            chcp 65001
                                            14⤵
                                              PID:1464
                                            • C:\Windows\system32\PING.EXE
                                              ping -n 10 localhost
                                              14⤵
                                              • System Network Configuration Discovery: Internet Connection Discovery
                                              • Runs ping.exe
                                              PID:2340
                                            • C:\Windows\system32\SubDir\SolaraExecutor.exe
                                              "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                                              14⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              PID:3024
                                              • C:\Windows\system32\schtasks.exe
                                                "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                                                15⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1588
                                              • C:\Windows\system32\cmd.exe
                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\fHUypsR5cZe8.bat" "
                                                15⤵
                                                  PID:2648
                                                  • C:\Windows\system32\chcp.com
                                                    chcp 65001
                                                    16⤵
                                                      PID:2928
                                                    • C:\Windows\system32\PING.EXE
                                                      ping -n 10 localhost
                                                      16⤵
                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                      • Runs ping.exe
                                                      PID:1008
                                                    • C:\Windows\system32\SubDir\SolaraExecutor.exe
                                                      "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                                                      16⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      PID:340
                                                      • C:\Windows\system32\schtasks.exe
                                                        "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                                                        17⤵
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:2672
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\T4RnteHx2LUO.bat" "
                                                        17⤵
                                                          PID:2576
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 65001
                                                            18⤵
                                                              PID:3016
                                                            • C:\Windows\system32\PING.EXE
                                                              ping -n 10 localhost
                                                              18⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Runs ping.exe
                                                              PID:1252
                                                            • C:\Windows\system32\SubDir\SolaraExecutor.exe
                                                              "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                                                              18⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              PID:2136
                                                              • C:\Windows\system32\schtasks.exe
                                                                "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                                                                19⤵
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2512
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\ufVoy4qTmJBg.bat" "
                                                                19⤵
                                                                  PID:692
                                                                  • C:\Windows\system32\chcp.com
                                                                    chcp 65001
                                                                    20⤵
                                                                      PID:2888
                                                                    • C:\Windows\system32\PING.EXE
                                                                      ping -n 10 localhost
                                                                      20⤵
                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                      • Runs ping.exe
                                                                      PID:2420
                                                                    • C:\Windows\system32\SubDir\SolaraExecutor.exe
                                                                      "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                                                                      20⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      PID:912
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                                                                        21⤵
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:536
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\6wxKarHO4iDi.bat" "
                                                                        21⤵
                                                                          PID:1772
                                                                          • C:\Windows\system32\chcp.com
                                                                            chcp 65001
                                                                            22⤵
                                                                              PID:1288
                                                                            • C:\Windows\system32\PING.EXE
                                                                              ping -n 10 localhost
                                                                              22⤵
                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                              • Runs ping.exe
                                                                              PID:1888
                                                                            • C:\Windows\system32\SubDir\SolaraExecutor.exe
                                                                              "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                                                                              22⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of SendNotifyMessage
                                                                              PID:2372
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                                                                                23⤵
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:2376
                                                                              • C:\Windows\system32\cmd.exe
                                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\XVn1Wk0PyNtH.bat" "
                                                                                23⤵
                                                                                  PID:444
                                                                                  • C:\Windows\system32\chcp.com
                                                                                    chcp 65001
                                                                                    24⤵
                                                                                      PID:860
                                                                                    • C:\Windows\system32\PING.EXE
                                                                                      ping -n 10 localhost
                                                                                      24⤵
                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                      • Runs ping.exe
                                                                                      PID:1536
                                                                                    • C:\Windows\system32\SubDir\SolaraExecutor.exe
                                                                                      "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                                                                                      24⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      PID:1632
                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                        "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                                                                                        25⤵
                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                        PID:2540
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\z0fvVgTurJIq.bat" "
                                                                                        25⤵
                                                                                          PID:2308
                                                                                          • C:\Windows\system32\chcp.com
                                                                                            chcp 65001
                                                                                            26⤵
                                                                                              PID:3036
                                                                                            • C:\Windows\system32\PING.EXE
                                                                                              ping -n 10 localhost
                                                                                              26⤵
                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                              • Runs ping.exe
                                                                                              PID:760
                                                                                            • C:\Windows\system32\SubDir\SolaraExecutor.exe
                                                                                              "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                                                                                              26⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              • Suspicious use of SendNotifyMessage
                                                                                              PID:2064
                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                                                                                                27⤵
                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                PID:936
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\MhLSwW5PbTD8.bat" "
                                                                                                27⤵
                                                                                                  PID:2936
                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                    chcp 65001
                                                                                                    28⤵
                                                                                                      PID:1588
                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                      ping -n 10 localhost
                                                                                                      28⤵
                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                      • Runs ping.exe
                                                                                                      PID:1908
                                                                                                    • C:\Windows\system32\SubDir\SolaraExecutor.exe
                                                                                                      "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                                                                                                      28⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                      PID:2852
                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                        "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                                                                                                        29⤵
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:2716
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\XC5vi1IMF8Fy.bat" "
                                                                                                        29⤵
                                                                                                          PID:1036
                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                            chcp 65001
                                                                                                            30⤵
                                                                                                              PID:2252
                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                              ping -n 10 localhost
                                                                                                              30⤵
                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                              • Runs ping.exe
                                                                                                              PID:2864
                                                                                                            • C:\Windows\system32\SubDir\SolaraExecutor.exe
                                                                                                              "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                                                                                                              30⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                              PID:2172
                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                                                                                                                31⤵
                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                PID:3008
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\HV4X7nAPaktd.bat" "
                                                                                                                31⤵
                                                                                                                  PID:3016
                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                    chcp 65001
                                                                                                                    32⤵
                                                                                                                      PID:764
                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                      ping -n 10 localhost
                                                                                                                      32⤵
                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                      • Runs ping.exe
                                                                                                                      PID:2904

