Analysis
-
max time kernel
172s -
max time network
208s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 15:45
Static task
static1
Behavioral task
behavioral1
Sample
4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe
Resource
win7-20221111-en
General
-
Target
4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe
-
Size
606KB
-
MD5
c23863e0d7186334ca69903c6653ae06
-
SHA1
6040256f4dabd5ee5dee6560e04c56f699532db6
-
SHA256
4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72
-
SHA512
b9a7ffaa9a01a488efd29a9f9162c95a8c50f25d2183679f4783ce900319d81f4d375518667959b89bf8df002a869736a2c47bccae3b8ec5844f8f31c2fa7759
-
SSDEEP
12288:HDNN+IaAFB0OLrdd5xSx8G3cK6TsrId6dd4WCWd9nNxtSR9UcN+Pjv:HDr+FqVvL5x4RcKYd83CWd9+UPv
Malware Config
Extracted
quasar
2.1.0.0
hacked
23.105.131.178:7812
VNM_MUTEX_cFzA15c8rYLW8gVTCh
-
encryption_key
VGvtyILUmmcgl2gY0sSm
-
install_name
Windows Security Health Service.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
SubDir
Signatures
-
Contains code to disable Windows Defender 7 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/1256-60-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1256-61-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1256-62-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1256-63-0x0000000000486C0E-mapping.dmp disable_win_def behavioral1/memory/1256-65-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1256-67-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/928-82-0x0000000000486C0E-mapping.dmp disable_win_def -
Processes:
4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe -
Quasar payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1256-60-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1256-61-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1256-62-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1256-63-0x0000000000486C0E-mapping.dmp family_quasar behavioral1/memory/1256-65-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1256-67-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/928-82-0x0000000000486C0E-mapping.dmp family_quasar -
Executes dropped EXE 2 IoCs
Processes:
Windows Security Health Service.exeWindows Security Health Service.exepid process 924 Windows Security Health Service.exe 928 Windows Security Health Service.exe -
Loads dropped DLL 1 IoCs
Processes:
4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exepid process 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe -
Processes:
4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exeWindows Security Health Service.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe" 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Windows Security Health Service.exe\"" Windows Security Health Service.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip-api.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exeWindows Security Health Service.exedescription pid process target process PID 2044 set thread context of 1256 2044 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe PID 924 set thread context of 928 924 Windows Security Health Service.exe Windows Security Health Service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 268 1256 WerFault.exe 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exe4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exepid process 1760 powershell.exe 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exepowershell.exeWindows Security Health Service.exedescription pid process Token: SeDebugPrivilege 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe Token: SeDebugPrivilege 1760 powershell.exe Token: SeDebugPrivilege 928 Windows Security Health Service.exe Token: SeDebugPrivilege 928 Windows Security Health Service.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Windows Security Health Service.exepid process 928 Windows Security Health Service.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exeWindows Security Health Service.exeWindows Security Health Service.execmd.exedescription pid process target process PID 2044 wrote to memory of 1256 2044 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe PID 2044 wrote to memory of 1256 2044 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe PID 2044 wrote to memory of 1256 2044 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe PID 2044 wrote to memory of 1256 2044 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe PID 2044 wrote to memory of 1256 2044 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe PID 2044 wrote to memory of 1256 2044 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe PID 2044 wrote to memory of 1256 2044 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe PID 2044 wrote to memory of 1256 2044 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe PID 2044 wrote to memory of 1256 2044 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe PID 1256 wrote to memory of 1052 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe schtasks.exe PID 1256 wrote to memory of 1052 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe schtasks.exe PID 1256 wrote to memory of 1052 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe schtasks.exe PID 1256 wrote to memory of 1052 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe schtasks.exe PID 1256 wrote to memory of 924 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe Windows Security Health Service.exe PID 1256 wrote to memory of 924 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe Windows Security Health Service.exe PID 1256 wrote to memory of 924 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe Windows Security Health Service.exe PID 1256 wrote to memory of 924 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe Windows Security Health Service.exe PID 924 wrote to memory of 928 924 Windows Security Health Service.exe Windows Security Health Service.exe PID 924 wrote to memory of 928 924 Windows Security Health Service.exe Windows Security Health Service.exe PID 924 wrote to memory of 928 924 Windows Security Health Service.exe Windows Security Health Service.exe PID 924 wrote to memory of 928 924 Windows Security Health Service.exe Windows Security Health Service.exe PID 924 