quasar | 3b2166067b82633f6773b3da714db496796054a315d6c870763e1a4641c6821c

Analysis

max time kernel
126s
max time network
140s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-01-2023 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OTP BOT CRACKED.exe
Size

692KB
MD5

57142dab96fabd2d6c9361ebf8a9b2b2
SHA1

46d08ee2df6df25352ef2b310bff8e42e99e6166
SHA256

3b2166067b82633f6773b3da714db496796054a315d6c870763e1a4641c6821c
SHA512

215facd7e421647391055ac823d27d15f8d90e45e88002305c2028e2c29a4828fc05f69858d84c96dfa44cbb372a64a21d02c60c756941e48080925e7e8dd331
SSDEEP

12288:FgHxLPNU1AoiCepLYI2UH92+JlAlB3GQrrCEvL6Dd6S7sQo:ilXoApNTH9eGQrrCE47s

Score

10^/10

quasar venomrat final evasion persistence rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

FINAL

192.253.245.243:7812

Mutex

VNM_MUTEX_qM9TbqrSltZ0u3P1Qz

Attributes

encryption_key
KCyrElxCqTCYe4YGdIaR
install_name
Windows Security.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
Windows Security Service

Signatures

Contains code to disable Windows Defender 8 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/files/0x000a000000012752-60.dat	disable_win_def
behavioral1/files/0x000a000000012752-63.dat	disable_win_def
behavioral1/files/0x000a000000012752-62.dat	disable_win_def
behavioral1/memory/1420-66-0x0000000001280000-0x000000000130C000-memory.dmp	disable_win_def
behavioral1/files/0x00080000000133a7-70.dat	disable_win_def
behavioral1/files/0x00080000000133a7-72.dat	disable_win_def
behavioral1/files/0x00080000000133a7-73.dat	disable_win_def
behavioral1/memory/1712-74-0x0000000000CD0000-0x0000000000D5C000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Windows Security Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Windows Security Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Windows Security Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Windows Security Service.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 8 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012752-60.dat	family_quasar
behavioral1/files/0x000a000000012752-63.dat	family_quasar
behavioral1/files/0x000a000000012752-62.dat	family_quasar
behavioral1/memory/1420-66-0x0000000001280000-0x000000000130C000-memory.dmp	family_quasar
behavioral1/files/0x00080000000133a7-70.dat	family_quasar
behavioral1/files/0x00080000000133a7-72.dat	family_quasar
behavioral1/files/0x00080000000133a7-73.dat	family_quasar
behavioral1/memory/1712-74-0x0000000000CD0000-0x0000000000D5C000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Executes dropped EXE 4 IoCs

pid	Process
904	Windows Security.exe
1420	Windows Security Service.exe
1712	Windows Security.exe
744	Windows Security.exe