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\Local\Temp\2Gs52dFuOOAc.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        de8778ddb3c735833bb8129de217f702

                                                        SHA1

                                                        85676f9bb246429bb6557c31cdb1f179a8dbab21

                                                        SHA256

                                                        f73c21b4ea8fd4885cc387a5b32a8f6f0103478cd5c52fdecd03390b7006d3d0

                                                        SHA512

                                                        8e9f18c5d5d995ede538aa71c10aadce16784d48597b571f44607e63a3ccbe2f16008bddb2f6d8f2f8b23d460a6e789cd5f60b71df178dcccdbec38dfdd8bd92

                                                      • C:\Users\Admin\AppData\Local\Temp\6wxKarHO4iDi.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        007aece500a3802fa3461e0a7d217e49

                                                        SHA1

                                                        d6d96d15679932570ee589607807e7b7c86a9138

                                                        SHA256

                                                        f6034f9dd5b936c9c62a66073ed0bcb9394bae3dd9f0b0eed64f5e3e42f6e9cb

                                                        SHA512

                                                        4c69f1b067db5b7048e3b6e63997218834b9df722b42de925b6be6c53753721f793346779aa32076ad00b31374d2f8d51d8008f9bd81766c86418ab905fa0b32

                                                      • C:\Users\Admin\AppData\Local\Temp\9a9JatYmIKwD.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        b40ecb22a2201a9d4d8d8681007cf62e

                                                        SHA1

                                                        c19a9da42637d979e1e0024fbaa41ab9f99cc25d

                                                        SHA256

                                                        8cbe2131f43905764537dee5f4c00bf766ed73739d9a014c0bd347cebfb2874c

                                                        SHA512

                                                        ba3ca397e2ee4de281559a89d68cdc7ddd8252225faa3a06fdc9134fdd9e07da7e76eacdf6d0a46b210f51d100061145849010ab5177135047d68c8ed2e2f7a9

                                                      • C:\Users\Admin\AppData\Local\Temp\HV4X7nAPaktd.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        2b0ea848d60689f71e36de6acb56c4e9

                                                        SHA1

                                                        ba83f8f1ea87add2b1f47cd5fb3332a6e73c9b52

                                                        SHA256

                                                        dd252e892706c39dd87ada2598677e7078e6b45ebf41ddf3c5a0a27532d1cce0

                                                        SHA512

                                                        5d104c428d428375361204c2cfde6409eeb908dbfc83afb06a6f121d5bfe231a4f8eafd92066180947ab943595e953923822f3e1422dac45eb89d5d51d2806c0

                                                      • C:\Users\Admin\AppData\Local\Temp\MhLSwW5PbTD8.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        a2a8dfbfe593f8740fbbaa5a7b4f3993

                                                        SHA1

                                                        a69675e7f25a416ec7cb28ff8b6e8491b60575ca

                                                        SHA256

                                                        348b52fdd349748c3ac31832dfe0d446dbba1e8f585b759096b32abbe076db03

                                                        SHA512

                                                        8b851a1f367d93bb386f3d7c861fa26396e2fd9664d55211556374cb1f7d34064f94d56e9b0815c9f577771c40ad6d8c10c5ba1f179192ca7168042f8d3bf06c

                                                      • C:\Users\Admin\AppData\Local\Temp\T4RnteHx2LUO.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        c85d83fa92faf8eb694431434d33f8d4

