quasar | e1dd16d3d0550466cd1e5efa60ea8f0d3b204f52ddccb4b58d46a7dba9dc5587

Analysis

max time kernel
142s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-12-2024 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

749286088524b5c49a9f6fd5dd15de49
SHA1

bc255bc2f5a7f50e8fec2e5eca55c82de0bb15a2
SHA256

e1dd16d3d0550466cd1e5efa60ea8f0d3b204f52ddccb4b58d46a7dba9dc5587
SHA512

b0ac4798d04e443f6e795e718bf301a885bc96ab2bd12f4d2b14d47e75aa897b5f53c22dab14b95a12a4f2e177d86a78a0af08ab916906a9a9ce7eb0b860dd8e
SSDEEP

49152:WvWI22SsaNYfdPBldt698dBcjHSlRJ6ibR3LoGd09THHB72eh2NT:Wv722SsaNYfdPBldt6+dBcjHSlRJ6c

Score

10^/10

quasar kdotcrypt discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

KDOTCrypt

fedx.ddns.net:7000

Mutex

f70e50c5-1467-4cc3-8be1-b4ca15c11c35

Attributes

encryption_key
92470F4731518ABFA77DC89068544FB7E7B7C459
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4904-1-0x0000000000F60000-0x0000000001284000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Client-built.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1424	PING.EXE
1088	PING.EXE
4388	PING.EXE
1832	PING.EXE
852	PING.EXE
4176	PING.EXE
1536	PING.EXE
3932	PING.EXE
4144	PING.EXE
3028	PING.EXE
4816	PING.EXE
2648	PING.EXE
1132	PING.EXE
1964	PING.EXE
3736	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
852	PING.EXE
1964	PING.EXE
3736	PING.EXE
2648	PING.EXE
3932	PING.EXE
4144	PING.EXE
1132	PING.EXE
1088	PING.EXE
4388	PING.EXE
3028	PING.EXE
4816	PING.EXE
4176	PING.EXE
1424	PING.EXE
1536	PING.EXE
1832	PING.EXE