Deletes itself 1 IoCs

pid	Process
1124	cmd.exe

Loads dropped DLL 4 IoCs

pid	Process
1952	OTP BOT CRACKED.exe
1952	OTP BOT CRACKED.exe
1420	Windows Security Service.exe
904	Windows Security.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	Windows Security Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Windows Security Service.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\chome_exe = "C:\\Users\\Admin\\AppData\\Roaming\\vlc\\Windows Security.exe"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
380	schtasks.exe
676	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Windows Security Service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Windows Security Service.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
904	Windows Security.exe
744	Windows Security.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
516	powershell.exe
1420	Windows Security Service.exe
1420	Windows Security Service.exe
1420	Windows Security Service.exe
1420	Windows Security Service.exe
1420	Windows Security Service.exe
1420	Windows Security Service.exe
1420	Windows Security Service.exe
940	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1420	Windows Security Service.exe
Token: SeDebugPrivilege	516	powershell.exe
Token: SeDebugPrivilege	1712	Windows Security.exe
Token: SeDebugPrivilege	1712	Windows Security.exe
Token: SeDebugPrivilege	940	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1712	Windows Security.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 904	1952	OTP BOT CRACKED.exe	26
PID 1952 wrote to memory of 904	1952	OTP BOT CRACKED.exe	26
PID 1952 wrote to memory of 904	1952	OTP BOT CRACKED.exe	26
PID 1952 wrote to memory of 904	1952	OTP BOT CRACKED.exe	26
PID 1952 wrote to memory of 1420	1952	OTP BOT CRACKED.exe	27
PID 1952 wrote to memory of 1420	1952	OTP BOT CRACKED.exe	27
PID 1952 wrote to memory of 1420	1952	OTP BOT CRACKED.exe	27
PID 1952 wrote to memory of 1420	1952	OTP BOT CRACKED.exe	27
PID 1420 wrote to memory of 380	1420	Windows Security Service.exe	29
PID 1420 wrote to memory of 380	1420	Windows Security Service.exe	29
PID 1420 wrote to memory of 380	1420	Windows Security Service.exe	29
PID 1420 wrote to memory of 380	1420	Windows Security Service.exe	29
PID 1420 wrote to memory of 1712	1420	Windows Security Service.exe	31
PID 1420 wrote to memory of 1712	1420	Windows Security Service.exe	31
PID 1420 wrote to memory of 1712	1420	Windows Security Service.exe	31
PID 1420 wrote to memory of 1712	1420	Windows Security Service.exe	31
PID 1420 wrote to memory of 516	1420	Windows Security Service.exe	32
PID 1420 wrote to memory of 516	1420	Windows Security Service.exe	32
PID 1420 wrote to memory of 516	1420	Windows Security Service.exe	32
PID 1420 wrote to memory of 516	1420	Windows Security Service.exe	32
PID 1712 wrote to memory of 676	1712	Windows Security.exe	34
PID 1712 wrote to memory of 676	1712	Windows Security.exe	34
PID 1712 wrote to memory of 676	1712	Windows Security.exe	34
PID 1712 wrote to memory of 676	1712	Windows Security.exe	34
PID 1420 wrote to memory of 1452	1420	Windows Security Service.exe	36
PID 1420 wrote to memory of 1452	1420	Windows Security Service.exe	36
PID 1420 wrote to memory of 1452	1420	Windows Security Service.exe	36
PID 1420 wrote to memory of 1452	1420	Windows Security Service.exe	36
PID 1452 wrote to memory of 1124	1452	cmd.exe	38
PID 1452 wrote to memory of 1124	1452	cmd.exe	38
PID 1452 wrote to memory of 1124	1452	cmd.exe	38
PID 1452 wrote to memory of 1124	1452	cmd.exe	38
PID 1420 wrote to memory of 896	1420	Windows Security Service.exe	40
PID 1420 wrote to memory of 896	1420	Windows Security Service.exe	40
PID 1420 wrote to memory of 896	1420	Windows Security Service.exe	40
PID 1420 wrote to memory of 896	1420	Windows Security Service.exe	40
PID 896 wrote to memory of 1684	896	cmd.exe	41
PID 896 wrote to memory of 1684	896	cmd.exe	41
PID 896 wrote to memory of 1684	896	cmd.exe	41
PID 896 wrote to memory of 1684	896	cmd.exe	41
PID 904 wrote to memory of 940	904	Windows Security.exe	42
PID 904 wrote to memory of 940	904	Windows Security.exe	42
PID 904 wrote to memory of 940	904	Windows Security.exe	42
PID 904 wrote to memory of 940	904	Windows Security.exe	42
PID 904 wrote to memory of 744	904	Windows Security.exe	44
PID 904 wrote to memory of 744	904	Windows Security.exe	44
PID 904 wrote to memory of 744	904	Windows Security.exe	44
PID 904 wrote to memory of 744	904	Windows Security.exe	44

C:\Users\Admin\AppData\Local\Temp\OTP BOT CRACKED.exe
"C:\Users\Admin\AppData\Local\Temp\OTP BOT CRACKED.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Roaming\Windows Security.exe
  "C:\Users\Admin\AppData\Roaming\Windows Security.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'chome_exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'chome_exe' -Value '"C:\Users\Admin\AppData\Roaming\vlc\Windows Security.exe"' -PropertyType 'String'
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:940
- - C:\Users\Admin\AppData\Roaming\vlc\Windows Security.exe
    "C:\Users\Admin\AppData\Roaming\vlc\Windows Security.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    PID:744
- C:\Users\Admin\AppData\Roaming\Windows Security Service.exe
  "C:\Users\Admin\AppData\Roaming\Windows Security Service.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Security Service.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:380
- - C:\Users\Admin\AppData\Roaming\Windows Security Service\Windows Security.exe
    "C:\Users\Admin\AppData\Roaming\Windows Security Service\Windows Security.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Security Service\Windows Security.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:676
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      Deletes itself
      PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\NljoJW92O22g.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NljoJW92O22g.bat

