Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 17:49
Static task
static1
Behavioral task
behavioral1
Sample
b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe
Resource
win7-20220812-en
General
-
Target
b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe
-
Size
680KB
-
MD5
3d9e3bf3109bfe73bccfb57e360fe465
-
SHA1
36bd2e71a35f678c8d1e8066e616706f2dcb8610
-
SHA256
b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50
-
SHA512
f24992b8f03df563eca83cce818a0d5af04094acde38af3d0acf1ec40ae87272156f56ab72121becbd82f77d296ad39b60939d2282e0167b11dcf3b33db43be7
-
SSDEEP
12288:a5393whFOBbosXQsI6f9fqAPzzEeEZchCBywRiaxJDj8DkIonQmP0Ove/diuHc:a53uhFzsAibzzEe9wRiaLSkI8QhOQ18
Malware Config
Extracted
quasar
2.1.0.0
ajith
23.105.131.178:7812
VNM_MUTEX_NdVd2sPSSqFdo7I35g
-
encryption_key
jyerms3KOWmt3C9DBFuq
-
install_name
Windows Defender Security.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
SubDir
Signatures
-
Contains code to disable Windows Defender 7 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/1468-66-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1468-67-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1468-68-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1468-69-0x0000000000486C4E-mapping.dmp disable_win_def behavioral1/memory/1468-72-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1468-74-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1084-88-0x0000000000486C4E-mapping.dmp disable_win_def -
Processes:
Windows Security.exe_protected.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Windows Security.exe_protected.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Windows Security.exe_protected.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Windows Security.exe_protected.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Windows Security.exe_protected.exe -
Quasar payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1468-66-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1468-67-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1468-68-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1468-69-0x0000000000486C4E-mapping.dmp family_quasar behavioral1/memory/1468-72-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1468-74-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1084-88-0x0000000000486C4E-mapping.dmp family_quasar -
Executes dropped EXE 4 IoCs
Processes:
Windows Security.exe_protected.exeWindows Security.exe_protected.exeWindows Defender Security.exeWindows Defender Security.exepid process 984 Windows Security.exe_protected.exe 1468 Windows Security.exe_protected.exe 704 Windows Defender Security.exe 1084 Windows Defender Security.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1712 cmd.exe -
Loads dropped DLL 3 IoCs
Processes:
b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exeWindows Security.exe_protected.exeWindows Security.exe_protected.exepid process 836 b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe 984 Windows Security.exe_protected.exe 1468 Windows Security.exe_protected.exe -
Processes:
Windows Security.exe_protected.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features Windows Security.exe_protected.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Windows Security.exe_protected.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Windows Security.exe_protected.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe" Windows Security.exe_protected.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Windows Security.exe_protected.exeWindows Defender Security.exedescription pid process target process PID 984 set thread context of 1468 984 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 704 set thread context of 1084 704 Windows Defender Security.exe Windows Defender Security.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
Windows Security.exe_protected.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Windows Security.exe_protected.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Windows Security.exe_protected.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exeWindows Security.exe_protected.exepid process 1176 powershell.exe 1468 Windows Security.exe_protected.exe 1468 Windows Security.exe_protected.exe 1468 Windows Security.exe_protected.exe 1468 Windows Security.exe_protected.exe 1468 Windows Security.exe_protected.exe 1468 Windows Security.exe_protected.exe 1468 Windows Security.exe_protected.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Windows Security.exe_protected.exeWindows Defender Security.exepowershell.exedescription pid process Token: SeDebugPrivilege 1468 Windows Security.exe_protected.exe Token: SeDebugPrivilege 1084 Windows Defender Security.exe Token: SeDebugPrivilege 1084 Windows Defender Security.exe Token: SeDebugPrivilege 1176 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Windows Defender Security.exepid process 1084 Windows Defender Security.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exeWindows Security.exe_protected.exeWindows Security.exe_protected.exeWindows Defender Security.exeWindows Defender Security.execmd.execmd.exedescription pid process target process PID 836 wrote to memory of 984 836 b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe Windows Security.exe_protected.exe PID 836 wrote to memory of 984 836 b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe Windows Security.exe_protected.exe PID 836 wrote to memory of 984 836 b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe Windows Security.exe_protected.exe PID 836 wrote to memory of 984 836 b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe Windows Security.exe_protected.exe PID 984 wrote to memory of 1468 984 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 984 wrote to memory of 1468 984 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 984 wrote to memory of 1468 984 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 984 wrote to memory of 1468 984 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 