                                                        SHA1

                                                        15743690e3fdf143e33a2afc5aa20ea5aee13d92

                                                        SHA256

                                                        f5ff779bd4eb9fe6b6313fa68d8b034e53f075231409541122d765548612c221

                                                        SHA512

                                                        8c56b9b51cabacaad6e340b1e4e7f53562c84054fd444927e88856e61b7c7f243e85d75256d2f7bd43eb79c67a07b460fcbaebd29a6b7d0a8762f6f7ae6eeead

                                                      • C:\Users\Admin\AppData\Local\Temp\XC5vi1IMF8Fy.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        5f68362e375bd080ea500a5cdfb1699b

                                                        SHA1

                                                        f68650ea2a35e53cff02d544315f9c6f2af6b849

                                                        SHA256

                                                        443db0cd5795d9ac2e553499003ae813961cc57ab4e22ee6ea41d0345d17b20c

                                                        SHA512

                                                        f5f585560e0e34020cd9ce4fb0628c918389bb54461b3599b57801b95e077072d5bc05f831c328017e3f84b7a365a7c64730661f9e8ba6ab0b143e7dc4fc0ff6

                                                      • C:\Users\Admin\AppData\Local\Temp\XVn1Wk0PyNtH.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        cb8edf2378050ab1cc2dd5fbe014e9f3

                                                        SHA1

                                                        b65c3e91bb146ea69e25dcdae3ff42958bf4b0be

                                                        SHA256

                                                        c3bea631b92b3854ec53850d77964af26befaa6839f71221f7ecbeab0c357b06

                                                        SHA512

                                                        fb88c19b06b180799e990e3b862a7601b9cc2c8aa142b76a369b8ab2f101f597b28c1956d68ffad21ea9dc5b8c4ad6614ce235c6cc04169e8435e4dc2b8c305f

                                                      • C:\Users\Admin\AppData\Local\Temp\fHUypsR5cZe8.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        f0ee2b391eae0e0620f7a0f2dbedddce

                                                        SHA1

                                                        d4a40d655b5fa9f80a61dd09f9d99c39c1ab5785

                                                        SHA256

                                                        394d8fad0a6ac74e8cf73cea2f667910fb654a9996c80ad729560b22839c93f0

                                                        SHA512

                                                        73484ea613cf8cd9787a018aa6173565075ca0bc16d7ba56ed1448a4df27aee297fdf57bd5f9b7fd8c1ceb85ecf3e15043f54620969abc5646096f82aa906795

                                                      • C:\Users\Admin\AppData\Local\Temp\kSp0LcAZqQIi.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        6bedd3c7e9b0fb40977706b879ebb724

                                                        SHA1

                                                        ce075859e40ce7acd338a57f6d35bf739f455e8d

                                                        SHA256

                                                        13ca9f2cd94459756d71985964146fa82e546081c39ed276af3d03e717565cb0

                                                        SHA512

                                                        1dd682d606feb7353fc71b8b359a303550c6c89a20ac8035e7e715d386e8400380f7c37555074e1e31d7b8f9c4cbfab488545df0b30d2f522ec5afd20c971bae

                                                      • C:\Users\Admin\AppData\Local\Temp\ookcGWi0iaCr.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        934d079a2a60a12fca0f174ce4e6d8ef

                                                        SHA1

                                                        76d9f8ff0397cbd956b3326dbb1caee5517093b8

                                                        SHA256

                                                        231e4645511ebc84e49a1658c129b5eccaac9bace556231d79176e74a937bfce

                                                        SHA512

                                                        4f7c846887eb7960dead87fcbb4323be89ecac59baa8957fc3c9f9f0301f0489f8e8e95b0039a93d037564afe233f8698e067ca785f776f9c020223d8cb452ac

                                                      • C:\Users\Admin\AppData\Local\Temp\s8cSGWumUXcy.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        cbbdfa0bb326f7e63a367fe9be7fd888

                                                        SHA1

                                                        2cdcf825e9162be34502052dd37e3c4894a01df6

                                                        SHA256

                                                        32213a5b4f50dbe1e80db42be22d577671826cf47e9ca9ccb1eeb874520c88f1

                                                        SHA512

                                                        29d7b3b7d474cc779fa4d67c47f043873c14812a5d12494960f292c26938d5bb8831fbba79f85ef1763b229f4ac5f4733dea5e7cb4857ecbf72838acb72daf77

                                                      • C:\Users\Admin\AppData\Local\Temp\ufVoy4qTmJBg.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        e82c82d014db1cae3e5ea8e8883038f5