Filesize
218B

MD5
88e2eeb83c4ac5573d5da3cfa7546144

SHA1
2794b161ccc4c2d6bb6dd8a7a6402b681abebbe5

SHA256
ae26d405af7f32f584370423e314da630cbc6e4f8aa50dfd969798704aaa04e5

SHA512
55cd2e3a03f5c3b56167f18890c92c84073b6c555a7ba037dd7fc89bd5991e0567ec12a9c656003988317831f8349ecfe0579c1cdc59321e4f9bcd3e605f420f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
1b31daf971e9738e3f84711d1618fba1

SHA1
19c91a03d1ed3e991417c3c1bb9cafe26770ffd5

SHA256
d1f29204d1a7f8d5466edf18bc492e25c8b15f271af61063fe4f0a2c6aebd9a5

SHA512
ba9b649fe16843e15636e77735a85009741dab751b441b6da8fec1eb982dd87ac352e5eb72d1f2a60d78119cebe0017ec7c7263321530b45545c5959031c51d8

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Security Service.exe

Filesize
534KB

MD5
cee83bcd736d132823307d0e64816eef

SHA1
814cf9852fd6a0c8daa5ce7f272e33a88382b901

SHA256
978d81b61bd4eabf7e0707b544f491f024a6d20411999f79c0da977456764c87

SHA512
c1744187b0c7d5a0eab75e72bf0b8b161b384fb0e94cb93b9f42a19ab4c00e80996bcc7a012a46c92ea83ad5b5e121022613de3949754535dd8e402cfff53e5a

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Security Service.exe

Filesize
534KB

MD5
cee83bcd736d132823307d0e64816eef

SHA1
814cf9852fd6a0c8daa5ce7f272e33a88382b901

SHA256
978d81b61bd4eabf7e0707b544f491f024a6d20411999f79c0da977456764c87

SHA512
c1744187b0c7d5a0eab75e72bf0b8b161b384fb0e94cb93b9f42a19ab4c00e80996bcc7a012a46c92ea83ad5b5e121022613de3949754535dd8e402cfff53e5a

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Security Service\Windows Security.exe

Filesize
534KB

MD5
cee83bcd736d132823307d0e64816eef

SHA1
814cf9852fd6a0c8daa5ce7f272e33a88382b901

SHA256
978d81b61bd4eabf7e0707b544f491f024a6d20411999f79c0da977456764c87

SHA512
c1744187b0c7d5a0eab75e72bf0b8b161b384fb0e94cb93b9f42a19ab4c00e80996bcc7a012a46c92ea83ad5b5e121022613de3949754535dd8e402cfff53e5a

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Security Service\Windows Security.exe

Filesize
534KB

MD5
cee83bcd736d132823307d0e64816eef

SHA1
814cf9852fd6a0c8daa5ce7f272e33a88382b901

SHA256
978d81b61bd4eabf7e0707b544f491f024a6d20411999f79c0da977456764c87

SHA512
c1744187b0c7d5a0eab75e72bf0b8b161b384fb0e94cb93b9f42a19ab4c00e80996bcc7a012a46c92ea83ad5b5e121022613de3949754535dd8e402cfff53e5a

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Security.exe

Filesize
10KB

MD5
b295df144910fea1f181c9beb9dd823e

SHA1
5c1522f3cd9192af98d04460458b8c85f1537397

SHA256
b2d9e6529dfbefd5e4de4eeab37788a3f1338bed40b27b4af85dc3db926cc349

SHA512
733e30514d5c3efce419443d7f9e2e6735f8e52d8a2839e85157e8a19537628bef0cd3c01f3a7ac8693343c8b1143ca2f3736ced4b7c323536de159206b7cbb8

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Security.exe

Filesize
10KB

MD5
b295df144910fea1f181c9beb9dd823e

SHA1
5c1522f3cd9192af98d04460458b8c85f1537397

SHA256
b2d9e6529dfbefd5e4de4eeab37788a3f1338bed40b27b4af85dc3db926cc349

SHA512
733e30514d5c3efce419443d7f9e2e6735f8e52d8a2839e85157e8a19537628bef0cd3c01f3a7ac8693343c8b1143ca2f3736ced4b7c323536de159206b7cbb8

