Analysis
-
max time kernel
130s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 14:28
Static task
static1
Behavioral task
behavioral1
Sample
94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33.exe
Resource
win7-20220812-en
General
-
Target
94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33.exe
-
Size
680KB
-
MD5
4f99850bfde0c6703b4f2c8420b9dc8f
-
SHA1
c60d92f1e0529b2e770858e180906bf9fae631a9
-
SHA256
94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33
-
SHA512
0d311592bc2dc5ececb3afae6dee5842b9f6a37710d29f5f1a3fe8a27d3e43a625a57039bef92044744d8a0225c52260cc9757b148deb9e0c4e72781e1a89aec
-
SSDEEP
12288:75393whFOBbQVXQsI6f9fqAPzzEeEZchCBywRiaxJDj8DkIonQmP0Ove/diuHc:753uhF7VAibzzEe9wRiaLSkI8QhOQ18
Malware Config
Extracted
quasar
2.1.0.0
ajith
23.105.131.178:7812
VNM_MUTEX_NdVd2sPSSqFdo7I35g
-
encryption_key
jyerms3KOWmt3C9DBFuq
-
install_name
Windows Defender Security.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
SubDir
Signatures
-
Contains code to disable Windows Defender 7 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/936-66-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/936-67-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/936-68-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/936-69-0x0000000000486C4E-mapping.dmp disable_win_def behavioral1/memory/936-74-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/936-72-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1956-91-0x0000000000486C4E-mapping.dmp disable_win_def -
Processes:
Windows Security.exe_protected.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Windows Security.exe_protected.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Windows Security.exe_protected.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Windows Security.exe_protected.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Windows Security.exe_protected.exe -
Quasar payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/936-66-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/936-67-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/936-68-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/936-69-0x0000000000486C4E-mapping.dmp family_quasar behavioral1/memory/936-74-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/936-72-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1956-91-0x0000000000486C4E-mapping.dmp family_quasar -
Executes dropped EXE 5 IoCs
Processes:
Windows Security.exe_protected.exeWindows Security.exe_protected.exeWindows Defender Security.exeWindows Defender Security.exeWindows Defender Security.exepid process 664 Windows Security.exe_protected.exe 936 Windows Security.exe_protected.exe 1116 Windows Defender Security.exe 2004 Windows Defender Security.exe 1956 Windows Defender Security.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1160 cmd.exe -
Loads dropped DLL 3 IoCs
Processes:
94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33.exeWindows Security.exe_protected.exeWindows Security.exe_protected.exepid process 1092 94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33.exe 664 Windows Security.exe_protected.exe 936 Windows Security.exe_protected.exe -
Processes:
Windows Security.exe_protected.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features Windows Security.exe_protected.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Windows Security.exe_protected.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
Windows Security.exe_protected.exeWindows Security.exe_protected.exeWindows Defender Security.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe" Windows Security.exe_protected.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\Windows Security.exe_protected.exe\"" Windows Security.exe_protected.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Windows Defender Security.exe\"" Windows Defender Security.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Windows Security.exe_protected.exeWindows Defender Security.exedescription pid process target process PID 664 set thread context of 936 664 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 1116 set thread context of 1956 1116 Windows Defender Security.exe Windows Defender Security.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1252 schtasks.exe 1564 schtasks.exe -
Processes:
Windows Security.exe_protected.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Windows Security.exe_protected.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Windows Security.exe_protected.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Windows Defender Security.exepowershell.exeWindows Security.exe_protected.exepid process 1116 Windows Defender Security.exe 1116 Windows Defender Security.exe 2020 powershell.exe 936 Windows Security.exe_protected.exe 936 Windows Security.exe_protected.exe 936 Windows Security.exe_protected.exe 936 Windows Security.exe_protected.exe 936 Windows Security.exe_protected.exe 936 Windows Security.exe_protected.exe 936 Windows Security.exe_protected.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Windows Security.exe_protected.exeWindows Defender Security.exeWindows Defender Security.exepowershell.exedescription pid process Token: SeDebugPrivilege 936 Windows Security.exe_protected.exe Token: SeDebugPrivilege 1116 Windows Defender Security.exe Token: SeDebugPrivilege 1956 Windows Defender Security.exe Token: SeDebugPrivilege 1956 Windows Defender Security.exe Token: SeDebugPrivilege 2020 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Windows Defender Security.exepid process 1956 Windows Defender Security.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33.exeWindows Security.exe_protected.exeWindows Security.exe_protected.exeWindows Defender Security.exeWindows Defender Security.execmd.execmd.exedescription pid process target process PID 1092 wrote to memory of 664 1092 94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33.exe Windows Security.exe_protected.exe PID 1092 wrote to memory of 664 1092 94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33.exe Windows Security.exe_protected.exe PID 1092 wrote to memory of 664 1092 94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33.exe Windows Security.exe_protected.exe PID 1092 wrote to memory of 664 1092 94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33.exe Windows Security.exe_protected.exe PID 664 wrote to memory of 936 664 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 664 wrote to memory of 936 664 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 664 wrote to memory of 936 664 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 664 wrote to memory of 936 664 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 664 wrote to memory of 936 664 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 664 wrote to memory of 936 664 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 664 wrote to memory of 936 664 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 664 wrote to memory of 936 664 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 664 wrote to memory of 936 664 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 936 wrote to memory of 1564 936 Windows Security.exe_protected.exe schtasks.exe PID 936 wrote to memory of 1564 936 Windows Security.exe_protected.exe schtasks.exe PID 936 wrote to memory of 1564 936 Windows Security.exe_protected.exe schtasks.exe PID 936 wrote to memory of 1564 936 Windows Security.exe_protected.exe schtasks.exe PID 936 wrote to memory of 1116 936 Windows Security.exe_protected.exe Windows Defender Security.exe PID 936 wrote to memory of 1116 936 Windows Security.exe_protected.exe Windows Defender Security.exe PID 936 wrote to memory of 1116 936 Windows Security.exe_protected.exe Windows Defender Security.exe PID 936 wrote to memory of 1116 936 Windows Security.exe_protected.exe Windows Defender Security.exe PID 1116 wrote to memory of 2004 1116 Windows Defender Security.exe Windows Defender Security.exe PID 1116 wrote to memory of 2004 1116 Windows Defender Security.exe Windows Defender Security.exe PID 1116 wrote to memory of 2004 1116 Windows Defender Security.exe Windows Defender Security.exe PID 1116 wrote to memory of 2004 1116 Windows Defender Security.exe Windows Defender Security.exe PID 936 wrote to memory of 2020 936 Windows Security.exe_protected.exe powershell.exe PID 936 wrote to memory of 2020 936 Windows Security.exe_protected.exe powershell.exe PID 936 wrote to memory of 2020 936 Windows Security.exe_protected.exe powershell.exe PID 936 wrote to memory of 2020 936 Windows Security.exe_protected.exe powershell.exe PID 1116 wrote to memory of 1956 1116 Windows Defender Security.exe Windows