                                                        SHA1

                                                        ff72b1f95932c4bebaef8b58ec28d3172fe2d3db

                                                        SHA256

                                                        21a7d1afc096d20036554e927a653822d6fd6d4e12db6260ff7e0a8465eaa11a

                                                        SHA512

                                                        963b69c5c0737f7ed6e935eed596e80005f45ce3eca37890b6ae7981b9b8e44b05c2016c6a5988ba790ce709cfeb2e5c95123fc77b1d3e27ed7f1df0c6a91845

                                                      • C:\Users\Admin\AppData\Local\Temp\w8lKwKzL6O1o.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        daddb1b98c2aa9bf6535c7cce995eafb

                                                        SHA1

                                                        774286ebd53cd08f20e739d16895fe66c76b14ff

                                                        SHA256

                                                        7aca139ed0eff45af2911354921132fde1d712363dffe4e7e8f961f056b1b9ee

                                                        SHA512

                                                        2c06abecd9afa7e47631b51dc1af960102f2f68d545ad21fff2615d5763d38c9bb1814d83692aa83580342d75915af281d5f2fa0a8c17a273f8b2d326e573d26

                                                      • C:\Users\Admin\AppData\Local\Temp\z0fvVgTurJIq.bat

                                                        Filesize

                                                        204B

                                                        MD5

                                                        8665de82fa2addcebe13a8cf19f4bd6d

                                                        SHA1

                                                        14d247f8486d45925fabc9d83e1f7aec49905ea2

                                                        SHA256

                                                        d2e063ec33888db0afb1e5fa2b05e18592e47a8958bdfeeed9cff3304c17305f

                                                        SHA512

                                                        4c30a1f4c701e2f1c94feabbf73d6854c316e6c7f3dc19f06c55c93226af7e3bceb8175f1a10284d2cc763e6495cac5cbb2e6e77a14114595119d63b5752939d

                                                      • C:\Windows\System32\SubDir\SolaraExecutor.exe

                                                        Filesize

                                                        3.1MB

                                                        MD5

                                                        3cf4f19b7c69135acb3c4c9bb9cdfb90

                                                        SHA1

                                                        e2b5a40dd2abfa03671fde7c4e74f9b2846f989f

                                                        SHA256

                                                        6aabee552a530d63bdabc02cbe5714fcb7e1f9c826acb0b27ad267d50065cdaf

                                                        SHA512

                                                        4b4237eaf8ca42456b5ce183c83ba3f0cd382dfa5ae775a9433db4f7091ac0295267e80fcd93861a1022288ebf7c3a9d3b7caa07423f75c0b685812bf97996cd

                                                      • \??\PIPE\lsarpc

                                                        MD5

                                                        d41d8cd98f00b204e9800998ecf8427e

                                                        SHA1

                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                        SHA256

                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                        SHA512

                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                      • memory/340-91-0x00000000011B0000-0x00000000014D4000-memory.dmp

                                                        Filesize

                                                        3.1MB

                                                      • memory/1248-56-0x0000000000120000-0x0000000000444000-memory.dmp

                                                        Filesize

                                                        3.1MB

                                                      • memory/1444-67-0x00000000010F0000-0x0000000001414000-memory.dmp

                                                        Filesize

                                                        3.1MB

                                                      • memory/1632-134-0x00000000000A0000-0x00000000003C4000-memory.dmp

                                                        Filesize

                                                        3.1MB

                                                      • memory/2064-146-0x0000000001220000-0x0000000001544000-memory.dmp

                                                        Filesize

                                                        3.1MB

                                                      • memory/2168-44-0x0000000001040000-0x0000000001364000-memory.dmp

                                                        Filesize

                                                        3.1MB

                                                      • memory/2200-22-0x0000000000280000-0x00000000005A4000-memory.dmp

                                                        Filesize

                                                        3.1MB

                                                      • memory/2624-33-0x0000000000030000-0x0000000000354000-memory.dmp

                                                        Filesize

                                                        3.1MB

                                                      • memory/2744-20-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

                                                        Filesize

                                                        9.9MB

                                                      • memory/2744-8-0x0000000000D20000-0x0000000001044000-memory.dmp

                                                        Filesize

                                                        3.1MB

                                                      • memory/2744-10-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

                                                        Filesize

                                                        9.9MB

                                                      • memory/2744-9-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

                                                        Filesize

                                                        9.9MB

                                                      • memory/2916-7-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

                                                        Filesize

                                                        9.9MB

                                                      • memory/2916-0-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2916-2-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

                                                        Filesize

                                                        9.9MB

                                                      • memory/2916-1-0x0000000000EF0000-0x0000000001214000-memory.dmp

                                                        Filesize

                                                        3.1MB