Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 17:49
Static task
static1
Behavioral task
behavioral1
Sample
b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe
Resource
win7-20220812-en
General
-
Target
b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe
-
Size
680KB
-
MD5
3d9e3bf3109bfe73bccfb57e360fe465
-
SHA1
36bd2e71a35f678c8d1e8066e616706f2dcb8610
-
SHA256
b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50
-
SHA512
f24992b8f03df563eca83cce818a0d5af04094acde38af3d0acf1ec40ae87272156f56ab72121becbd82f77d296ad39b60939d2282e0167b11dcf3b33db43be7
-
SSDEEP
12288:a5393whFOBbosXQsI6f9fqAPzzEeEZchCBywRiaxJDj8DkIonQmP0Ove/diuHc:a53uhFzsAibzzEe9wRiaLSkI8QhOQ18
Malware Config
Extracted
quasar
2.1.0.0
ajith
23.105.131.178:7812
VNM_MUTEX_NdVd2sPSSqFdo7I35g
-
encryption_key
jyerms3KOWmt3C9DBFuq
-
install_name
Windows Defender Security.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
SubDir
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/1792-140-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def -
Processes:
Windows Security.exe_protected.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Windows Security.exe_protected.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Windows Security.exe_protected.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Windows Security.exe_protected.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection Windows Security.exe_protected.exe -
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1792-140-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar -
Executes dropped EXE 7 IoCs
Processes:
Windows Security.exe_protected.exeWindows Security.exe_protected.exeWindows Defender Security.exeWindows Defender Security.exeWindows Security.exe_protected.exeWindows Security.exe_protected.exeWindows Security.exe_protected.exepid process 4176 Windows Security.exe_protected.exe 1792 Windows Security.exe_protected.exe 4692 Windows Defender Security.exe 4864 Windows Defender Security.exe 4576 Windows Security.exe_protected.exe 1648 Windows Security.exe_protected.exe 2788 Windows Security.exe_protected.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exeWindows Security.exe_protected.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Windows Security.exe_protected.exe -
Processes:
Windows Security.exe_protected.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features Windows Security.exe_protected.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Windows Security.exe_protected.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Windows Security.exe_protected.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe" Windows Security.exe_protected.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 16 ip-api.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Windows Security.exe_protected.exeWindows Defender Security.exeWindows Security.exe_protected.exedescription pid process target process PID 4176 set thread context of 1792 4176 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4692 set thread context of 4864 4692 Windows Defender Security.exe Windows Defender Security.exe PID 4576 set thread context of 2788 4576 Windows Security.exe_protected.exe Windows Security.exe_protected.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4884 schtasks.exe 2520 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exeWindows Security.exe_protected.exeWindows Security.exe_protected.exeWindows Security.exe_protected.exepid process 4412 powershell.exe 4412 powershell.exe 1792 Windows Security.exe_protected.exe 1792 Windows Security.exe_protected.exe 1792 Windows Security.exe_protected.exe 1792 Windows Security.exe_protected.exe 1792 Windows Security.exe_protected.exe 1792 Windows Security.exe_protected.exe 1792 Windows Security.exe_protected.exe 4576 Windows Security.exe_protected.exe 4576 Windows Security.exe_protected.exe 2788 Windows Security.exe_protected.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Windows Security.exe_protected.exepowershell.exeWindows Defender Security.exeWindows Security.exe_protected.exeWindows Security.exe_protected.exedescription pid process Token: SeDebugPrivilege 1792 Windows Security.exe_protected.exe Token: SeDebugPrivilege 4412 powershell.exe Token: SeDebugPrivilege 4864 Windows Defender Security.exe Token: SeDebugPrivilege 4864 Windows Defender Security.exe Token: SeDebugPrivilege 4576 Windows Security.exe_protected.exe Token: SeDebugPrivilege 2788 Windows Security.exe_protected.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Windows Defender Security.exepid process 4864 Windows Defender Security.