984 wrote to memory of 1468 984 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 984 wrote to memory of 1468 984 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 984 wrote to memory of 1468 984 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 984 wrote to memory of 1468 984 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 984 wrote to memory of 1468 984 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 1468 wrote to memory of 952 1468 Windows Security.exe_protected.exe schtasks.exe PID 1468 wrote to memory of 952 1468 Windows Security.exe_protected.exe schtasks.exe PID 1468 wrote to memory of 952 1468 Windows Security.exe_protected.exe schtasks.exe PID 1468 wrote to memory of 952 1468 Windows Security.exe_protected.exe schtasks.exe PID 1468 wrote to memory of 704 1468 Windows Security.exe_protected.exe Windows Defender Security.exe PID 1468 wrote to memory of 704 1468 Windows Security.exe_protected.exe Windows Defender Security.exe PID 1468 wrote to memory of 704 1468 Windows Security.exe_protected.exe Windows Defender Security.exe PID 1468 wrote to memory of 704 1468 Windows Security.exe_protected.exe Windows Defender Security.exe PID 704 wrote to memory of 1084 704 Windows Defender Security.exe Windows Defender Security.exe PID 704 wrote to memory of 1084 704 Windows Defender Security.exe Windows Defender Security.exe PID 704 wrote to memory of 1084 704 Windows Defender Security.exe Windows Defender Security.exe PID 704 wrote to memory of 1084 704 Windows Defender Security.exe Windows Defender Security.exe PID 704 wrote to memory of 1084 704 Windows Defender Security.exe Windows Defender Security.exe PID 704 wrote to memory of 1084 704 Windows Defender Security.exe Windows Defender Security.exe PID 704 wrote to memory of 1084 704 Windows Defender Security.exe Windows Defender Security.exe PID 704 wrote to memory of 1084 704 Windows Defender Security.exe Windows Defender Security.exe PID 704 wrote to memory of 1084 704 Windows Defender Security.exe Windows Defender Security.exe PID 1468 wrote to memory of 1176 1468 Windows Security.exe_protected.exe powershell.exe PID 1468 wrote to memory of 1176 1468 Windows Security.exe_protected.exe powershell.exe PID 1468 wrote to memory of 1176 1468 Windows Security.exe_protected.exe powershell.exe PID 1468 wrote to memory of 1176 1468 Windows Security.exe_protected.exe powershell.exe PID 1084 wrote to memory of 2012 1084 Windows Defender Security.exe schtasks.exe PID 1084 wrote to memory of 2012 1084 Windows Defender Security.exe schtasks.exe PID 1084 wrote to memory of 2012 1084 Windows Defender Security.exe schtasks.exe PID 1084 wrote to memory of 2012 1084 Windows Defender Security.exe schtasks.exe PID 1468 wrote to memory of 944 1468 Windows Security.exe_protected.exe cmd.exe PID 1468 wrote to memory of 944 1468 Windows Security.exe_protected.exe cmd.exe PID 1468 wrote to memory of 944 1468 Windows Security.exe_protected.exe cmd.exe PID 1468 wrote to memory of 944 1468 Windows Security.exe_protected.exe cmd.exe PID 944 wrote to memory of 1712 944 cmd.exe cmd.exe PID 944 wrote to memory of 1712 944 cmd.exe cmd.exe PID 944 wrote to memory of 1712 944 cmd.exe cmd.exe PID 944 wrote to memory of 1712 944 cmd.exe cmd.exe PID 1468 wrote to memory of 1508 1468 Windows Security.exe_protected.exe cmd.exe PID 1468 wrote to memory of 1508 1468 Windows Security.exe_protected.exe cmd.exe PID 1468 wrote to memory of 1508 1468 Windows Security.exe_protected.exe cmd.exe PID 1468 wrote to memory of 1508 1468 Windows Security.exe_protected.exe cmd.exe PID 1508 wrote to memory of 1544 1508 cmd.exe chcp.com PID 1508 wrote to memory of 1544 1508 cmd.exe chcp.com PID 1508 wrote to memory of 1544 1508 cmd.exe chcp.com PID 1508 wrote to memory of 1544 1508 cmd.exe chcp.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe"C:\Users\Admin\AppData\Local\Temp\b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe" /silent2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe" /rl HIGHEST /f6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*5⤵
- Deletes itself
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\KYTAbvvkUa3n.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Local\Temp\KYTAbvvkUa3n.batFilesize
239B
MD592c5320bca10671f10dcdd8d6093a5b6
SHA1bd14f3814623329a6c1d21900bac44d3eabf16b3
SHA25602362a8b1ad99aead3b49735388a230fdbc901cc9adf425f0c7d7c38d4f1cd4f
SHA5124462fae207beec626cd9b0d65804ed0f784139112ac7da6888979fc2f4df47ff37e5be3d4894f6cf75b535fb1bc509e32323a20be5b9b86ccc0b6f3d71e7f5b4
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
memory/704-81-0x00000000011A0000-0x0000000001248000-memory.dmpFilesize
672KB
-
memory/704-78-0x0000000000000000-mapping.dmp
-
memory/836-54-0x0000000075AD1000-0x0000000075AD3000-memory.dmpFilesize
8KB
-
memory/944-100-0x0000000000000000-mapping.dmp
-
memory/952-76-0x0000000000000000-mapping.dmp
-
memory/984-59-0x0000000000F50000-0x0000000000FF8000-memory.dmpFilesize
672KB
-
memory/984-61-0x00000000008B0000-0x00000000008BA000-memory.dmpFilesize
40KB
-
memory/984-56-0x0000000000000000-mapping.dmp
-
memory/1084-88-0x0000000000486C4E-mapping.dmp
-
memory/1176-95-0x0000000000000000-mapping.dmp
-
memory/1176-98-0x000000006F110000-0x000000006F6BB000-memory.dmpFilesize
5.7MB
-
memory/1176-99-0x000000006F110000-0x000000006F6BB000-memory.dmpFilesize
5.7MB
-
memory/1468-63-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1468-74-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1468-72-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1468-69-0x0000000000486C4E-mapping.dmp
-
memory/1468-68-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1468-67-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1468-66-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1468-64-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1508-102-0x0000000000000000-mapping.dmp
-
memory/1544-104-0x0000000000000000-mapping.dmp
-
memory/1712-101-0x0000000000000000-mapping.dmp
-
memory/2012-97-0x0000000000000000-mapping.dmp