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	Client-built.exe
Token: SeDebugPrivilege	2356	Client-built.exe
Token: SeDebugPrivilege	2348	Client-built.exe
Token: SeDebugPrivilege	4040	Client-built.exe
Token: SeDebugPrivilege	2396	Client-built.exe
Token: SeDebugPrivilege	4596	Client-built.exe
Token: SeDebugPrivilege	2144	Client-built.exe
Token: SeDebugPrivilege	540	Client-built.exe
Token: SeDebugPrivilege	1820	Client-built.exe
Token: SeDebugPrivilege	760	Client-built.exe
Token: SeDebugPrivilege	4904	Client-built.exe
Token: SeDebugPrivilege	944	Client-built.exe
Token: SeDebugPrivilege	3480	Client-built.exe
Token: SeDebugPrivilege	3056	Client-built.exe
Token: SeDebugPrivilege	712	Client-built.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 912	4904	Client-built.exe	83
PID 4904 wrote to memory of 912	4904	Client-built.exe	83
PID 912 wrote to memory of 1824	912	cmd.exe	85
PID 912 wrote to memory of 1824	912	cmd.exe	85
PID 912 wrote to memory of 1132	912	cmd.exe	86
PID 912 wrote to memory of 1132	912	cmd.exe	86
PID 912 wrote to memory of 2356	912	cmd.exe	97
PID 912 wrote to memory of 2356	912	cmd.exe	97
PID 2356 wrote to memory of 4908	2356	Client-built.exe	101
PID 2356 wrote to memory of 4908	2356	Client-built.exe	101
PID 4908 wrote to memory of 1700	4908	cmd.exe	103
PID 4908 wrote to memory of 1700	4908	cmd.exe	103
PID 4908 wrote to memory of 852	4908	cmd.exe	104
PID 4908 wrote to memory of 852	4908	cmd.exe	104
PID 4908 wrote to memory of 2348	4908	cmd.exe	105
PID 4908 wrote to memory of 2348	4908	cmd.exe	105
PID 2348 wrote to memory of 4256	2348	Client-built.exe	107
PID 2348 wrote to memory of 4256	2348	Client-built.exe	107
PID 4256 wrote to memory of 2312	4256	cmd.exe	109
PID 4256 wrote to memory of 2312	4256	cmd.exe	109
PID 4256 wrote to memory of 1964	4256	cmd.exe	110
PID 4256 wrote to memory of 1964	4256	cmd.exe	110
PID 4256 wrote to memory of 4040	4256	cmd.exe	113
PID 4256 wrote to memory of 4040	4256	cmd.exe	113
PID 4040 wrote to memory of 3964	4040	Client-built.exe	115
PID 4040 wrote to memory of 3964	4040	Client-built.exe	115
PID 3964 wrote to memory of 1628	3964	cmd.exe	117
PID 3964 wrote to memory of 1628	3964	cmd.exe	117
PID 3964 wrote to memory of 4176	3964	cmd.exe	118
PID 3964 wrote to memory of 4176	3964	cmd.exe	118
PID 3964 wrote to memory of 2396	3964	cmd.exe	121
PID 3964 wrote to memory of 2396	3964	cmd.exe	121
PID 2396 wrote to memory of 4144	2396	Client-built.exe	123
PID 2396 wrote to memory of 4144	2396	Client-built.exe	123
PID 4144 wrote to memory of 536	4144	cmd.exe	125
PID 4144 wrote to memory of 536	4144	cmd.exe	125
PID 4144 wrote to memory of 1424	4144	cmd.exe	126
PID 4144 wrote to memory of 1424	4144	cmd.exe	126
PID 4144 wrote to memory of 4596	4144	cmd.exe	128
PID 4144 wrote to memory of 4596	4144	cmd.exe	128
PID 4596 wrote to memory of 4600	4596	Client-built.exe	130
PID 4596 wrote to memory of 4600	4596	Client-built.exe	130
PID 4600 wrote to memory of 2460	4600	cmd.exe	132
PID 4600 wrote to memory of 2460	4600	cmd.exe	132
PID 4600 wrote to memory of 3932	4600	cmd.exe	133
PID 4600 wrote to memory of 3932	4600	cmd.exe	133
PID 4600 wrote to memory of 2144	4600	cmd.exe	134
PID 4600 wrote to memory of 2144	4600	cmd.exe	134
PID 2144 wrote to memory of 2204	2144	Client-built.exe	136
PID 2144 wrote to memory of 2204	2144	Client-built.exe	136
PID 2204 wrote to memory of 3928	2204	cmd.exe	138
PID 2204 wrote to memory of 3928	2204	cmd.exe	138
PID 2204 wrote to memory of 1088	2204	cmd.exe	139
PID 2204 wrote to memory of 1088	2204	cmd.exe	139
PID 2204 wrote to memory of 540	2204	cmd.exe	141
PID 2204 wrote to memory of 540	2204	cmd.exe	141
PID 540 wrote to memory of 3824	540	Client-built.exe	143
PID 540 wrote to memory of 3824	540	Client-built.exe	143
PID 3824 wrote to memory of 4452	3824	cmd.exe	145
PID 3824 wrote to memory of 4452	3824	cmd.exe	145
PID 3824 wrote to memory of 1536	3824	cmd.exe	146
PID 3824 wrote to memory of 1536	3824	cmd.exe	146
PID 3824 wrote to memory of 1820	3824	cmd.exe	148
PID 3824 wrote to memory of 1820	3824	cmd.exe	148

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qWWEK83BpvSR.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1824
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OxOsjkQCg6pt.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4908
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1700
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:852
    - - C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2348
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0ZdpwWLudMAD.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2312
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        7⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXKqkuYvv3Qj.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1628
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6eRnVfvUncpx.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:536
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        11⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ATm3H4h40Qk7.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:2460
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        13⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Fw75m2JdrFv2.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:3928
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        15⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ro6n2l6AuJ9Z.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3824
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:4452
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        17⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tJaw6iSPjWFJ.bat" "
        18⤵
        
        PID:3540
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:4964
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        19⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7TXQ2Sb5VgVc.bat" "
        20⤵
        
        PID:2560
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:2184
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        21⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zBQZ5ADdCVrf.bat" "
        22⤵
        
        PID:3704
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:3376
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        23⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VvF8RI2ujKRl.bat" "
        24⤵
        
        PID:3348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:4560
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        25⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pJw8zjo8pLVS.bat" "
        26⤵
        
        PID:4064
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:852
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        27⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1mZkfN6t1SpR.bat" "
        28⤵
        
        PID:4456
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:3304
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        29⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c7R8ASGw5VZZ.bat" "
        30⤵
        
        PID:1848
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:2980
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        31⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client-built.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\0ZdpwWLudMAD.bat

Filesize
209B

MD5
57ad286146d8ab515ac2ba839ac0edd6

SHA1
5adcc0a7310e9b2a3174d5e0db79120f1fb0d8de

SHA256
ad1e23f82a6ba74f179dcbbf7ef0ce4aedb4b6d3d574db79d43561cfc8bcab34

SHA512
71e124cc4d11a456dae066f4311afa6b9b5ba52da3ab83fce78c4158871bd3e6e00bfee365c881beb15fd762dded1a027b68952ad5d313df5f4adae40fa4de5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1mZkfN6t1SpR.bat