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exeWindows Security.exe_protected.exeWindows Security.exe_protected.exeWindows Defender Security.exeWindows Defender Security.execmd.execmd.exeWindows Security.exe_protected.exedescription pid process target process PID 4224 wrote to memory of 4176 4224 b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe Windows Security.exe_protected.exe PID 4224 wrote to memory of 4176 4224 b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe Windows Security.exe_protected.exe PID 4224 wrote to memory of 4176 4224 b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe Windows Security.exe_protected.exe PID 4176 wrote to memory of 1792 4176 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4176 wrote to memory of 1792 4176 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4176 wrote to memory of 1792 4176 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4176 wrote to memory of 1792 4176 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4176 wrote to memory of 1792 4176 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4176 wrote to memory of 1792 4176 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4176 wrote to memory of 1792 4176 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4176 wrote to memory of 1792 4176 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 1792 wrote to memory of 4884 1792 Windows Security.exe_protected.exe schtasks.exe PID 1792 wrote to memory of 4884 1792 Windows Security.exe_protected.exe schtasks.exe PID 1792 wrote to memory of 4884 1792 Windows Security.exe_protected.exe schtasks.exe PID 1792 wrote to memory of 4692 1792 Windows Security.exe_protected.exe Windows Defender Security.exe PID 1792 wrote to memory of 4692 1792 Windows Security.exe_protected.exe Windows Defender Security.exe PID 1792 wrote to memory of 4692 1792 Windows Security.exe_protected.exe Windows Defender Security.exe PID 1792 wrote to memory of 4412 1792 Windows Security.exe_protected.exe powershell.exe PID 1792 wrote to memory of 4412 1792 Windows Security.exe_protected.exe powershell.exe PID 1792 wrote to memory of 4412 1792 Windows Security.exe_protected.exe powershell.exe PID 4692 wrote to memory of 4864 4692 Windows Defender Security.exe Windows Defender Security.exe PID 4692 wrote to memory of 4864 4692 Windows Defender Security.exe Windows Defender Security.exe PID 4692 wrote to memory of 4864 4692 Windows Defender Security.exe Windows Defender Security.exe PID 4692 wrote to memory of 4864 4692 Windows Defender Security.exe Windows Defender Security.exe PID 4692 wrote to memory of 4864 4692 Windows Defender Security.exe Windows Defender Security.exe PID 4692 wrote to memory of 4864 4692 Windows Defender Security.exe Windows Defender Security.exe PID 4692 wrote to memory of 4864 4692 Windows Defender Security.exe Windows Defender Security.exe PID 4692 wrote to memory of 4864 4692 Windows Defender Security.exe Windows Defender Security.exe PID 4864 wrote to memory of 2520 4864 Windows Defender Security.exe schtasks.exe PID 4864 wrote to memory of 2520 4864 Windows Defender Security.exe schtasks.exe PID 4864 wrote to memory of 2520 4864 Windows Defender Security.exe schtasks.exe PID 1792 wrote to memory of 4236 1792 Windows Security.exe_protected.exe cmd.exe PID 1792 wrote to memory of 4236 1792 Windows Security.exe_protected.exe cmd.exe PID 1792 wrote to memory of 4236 1792 Windows Security.exe_protected.exe cmd.exe PID 4236 wrote to memory of 4364 4236 cmd.exe cmd.exe PID 4236 wrote to memory of 4364 4236 cmd.exe cmd.exe PID 4236 wrote to memory of 4364 4236 cmd.exe cmd.exe PID 1792 wrote to memory of 3928 1792 Windows Security.exe_protected.exe cmd.exe PID 1792 wrote to memory of 3928 1792 Windows Security.exe_protected.exe cmd.exe PID 1792 wrote to memory of 3928 1792 Windows Security.exe_protected.exe cmd.exe PID 3928 wrote to memory of 1484 3928 cmd.exe chcp.com PID 3928 wrote to memory of 1484 3928 cmd.exe chcp.com PID 3928 wrote to memory of 1484 3928 cmd.exe chcp.com PID 3928 wrote to memory of 788 3928 cmd.exe PING.EXE PID 3928 wrote to memory of 788 3928 cmd.exe PING.EXE PID 3928 wrote to memory of 788 3928 cmd.exe PING.EXE PID 3928 wrote to memory of 4576 3928 cmd.exe Windows Security.exe_protected.exe PID 3928 wrote to memory of 4576 3928 cmd.exe Windows Security.exe_protected.exe PID 3928 wrote to memory of 4576 3928 cmd.exe Windows Security.exe_protected.exe PID 4576 wrote to memory of 1648 4576 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4576 wrote to memory of 1648 4576 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4576 wrote to memory of 1648 4576 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4576 wrote to memory of 2788 4576 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4576 wrote to memory of 2788 4576 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4576 wrote to memory of 2788 4576 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4576 wrote to memory of 2788 4576 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4576 wrote to memory of 2788 4576 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4576 wrote to memory of 2788 4576 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4576 wrote to memory of 2788 4576 Windows Security.exe_protected.exe Windows Security.exe_protected.exe PID 4576 wrote to memory of 2788 4576 Windows Security.exe_protected.exe Windows Security.exe_protected.