Defender Security.exe PID 1116 wrote to memory of 1956 1116 Windows Defender Security.exe Windows Defender Security.exe PID 1116 wrote to memory of 1956 1116 Windows Defender Security.exe Windows Defender Security.exe PID 1116 wrote to memory of 1956 1116 Windows Defender Security.exe Windows Defender Security.exe PID 1116 wrote to memory of 1956 1116 Windows Defender Security.exe Windows Defender Security.exe PID 1116 wrote to memory of 1956 1116 Windows Defender Security.exe Windows Defender Security.exe PID 1116 wrote to memory of 1956 1116 Windows Defender Security.exe Windows Defender Security.exe PID 1116 wrote to memory of 1956 1116 Windows Defender Security.exe Windows Defender Security.exe PID 1116 wrote to memory of 1956 1116 Windows Defender Security.exe Windows Defender Security.exe PID 1956 wrote to memory of 1252 1956 Windows Defender Security.exe schtasks.exe PID 1956 wrote to memory of 1252 1956 Windows Defender Security.exe schtasks.exe PID 1956 wrote to memory of 1252 1956 Windows Defender Security.exe schtasks.exe PID 1956 wrote to memory of 1252 1956 Windows Defender Security.exe schtasks.exe PID 936 wrote to memory of 944 936 Windows Security.exe_protected.exe cmd.exe PID 936 wrote to memory of 944 936 Windows Security.exe_protected.exe cmd.exe PID 936 wrote to memory of 944 936 Windows Security.exe_protected.exe cmd.exe PID 936 wrote to memory of 944 936 Windows Security.exe_protected.exe cmd.exe PID 944 wrote to memory of 1160 944 cmd.exe cmd.exe PID 944 wrote to memory of 1160 944 cmd.exe cmd.exe PID 944 wrote to memory of 1160 944 cmd.exe cmd.exe PID 944 wrote to memory of 1160 944 cmd.exe cmd.exe PID 936 wrote to memory of 1340 936 Windows Security.exe_protected.exe cmd.exe PID 936 wrote to memory of 1340 936 Windows Security.exe_protected.exe cmd.exe PID 936 wrote to memory of 1340 936 Windows Security.exe_protected.exe cmd.exe PID 936 wrote to memory of 1340 936 Windows Security.exe_protected.exe cmd.exe PID 1340 wrote to memory of 2044 1340 cmd.exe chcp.com PID 1340 wrote to memory of 2044 1340 cmd.exe chcp.com PID 1340 wrote to memory of 2044 1340 cmd.exe chcp.com PID 1340 wrote to memory of 2044 1340 cmd.exe chcp.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33.exe"C:\Users\Admin\AppData\Local\Temp\94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe" /rl HIGHEST /f6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*5⤵
- Deletes itself
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\vddUngunQ1Xs.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Local\Temp\vddUngunQ1Xs.batFilesize
239B
MD591454e4f299038e55a35479a8346b91d
SHA1be4bc923e3157408ad2e9dc773fbdbedf55835e8
SHA256176aeb0ad066144c2feff1a137230b459557832637289ed1b69af7d86d25fcc6
SHA512ab3772beec68de30b2bf01575516a0f0c3848cd4b42d78e42d3ca022675c99e513a5e1a5b3bac8addf78abafb1df4a35a8b7dbffcff5a6365d9629146dbf9f9f
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
memory/664-61-0x0000000000240000-0x000000000024A000-memory.dmpFilesize
40KB
-
memory/664-59-0x0000000000280000-0x0000000000328000-memory.dmpFilesize
672KB
-
memory/664-56-0x0000000000000000-mapping.dmp
-
memory/936-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/936-66-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/936-72-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/936-69-0x0000000000486C4E-mapping.dmp
-
memory/936-68-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/936-74-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/936-67-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/936-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/944-101-0x0000000000000000-mapping.dmp
-
memory/1092-54-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/1116-78-0x0000000000000000-mapping.dmp
-
memory/1116-81-0x0000000000310000-0x00000000003B8000-memory.dmpFilesize
672KB
-
memory/1160-102-0x0000000000000000-mapping.dmp
-
memory/1252-98-0x0000000000000000-mapping.dmp
-
memory/1340-103-0x0000000000000000-mapping.dmp
-
memory/1564-76-0x0000000000000000-mapping.dmp
-
memory/1956-91-0x0000000000486C4E-mapping.dmp
-
memory/2020-82-0x0000000000000000-mapping.dmp
-
memory/2020-99-0x000000006E8B0000-0x000000006EE5B000-memory.dmpFilesize
5.7MB
-
memory/2020-100-0x000000006E8B0000-0x000000006EE5B000-memory.dmpFilesize
5.7MB
-
memory/2044-105-0x0000000000000000-mapping.dmp