Filesize
209B

MD5
0cbb5a11281e0ec2818413ddf8f6959e

SHA1
b49314ac67c365f40b7ea84668a8499e0945ffe8

SHA256
a21dbcf63d905291b6e769eb13336ecc92ef61c11a9137f0b2adb2a4166add7a

SHA512
96ebde42cc619742339edfc996a10ee1d3f3bb2d1490251258c64777f4548a6f2a05f4f58fe11975b34652b77eaf70125c834a1725e6435cd170439b54ea4575

Download Submit
C:\Users\Admin\AppData\Local\Temp\6eRnVfvUncpx.bat

Filesize
209B

MD5
b000f508ce0df9474a36b7e9ad9f57cc

SHA1
aae27e89b34d8313101f3988a704df263f1db25b

SHA256
3f70db9d7b7e94aec8d22b929eeafdbae223fe19f2c58b1917e5603a93a0e598

SHA512
78e8cf043e2b92085bb272417fc91a12f8be8960f0ce89314825ca6a5f47f075190eee14ee427fc69bf4f81686c6af348ff9d797646e898fa0dbe606033215fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7TXQ2Sb5VgVc.bat

Filesize
209B

MD5
a4969ab397fb67695b595d27abb4a629

SHA1
df7a9a81849fa79366cd0958a4c26416770d0d67

SHA256
1c533e95679e6058f72eef44cdacbad5a13ba5259d73f19b2b66332af5be5a0c

SHA512
c0404a01f2c4d4e31f2eee97da24e65214f6675e9445d28774bce9318cc950dfe36eb6885953a671b46df24bb52a9055b26dfa256acc2a9d97894ea1b49b7439

Download Submit
C:\Users\Admin\AppData\Local\Temp\ATm3H4h40Qk7.bat

Filesize
209B

MD5
267e96cbd6b3699b18b3115d3316b586

SHA1
6c54fa8c3f2820089e445a49427eea04a8f055e4

SHA256
d1517b4fe58ca4656a4875bd0431c023c6e0fce39f2d3b1200a5d6dc6824b671

SHA512
88286400e4cf1ed8fb17274f657cdd5ae6d940e235a7ec6ed55af2f8cf08da0e3ad478184783851b5b2ec24950f38c6c283e284fd7debbc3aef2c6509951691a

Download Submit
C:\Users\Admin\AppData\Local\Temp\EXKqkuYvv3Qj.bat

Filesize
209B

MD5
83ef05eae2c81fad87ef425b3cab451f

SHA1
bf4307fa6e3e0a10c7abc72320f739cc896ec474

SHA256
ca2015e0a568585f91e9cc44a64afab5bda32d367648b1d6efa01c275c38562b

SHA512
9d64cf897c3f7691d544d9b52644e6ab18ba71d3122f27f7fbe49703d24a0abfc2916fa8569491c62dcaf5a2cf3f15092e3a1c628ba2e112626257aeb104b4c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fw75m2JdrFv2.bat

Filesize
209B

MD5
2235709965085cbc1afd1441b26219d1

SHA1
45d3482398c3e3be88805b44e472e157d80c6e16

SHA256
d1d3cab55284e513eee8807a0f52e063d09517642fceab522c30c42694eb1d4c

SHA512
0c9f3fb37f47254c6cac3953efcd6dbd3f63d540c3687f612df76fceba1cd40363a347e9c1621022b9c1e34efb5135ddb10069aaa8f679f310a675647de657c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\OxOsjkQCg6pt.bat

Filesize
209B

MD5
386435ef8336c1b4100d2c85b61d4db2

SHA1
b6e08c7a4c1ca1e3d659ab36e158ffae2b76de69

SHA256
a1c527ba7661caa7e36943a5a0ec22c34cafe77e612393f032164ca0a9c42e97

SHA512
c9312a5ff100b194114f24fcad5f8f0fbe1f8643fcb29e986cabb8ed6f78adc6b9af7eb42c558ff2044d06d04a5b87ead43e508ec894c1fdeb5a1aef2592ebe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\VvF8RI2ujKRl.bat

Filesize
209B

MD5
1db9c6ffdc5290d52a9bdf2878a4e021

SHA1
107792c2b5c3d5c98166407a76a3a0bd9df9db70

SHA256
dca61a08944fb41c9cbff5b39822e5ee377cc23d112a773f3b1bd694e2038b2c

SHA512
05c370299d44c6a147f641d44489c5f998aea3a0d1d7e7658964c99990d0b975a498db2d47523ff47983abcd1fd4c70f58e8f99d4e289b251effb6007f2af57b