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe"C:\Users\Admin\AppData\Local\Temp\b4b4889b0d6ac058b3d39e62c9cb32fea0abb700b92e1e10325e0854470aac50.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe" /silent2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Checks computer location settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe" /rl HIGHEST /f6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cYE22NScCqxp.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Windows Defender Security.exe.logFilesize
507B
MD58cf94b5356be60247d331660005941ec
SHA1fdedb361f40f22cb6a086c808fc0056d4e421131
SHA25652a5b2d36f2b72cb02c695cf7ef46444dda73d4ea82a73e0894c805fa9987bc0
SHA512b886dfc8bf03f8627f051fb6e2ac40ae2e7713584695a365728eb2e2c87217830029aa35bd129c642fa03dde3f7a7dd5690b16248676be60a6bb5f497fb23651
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Windows Security.exe_protected.exe.logFilesize
507B
MD58cf94b5356be60247d331660005941ec
SHA1fdedb361f40f22cb6a086c808fc0056d4e421131
SHA25652a5b2d36f2b72cb02c695cf7ef46444dda73d4ea82a73e0894c805fa9987bc0
SHA512b886dfc8bf03f8627f051fb6e2ac40ae2e7713584695a365728eb2e2c87217830029aa35bd129c642fa03dde3f7a7dd5690b16248676be60a6bb5f497fb23651
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Windows Security.exe_protected.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Local\Temp\cYE22NScCqxp.batFilesize
239B
MD559eb9ada666d22ee0eb96a46e3b78056
SHA1998d1a5e4dfbf073679845b72a1ce876f4b32244
SHA2563cf94e7ad743b6943300aa573b027578c749d3cd7a3dfd65ba55620846c3fa86
SHA5129dae8774db8cbac0793452f5c1ffd94eea9e71b61f55bcd4fbfae5c5d3b1631e9ff07e329a7d3bbe1fdf24a64408ac50cf0dfc79e642820e83d563b3b05372ea
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
memory/788-177-0x0000000000000000-mapping.dmp
-
memory/1484-176-0x0000000000000000-mapping.dmp
-
memory/1648-180-0x0000000000000000-mapping.dmp
-
memory/1792-140-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1792-139-0x0000000000000000-mapping.dmp
-
memory/1792-145-0x00000000069B0000-0x00000000069EC000-memory.dmpFilesize
240KB
-
memory/1792-144-0x0000000006440000-0x0000000006452000-memory.dmpFilesize
72KB
-
memory/1792-143-0x0000000005880000-0x00000000058E6000-memory.dmpFilesize
408KB
-
memory/2520-160-0x0000000000000000-mapping.dmp
-
memory/2788-182-0x0000000000000000-mapping.dmp
-
memory/3928-174-0x0000000000000000-mapping.dmp
-
memory/4176-132-0x0000000000000000-mapping.dmp
-
memory/4176-137-0x0000000004E00000-0x0000000004E92000-memory.dmpFilesize
584KB
-
memory/4176-138-0x0000000004F60000-0x0000000004FFC000-memory.dmpFilesize
624KB
-
memory/4176-136-0x00000000055F0000-0x0000000005B94000-memory.dmpFilesize
5.6MB
-
memory/4176-135-0x0000000000380000-0x0000000000428000-memory.dmpFilesize
672KB
-
memory/4236-172-0x0000000000000000-mapping.dmp
-
memory/4364-173-0x0000000000000000-mapping.dmp
-
memory/4412-157-0x0000000005D80000-0x0000000005DA2000-memory.dmpFilesize
136KB
-
memory/4412-170-0x0000000007A50000-0x0000000007A6A000-memory.dmpFilesize
104KB
-
memory/4412-165-0x0000000007D60000-0x00000000083DA000-memory.dmpFilesize
6.5MB
-
memory/4412-166-0x0000000007710000-0x000000000772A000-memory.dmpFilesize
104KB
-
memory/4412-167-0x0000000007780000-0x000000000778A000-memory.dmpFilesize
40KB
-
memory/4412-168-0x0000000007990000-0x0000000007A26000-memory.dmpFilesize
600KB
-
memory/4412-169-0x0000000007940000-0x000000000794E000-memory.dmpFilesize
56KB
-
memory/4412-164-0x00000000069C0000-0x00000000069DE000-memory.dmpFilesize
120KB
-
memory/4412-171-0x0000000007A30000-0x0000000007A38000-memory.dmpFilesize
32KB
-
memory/4412-163-0x000000006FE40000-0x000000006FE8C000-memory.dmpFilesize
304KB
-
memory/4412-162-0x00000000069E0000-0x0000000006A12000-memory.dmpFilesize
200KB
-
memory/4412-150-0x0000000000000000-mapping.dmp
-
memory/4412-159-0x0000000006400000-0x000000000641E000-memory.dmpFilesize
120KB
-
memory/4412-158-0x0000000005E20000-0x0000000005E86000-memory.dmpFilesize
408KB
-
memory/4412-156-0x0000000005720000-0x0000000005D48000-memory.dmpFilesize
6.2MB
-
memory/4412-151-0x0000000004F60000-0x0000000004F96000-memory.dmpFilesize
216KB
-
memory/4576-178-0x0000000000000000-mapping.dmp
-
memory/4692-147-0x0000000000000000-mapping.dmp
-
memory/4864-152-0x0000000000000000-mapping.dmp
-
memory/4864-161-0x0000000006DE0000-0x0000000006DEA000-memory.dmpFilesize
40KB
-
memory/4884-146-0x0000000000000000-mapping.dmp