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\Windows Security.exe

Filesize
36.9MB

MD5
d1db07799438f66503dd795cea74e54f

SHA1
91cb46f9bbd66fb1e316620e9aa2429cadd4c8dd

SHA256
7d554724daff8b6f0302376f305b989b59ace25adb9a87915d15fd2919b3d3ae

SHA512
9cdc5e7ec8533579d371462f5ec6005e017ed718dd6afa3fb91428d371b39dcffffb25738ad3a7f04a3b94f40d59848b1608e809b37c6cc6c9ee229c5ab5374b

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\Windows Security.exe

Filesize
36.9MB

MD5
d1db07799438f66503dd795cea74e54f

SHA1
91cb46f9bbd66fb1e316620e9aa2429cadd4c8dd

SHA256
7d554724daff8b6f0302376f305b989b59ace25adb9a87915d15fd2919b3d3ae

SHA512
9cdc5e7ec8533579d371462f5ec6005e017ed718dd6afa3fb91428d371b39dcffffb25738ad3a7f04a3b94f40d59848b1608e809b37c6cc6c9ee229c5ab5374b

Download Submit
\Users\Admin\AppData\Roaming\Windows Security Service.exe

Filesize
534KB

MD5
cee83bcd736d132823307d0e64816eef

SHA1
814cf9852fd6a0c8daa5ce7f272e33a88382b901

SHA256
978d81b61bd4eabf7e0707b544f491f024a6d20411999f79c0da977456764c87

SHA512
c1744187b0c7d5a0eab75e72bf0b8b161b384fb0e94cb93b9f42a19ab4c00e80996bcc7a012a46c92ea83ad5b5e121022613de3949754535dd8e402cfff53e5a

Download Submit
\Users\Admin\AppData\Roaming\Windows Security Service\Windows Security.exe

Filesize
534KB

MD5
cee83bcd736d132823307d0e64816eef

SHA1
814cf9852fd6a0c8daa5ce7f272e33a88382b901

SHA256
978d81b61bd4eabf7e0707b544f491f024a6d20411999f79c0da977456764c87

SHA512
c1744187b0c7d5a0eab75e72bf0b8b161b384fb0e94cb93b9f42a19ab4c00e80996bcc7a012a46c92ea83ad5b5e121022613de3949754535dd8e402cfff53e5a

Download Submit
\Users\Admin\AppData\Roaming\Windows Security.exe

Filesize
10KB

MD5
b295df144910fea1f181c9beb9dd823e

SHA1
5c1522f3cd9192af98d04460458b8c85f1537397

SHA256
b2d9e6529dfbefd5e4de4eeab37788a3f1338bed40b27b4af85dc3db926cc349

SHA512
733e30514d5c3efce419443d7f9e2e6735f8e52d8a2839e85157e8a19537628bef0cd3c01f3a7ac8693343c8b1143ca2f3736ced4b7c323536de159206b7cbb8

Download Submit
\Users\Admin\AppData\Roaming\vlc\Windows Security.exe

Filesize
36.9MB

MD5
d1db07799438f66503dd795cea74e54f

SHA1
91cb46f9bbd66fb1e316620e9aa2429cadd4c8dd

SHA256
7d554724daff8b6f0302376f305b989b59ace25adb9a87915d15fd2919b3d3ae

SHA512
9cdc5e7ec8533579d371462f5ec6005e017ed718dd6afa3fb91428d371b39dcffffb25738ad3a7f04a3b94f40d59848b1608e809b37c6cc6c9ee229c5ab5374b

Download Submit
memory/516-80-0x000000006E930000-0x000000006EEDB000-memory.dmp

Filesize
5.7MB

Download
memory/516-78-0x000000006E930000-0x000000006EEDB000-memory.dmp

Filesize
5.7MB

Download
memory/744-93-0x0000000000290000-0x0000000000298000-memory.dmp

Filesize
32KB

Download
memory/904-65-0x0000000000E80000-0x0000000000E88000-memory.dmp

Filesize
32KB

Download
memory/940-95-0x000000006E900000-0x000000006EEAB000-memory.dmp

Filesize
5.7MB

Download
memory/940-96-0x000000006E900000-0x000000006EEAB000-memory.dmp

Filesize
5.7MB

Download
memory/1420-66-0x0000000001280000-0x000000000130C000-memory.dmp

Filesize
560KB

Download
memory/1712-74-0x0000000000CD0000-0x0000000000D5C000-memory.dmp

Filesize
560KB

Download
memory/1952-54-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download
memory/1952-64-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1952-55-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download