Download Submit
C:\Users\Admin\AppData\Local\Temp\c7R8ASGw5VZZ.bat

Filesize
209B

MD5
d65622433c9569148a65e8ce6139c23c

SHA1
8cf402b2b2416722203c6e4770cf55259eeca904

SHA256
71d05937ae4e15b7ec90915724750bbe9d4534d6ce9c5c0c15efec12fd85017c

SHA512
a77ec0d8450569f03d0fa6180631fe51180e9435569d262d6435a671e332c8c5cc45a7d9f008e68877506432190e48656031aa8b0afa17d61d411ab02ae6145e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pJw8zjo8pLVS.bat

Filesize
209B

MD5
e75a58c45e7dfa73b924249ab62d51ee

SHA1
1fe91ec71deb791b282916dea6d17dcb5c2f171d

SHA256
df083d291d151a93d212e0452b7cf68e42651e17b6ee9870851d56b3933b4759

SHA512
53a1caf8099e0981083ab1b53712e29ae7918ff7031a5d6008bf8c3d88e50bd3d96190f785aa08f939ffa957fd5d217e21cdb3c85f347caeb5e33bae5268308b

Download Submit
C:\Users\Admin\AppData\Local\Temp\qWWEK83BpvSR.bat

Filesize
209B

MD5
d8b3f7636c3dd3dd18602939d05ea67f

SHA1
2d7e5a6e9999073d34e077884f2931150be7c8d2

SHA256
eaf91411b174890030dc10b7e3305653661aeb4feb3a04f0269d16392578fdef

SHA512
5216655e30152f262d4f92ea4e54e09ed3ba86350cfa9a2a55a0f58272a1ea5ea4c2ad8739f25a995e1cd6f524cd1664a6da8d5ed5e7e51e65c8c8f706e31b85

Download Submit
C:\Users\Admin\AppData\Local\Temp\ro6n2l6AuJ9Z.bat

Filesize
209B

MD5
468d8b4ef3c8bc739a5dfa83fe595ee0

SHA1
40d24d3bce2c4941eda5644e6c6111da73f5e6f2

SHA256
79cda1777824f4e9c077b1feae0dae655c0543a8249b4bc9f318788b00b6d3d7

SHA512
bce1c76b0a4fc0cf469b5c91a04f1df3f8e1119727518db77161e97fbebb306156481874336299a56242278c5ca3bce25455b19da82b56f996fc385b83c9e0b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tJaw6iSPjWFJ.bat

Filesize
209B

MD5
89b2d017c28cbfb6046c07dde7a7c718

SHA1
a335967362feca7dacbf5e650f1eaba0749a78e3

SHA256
82f88b7558df4e065f4485274ab5ecc20ef111cd5e65778de20d6c3eb540e109

SHA512
db9ada9ad5e86d21cc847fca36785ff4b85882a795bf99de6e71084dedcc998c2a6364d5988446e4890cb35baae8c9ff8fa19fce27f32da8246ddb5156fcb1f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\zBQZ5ADdCVrf.bat

Filesize
209B

MD5
1530e0126bc3722529646ef3d24fb922

SHA1
055207e340916017c6bd51ce4c9082d2f8a07fb3

SHA256
30e3052bf14925d5f32254a6b8e1eef21a299f8988d09a22d661df1300dcf5cb

SHA512
2ad618373eaf68f523ac0e29e1872deafac74ebd19fe06582e95379f5138fcf8af5ce09ec28810cc6824342ec2427c3f078fa68bfaf2e7d9a52576adf92f4a52

Download Submit
memory/2356-17-0x00007FF887B50000-0x00007FF888611000-memory.dmp

Filesize
10.8MB

Download
memory/2356-13-0x00007FF887B50000-0x00007FF888611000-memory.dmp

Filesize
10.8MB

Download
memory/2356-12-0x00007FF887B50000-0x00007FF888611000-memory.dmp

Filesize
10.8MB

Download
memory/4904-0-0x00007FF887D13000-0x00007FF887D15000-memory.dmp

Filesize
8KB

Download
memory/4904-9-0x00007FF887D10000-0x00007FF8887D1000-memory.dmp

Filesize
10.8MB

Download
memory/4904-4-0x000000001C340000-0x000000001C3F2000-memory.dmp

Filesize
712KB

Download
memory/4904-3-0x000000001C230000-0x000000001C280000-memory.dmp

Filesize
320KB

Download
memory/4904-2-0x00007FF887D10000-0x00007FF8887D1000-memory.dmp

Filesize
10.8MB

Download
memory/4904-1-0x0000000000F60000-0x0000000001284000-memory.dmp

Filesize
3.1MB

Download