wrote to memory of 928 924 Windows Security Health Service.exe Windows Security Health Service.exe PID 1256 wrote to memory of 1760 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe powershell.exe PID 1256 wrote to memory of 1760 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe powershell.exe PID 1256 wrote to memory of 1760 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe powershell.exe PID 1256 wrote to memory of 1760 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe powershell.exe PID 924 wrote to memory of 928 924 Windows Security Health Service.exe Windows Security Health Service.exe PID 924 wrote to memory of 928 924 Windows Security Health Service.exe Windows Security Health Service.exe PID 924 wrote to memory of 928 924 Windows Security Health Service.exe Windows Security Health Service.exe PID 924 wrote to memory of 928 924 Windows Security Health Service.exe Windows Security Health Service.exe PID 928 wrote to memory of 800 928 Windows Security Health Service.exe schtasks.exe PID 928 wrote to memory of 800 928 Windows Security Health Service.exe schtasks.exe PID 928 wrote to memory of 800 928 Windows Security Health Service.exe schtasks.exe PID 928 wrote to memory of 800 928 Windows Security Health Service.exe schtasks.exe PID 1256 wrote to memory of 1220 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe cmd.exe PID 1256 wrote to memory of 1220 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe cmd.exe PID 1256 wrote to memory of 1220 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe cmd.exe PID 1256 wrote to memory of 1220 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe cmd.exe PID 1220 wrote to memory of 1212 1220 cmd.exe cmd.exe PID 1220 wrote to memory of 1212 1220 cmd.exe cmd.exe PID 1220 wrote to memory of 1212 1220 cmd.exe cmd.exe PID 1220 wrote to memory of 1212 1220 cmd.exe cmd.exe PID 1256 wrote to memory of 268 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe WerFault.exe PID 1256 wrote to memory of 268 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe WerFault.exe PID 1256 wrote to memory of 268 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe WerFault.exe PID 1256 wrote to memory of 268 1256 4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe"C:\Users\Admin\AppData\Local\Temp\4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe"C:\Users\Admin\AppData\Local\Temp\4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Loads dropped DLL
- Windows security modification
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\4e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Security Health Service.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Security Health Service.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Security Health Service.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Security Health Service.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Security Health Service.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 20123⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WEknQP9rN4jp.batFilesize
261B
MD5bc9689263a9bbf07f2f80a3725674809
SHA17a298391b69e80f8588eebbe4c5d61e8eccc77eb
SHA25693bc12c06d681de8ed994b4c4c466b8f198d9dc55a2462eaa8f969d7b0968936
SHA5120129cfa73fe4fb8f52ea1ed6662a75650f565e4a26c5c57e651147cd17c04df5810ee88b1befbefd81fbb2346fe78ad8766eed69c7212a72ab582d614741596c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Security Health Service.exeFilesize
606KB
MD5c23863e0d7186334ca69903c6653ae06
SHA16040256f4dabd5ee5dee6560e04c56f699532db6
SHA2564e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72
SHA512b9a7ffaa9a01a488efd29a9f9162c95a8c50f25d2183679f4783ce900319d81f4d375518667959b89bf8df002a869736a2c47bccae3b8ec5844f8f31c2fa7759
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Security Health Service.exeFilesize
606KB
MD5c23863e0d7186334ca69903c6653ae06
SHA16040256f4dabd5ee5dee6560e04c56f699532db6
SHA2564e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72
SHA512b9a7ffaa9a01a488efd29a9f9162c95a8c50f25d2183679f4783ce900319d81f4d375518667959b89bf8df002a869736a2c47bccae3b8ec5844f8f31c2fa7759
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Security Health Service.exeFilesize
606KB
MD5c23863e0d7186334ca69903c6653ae06
SHA16040256f4dabd5ee5dee6560e04c56f699532db6
SHA2564e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72
SHA512b9a7ffaa9a01a488efd29a9f9162c95a8c50f25d2183679f4783ce900319d81f4d375518667959b89bf8df002a869736a2c47bccae3b8ec5844f8f31c2fa7759
-
\Users\Admin\AppData\Roaming\SubDir\Windows Security Health Service.exeFilesize
606KB
MD5c23863e0d7186334ca69903c6653ae06
SHA16040256f4dabd5ee5dee6560e04c56f699532db6
SHA2564e07acab1178209379b2f3926e63da1a3002c9640667907db610216bd6e02e72
SHA512b9a7ffaa9a01a488efd29a9f9162c95a8c50f25d2183679f4783ce900319d81f4d375518667959b89bf8df002a869736a2c47bccae3b8ec5844f8f31c2fa7759
-
memory/268-96-0x0000000000000000-mapping.dmp
-
memory/800-90-0x0000000000000000-mapping.dmp
-
memory/924-71-0x0000000000000000-mapping.dmp
-
memory/924-74-0x0000000000070000-0x000000000010E000-memory.dmpFilesize
632KB
-
memory/928-82-0x0000000000486C0E-mapping.dmp
-
memory/1052-69-0x0000000000000000-mapping.dmp
-
memory/1212-94-0x0000000000000000-mapping.dmp
-
memory/1220-93-0x0000000000000000-mapping.dmp
-
memory/1256-67-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1256-63-0x0000000000486C0E-mapping.dmp
-
memory/1256-57-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1256-61-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1256-62-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1256-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1256-60-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1256-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1760-91-0x000000006F350000-0x000000006F8FB000-memory.dmpFilesize
5.7MB
-
memory/1760-92-0x000000006F350000-0x000000006F8FB000-memory.dmpFilesize
5.7MB
-
memory/1760-77-0x0000000000000000-mapping.dmp
-
memory/2044-56-0x0000000000320000-0x000000000032A000-memory.dmpFilesize
40KB
-
memory/2044-55-0x0000000075881000-0x0000000075883000-memory.dmpFilesize
8KB
-
memory/2044-54-0x0000000001130000-0x00000000011CE000-memory.dmpFilesize
632KB