quasar | c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b

Analysis

max time kernel
108s
max time network
138s
platform
windows10-1703_x64
resource
win10-20220718-en
resource tags

arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system
submitted
26-07-2022 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
Size

879KB
MD5

3295138274c034c16522257d6c18f225
SHA1

6f93c0800221d86ec8de5636195383f91cb9a336
SHA256

c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b
SHA512

7fb76b1bd0ec1d7e631c44d9cb82f06c6f2145b9a7797c5c8b18f3752bf18daec6ba57802bd178f630bcb9f9f20fc4486568a92e474d6499366e57f3e5bc81a3

Score

10^/10

quasar venomrat bomboclat evasion rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Bomboclat

185.236.78.58:4782

Mutex

VNM_MUTEX_mtYiaCcGzveD5dsvgE

Attributes

encryption_key
1WEWg6889GqBWLC1XKxQ
install_name
WndowsSecurityUpdate.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Wndows Dfender Update Startup
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 4 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2504-184-0x0000000000400000-0x00000000004B6000-memory.dmp	disable_win_def
behavioral1/memory/2504-185-0x0000000000486C6E-mapping.dmp	disable_win_def
behavioral1/memory/1992-701-0x0000000000486C6E-mapping.dmp	disable_win_def
behavioral1/memory/1920-904-0x0000000000486C6E-mapping.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2504-184-0x0000000000400000-0x00000000004B6000-memory.dmp	family_quasar
behavioral1/memory/2504-185-0x0000000000486C6E-mapping.dmp	family_quasar
behavioral1/memory/1992-701-0x0000000000486C6E-mapping.dmp	family_quasar
behavioral1/memory/1920-904-0x0000000000486C6E-mapping.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Executes dropped EXE 2 IoCs

Processes:

WndowsSecurityUpdate.exeWndowsSecurityUpdate.exe

pid	Process
592	WndowsSecurityUpdate.exe
1992	WndowsSecurityUpdate.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
10	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exeWndowsSecurityUpdate.exec063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe

description	pid	Process	procid_target
PID 1264 set thread context of 2504	1264	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	67
PID 592 set thread context of 1992	592	WndowsSecurityUpdate.exe	77
PID 2724 set thread context of 1920	2724	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exe

pid	Process
3856	schtasks.exe
704	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
1564	PING.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exec063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exec063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe

pid	Process
696	powershell.exe
696	powershell.exe
696	powershell.exe
2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
1920	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exepowershell.exeWndowsSecurityUpdate.exec063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe

description	pid	Process
Token: SeDebugPrivilege	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
Token: SeDebugPrivilege	696	powershell.exe
Token: SeDebugPrivilege	1992	WndowsSecurityUpdate.exe
Token: SeDebugPrivilege	1992	WndowsSecurityUpdate.exe
Token: SeDebugPrivilege	1920	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WndowsSecurityUpdate.exe

pid	Process
1992	WndowsSecurityUpdate.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exec063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.execmd.exeWndowsSecurityUpdate.exeWndowsSecurityUpdate.execmd.exec063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe

description	pid	Process	procid_target
PID 1264 wrote to memory of 2504	1264	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	67
PID 1264 wrote to memory of 2504	1264	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	67
PID 1264 wrote to memory of 2504	1264	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	67
PID 1264 wrote to memory of 2504	1264	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	67
PID 1264 wrote to memory of 2504	1264	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	67
PID 1264 wrote to memory of 2504	1264	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	67
PID 1264 wrote to memory of 2504	1264	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	67
PID 1264 wrote to memory of 2504	1264	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	67
PID 2504 wrote to memory of 3856	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	69
PID 2504 wrote to memory of 3856	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	69
PID 2504 wrote to memory of 3856	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	69
PID 2504 wrote to memory of 592	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	71
PID 2504 wrote to memory of 592	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	71
PID 2504 wrote to memory of 592	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	71
PID 2504 wrote to memory of 696	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	72
PID 2504 wrote to memory of 696	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	72
PID 2504 wrote to memory of 696	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	72
PID 2504 wrote to memory of 2628	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	74
PID 2504 wrote to memory of 2628	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	74
PID 2504 wrote to memory of 2628	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	74
PID 2628 wrote to memory of 3336	2628	cmd.exe	76
PID 2628 wrote to memory of 3336	2628	cmd.exe	76
PID 2628 wrote to memory of 3336	2628	cmd.exe	76
PID 592 wrote to memory of 1992	592	WndowsSecurityUpdate.exe	77
PID 592 wrote to memory of 1992	592	WndowsSecurityUpdate.exe	77
PID 592 wrote to memory of 1992	592	WndowsSecurityUpdate.exe	77
PID 592 wrote to memory of 1992	592	WndowsSecurityUpdate.exe	77
PID 592 wrote to memory of 1992	592	WndowsSecurityUpdate.exe	77
PID 592 wrote to memory of 1992	592	WndowsSecurityUpdate.exe	77
PID 592 wrote to memory of 1992	592	WndowsSecurityUpdate.exe	77
PID 592 wrote to memory of 1992	592	WndowsSecurityUpdate.exe	77
PID 1992 wrote to memory of 704	1992	WndowsSecurityUpdate.exe	78
PID 1992 wrote to memory of 704	1992	WndowsSecurityUpdate.exe	78
PID 1992 wrote to memory of 704	1992	WndowsSecurityUpdate.exe	78
PID 2504 wrote to memory of 388	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	79
PID 2504 wrote to memory of 388	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	79
PID 2504 wrote to memory of 388	2504	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	79
PID 388 wrote to memory of 3376	388	cmd.exe	82
PID 388 wrote to memory of 3376	388	cmd.exe	82
PID 388 wrote to memory of 3376	388	cmd.exe	82
PID 388 wrote to memory of 1564	388	cmd.exe	83
PID 388 wrote to memory of 1564	388	cmd.exe	83
PID 388 wrote to memory of 1564	388	cmd.exe	83
PID 388 wrote to memory of 2724	388	cmd.exe	84
PID 388 wrote to memory of 2724	388	cmd.exe	84
PID 388 wrote to memory of 2724	388	cmd.exe	84
PID 2724 wrote to memory of 1920	2724	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	85
PID 2724 wrote to memory of 1920	2724	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	85
PID 2724 wrote to memory of 1920	2724	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	85
PID 2724 wrote to memory of 1920	2724	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	85
PID 2724 wrote to memory of 1920	2724	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	85
PID 2724 wrote to memory of 1920	2724	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	85
PID 2724 wrote to memory of 1920	2724	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	85
PID 2724 wrote to memory of 1920	2724	c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe	85

C:\Users\Admin\AppData\Local\Temp\c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
"C:\Users\Admin\AppData\Local\Temp\c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
  "{path}"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Wndows Dfender Update Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3856
- - C:\Users\Admin\AppData\Roaming\SubDir\WndowsSecurityUpdate.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\WndowsSecurityUpdate.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:592
  - - C:\Users\Admin\AppData\Roaming\SubDir\WndowsSecurityUpdate.exe
      "{path}"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1992
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Wndows Dfender Update Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WndowsSecurityUpdate.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:704
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:696
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      PID:3336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B7835FV4VeOS.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:388
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:3376
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
      "C:\Users\Admin\AppData\Local\Temp\c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe
        
        "{path}"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WndowsSecurityUpdate.exe.log

Filesize
1KB

MD5
c3cc52ccca9ff2b6fa8d267fc350ca6b

SHA1
a68d4028333296d222e4afd75dea36fdc98d05f3

SHA256
3125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e

SHA512
b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b.exe.log

Filesize
1KB

MD5
c3cc52ccca9ff2b6fa8d267fc350ca6b

SHA1
a68d4028333296d222e4afd75dea36fdc98d05f3

SHA256
3125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e

SHA512
b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\B7835FV4VeOS.bat

Filesize
261B

MD5
671cfb124cf3c1b68becb68a35d1559d

SHA1
409e3ba46c2421a500aa56bda3f6d5564d2fc25b

SHA256
9fc44cc9cebc3fc1e2f936364c64ccbd3b8255da400e1bcd13b313cc073ca40e

SHA512
8ea4f178a1791a19186a470b654604d3084b82f27518e01eb56cd7e7229e0545e0e256dff0e5906949686a6107fed90818ee271ec1fd5ae76acb1cb66eaeec5b

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\WndowsSecurityUpdate.exe

Filesize
879KB

MD5
3295138274c034c16522257d6c18f225

SHA1
6f93c0800221d86ec8de5636195383f91cb9a336

SHA256
c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b

SHA512
7fb76b1bd0ec1d7e631c44d9cb82f06c6f2145b9a7797c5c8b18f3752bf18daec6ba57802bd178f630bcb9f9f20fc4486568a92e474d6499366e57f3e5bc81a3

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\WndowsSecurityUpdate.exe

Filesize
879KB

MD5
3295138274c034c16522257d6c18f225

SHA1
6f93c0800221d86ec8de5636195383f91cb9a336

SHA256
c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b

SHA512
7fb76b1bd0ec1d7e631c44d9cb82f06c6f2145b9a7797c5c8b18f3752bf18daec6ba57802bd178f630bcb9f9f20fc4486568a92e474d6499366e57f3e5bc81a3

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\WndowsSecurityUpdate.exe

Filesize
879KB

MD5
3295138274c034c16522257d6c18f225

SHA1
6f93c0800221d86ec8de5636195383f91cb9a336

SHA256
c063f14a72b49e90fe7862e4402540c2227abf2f063c9a8f63af90d4a6ab5e5b

SHA512
7fb76b1bd0ec1d7e631c44d9cb82f06c6f2145b9a7797c5c8b18f3752bf18daec6ba57802bd178f630bcb9f9f20fc4486568a92e474d6499366e57f3e5bc81a3

Download Submit
memory/388-781-0x0000000000000000-mapping.dmp

Download
memory/592-286-0x0000000000000000-mapping.dmp

Download
memory/696-417-0x0000000008000000-0x0000000008076000-memory.dmp

Filesize
472KB

Download
memory/696-409-0x0000000007900000-0x0000000007C50000-memory.dmp

Filesize
3.3MB

Download
memory/696-431-0x0000000009050000-0x000000000906E000-memory.dmp

Filesize
120KB

Download
memory/696-430-0x0000000009070000-0x00000000090A3000-memory.dmp

Filesize
204KB

Download
memory/696-444-0x0000000009380000-0x0000000009414000-memory.dmp

Filesize
592KB

Download
memory/696-413-0x0000000007CF0000-0x0000000007D3B000-memory.dmp

Filesize
300KB

Download
memory/696-412-0x0000000007110000-0x000000000712C000-memory.dmp

Filesize
112KB

Download
memory/696-440-0x00000000091B0000-0x0000000009255000-memory.dmp

Filesize
660KB

Download
memory/696-408-0x0000000006FA0000-0x0000000007006000-memory.dmp

Filesize
408KB

Download
memory/696-405-0x0000000006F00000-0x0000000006F22000-memory.dmp

Filesize
136KB

Download
memory/696-381-0x00000000071D0000-0x00000000077F8000-memory.dmp

Filesize
6.2MB

Download
memory/696-366-0x00000000044C0000-0x00000000044F6000-memory.dmp

Filesize
216KB

Download
memory/696-647-0x0000000009320000-0x000000000933A000-memory.dmp

Filesize
104KB

Download
memory/696-289-0x0000000000000000-mapping.dmp

Download
memory/696-652-0x0000000009310000-0x0000000009318000-memory.dmp

Filesize
32KB

Download
memory/704-779-0x0000000000000000-mapping.dmp

Download
memory/1264-144-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-182-0x00000000085E0000-0x000000000869C000-memory.dmp

Filesize
752KB

Download
memory/1264-143-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-117-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-145-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-146-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-147-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-148-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-149-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-150-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-151-0x0000000000D20000-0x0000000000E02000-memory.dmp

Filesize
904KB

Download
memory/1264-152-0x0000000005C50000-0x000000000614E000-memory.dmp

Filesize
5.0MB

Download
memory/1264-153-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-154-0x0000000005640000-0x00000000056D2000-memory.dmp

Filesize
584KB

Download
memory/1264-155-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-156-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-157-0x00000000057F0000-0x000000000588C000-memory.dmp

Filesize
624KB

Download
memory/1264-158-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-159-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-160-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-161-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-162-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-163-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-164-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-165-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-166-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-167-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-168-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-169-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-170-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-171-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-172-0x0000000005620000-0x000000000562A000-memory.dmp

Filesize
40KB

Download
memory/1264-173-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-174-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-175-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-176-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-177-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-178-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-179-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-180-0x00000000057B0000-0x00000000057BA000-memory.dmp

Filesize
40KB

Download
memory/1264-181-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-142-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-183-0x000000000AF50000-0x000000000B006000-memory.dmp

Filesize
728KB

Download
memory/1264-118-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-119-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-120-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-121-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-189-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-122-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-141-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-123-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-124-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-125-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-126-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-140-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-139-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-138-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-137-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-136-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-135-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-134-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-133-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-132-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-131-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-130-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-129-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-128-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1264-127-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/1564-822-0x0000000000000000-mapping.dmp

Download
memory/1920-904-0x0000000000486C6E-mapping.dmp

Download
memory/1992-701-0x0000000000486C6E-mapping.dmp

Download
memory/2504-184-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2504-264-0x0000000006660000-0x000000000669E000-memory.dmp

Filesize
248KB

Download
memory/2504-243-0x0000000005670000-0x0000000005682000-memory.dmp

Filesize
72KB

Download
memory/2504-233-0x0000000005230000-0x0000000005296000-memory.dmp

Filesize
408KB

Download
memory/2504-188-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/2504-187-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/2504-186-0x0000000077A50000-0x0000000077BDE000-memory.dmp

Filesize
1.6MB

Download
memory/2504-185-0x0000000000486C6E-mapping.dmp

Download
memory/2628-686-0x0000000000000000-mapping.dmp

Download
memory/2724-845-0x0000000000000000-mapping.dmp

Download
memory/3336-692-0x0000000000000000-mapping.dmp

Download
memory/3376-813-0x0000000000000000-mapping.dmp

Download
memory/3856-266-0x0000000000000000-mapping.dmp

Download