quasar | ed097795acee8f6fce5f80e71d2ed3cf6e27cbb3203673b6c1fc034bd3cee538

Analysis

max time kernel
284s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2023 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BitcoinFakeTransaction/BitcoinFakeTransaction.exe
Size

997KB
MD5

4fe10e794eb25820b63890cfa0abca42
SHA1

321ecd39644a864a47cc3d431be53c8035acf59f
SHA256

5cc80ef8d5cd9c1fffb5660dd739177ae9043cc13a022a8e8e2c696fa5fcf59e
SHA512

728e83d4782347f8959c528579e504ec38fb8c5c18ebacceb106c46d5462ed731a685be3db0450d0dc5eb08f3f9ead13d5080ce244408e3d371e760dd159d70e
SSDEEP

12288:1UTyp3ZXSXsy8p4pymXXOZ4z2im3eyOYZ/w4FGVIa9A30xT5uUPDP:1UTSo/Bpu4qim3nZ/wB9+wT5fP

Score

10^/10

quasar venomrat windows securityy evasion persistence rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

windows securityy

192.253.245.243:7812

Mutex

VNM_MUTEX_Lwt9GYx0ZlES09069Z

Attributes

encryption_key
AhFntNS40ejah7Nv2cWL
install_name
Window Security Health Service.exe
log_directory
Logs
reconnect_delay
3000
startup_key
window update
subdirectory
windows Service32

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral4/memory/4412-148-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

Aimtxznnlqlhr.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	Aimtxznnlqlhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Aimtxznnlqlhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Aimtxznnlqlhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Aimtxznnlqlhr.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral4/memory/4412-148-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Executes dropped EXE 10 IoCs

Processes:

Mvjdejeez.exeAimtxznnlqlhr.exeMvjdejeez.exeAimtxznnlqlhr.exeMvjdejeez.exeMvjdejeez.exeMvjdejeez.exeMvjdejeez.exeWindow Security Health Service.exeWindow Security Health Service.exe

pid	Process
1112	Mvjdejeez.exe
564	Aimtxznnlqlhr.exe
4268	Mvjdejeez.exe
4412	Aimtxznnlqlhr.exe
2148	Mvjdejeez.exe
4700	Mvjdejeez.exe
2344	Mvjdejeez.exe
1480	Mvjdejeez.exe
3584	Window Security Health Service.exe
4204	Window Security Health Service.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

BitcoinFakeTransaction.exeAimtxznnlqlhr.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	BitcoinFakeTransaction.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	Aimtxznnlqlhr.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

Aimtxznnlqlhr.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	Aimtxznnlqlhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Aimtxznnlqlhr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Mvjdejeez.exeAimtxznnlqlhr.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dSHXtPBWwq = "C:\\Users\\Admin\\AppData\\Roaming\\yMRJBwKnFT\\iYAZWtRxTK.exe"	Mvjdejeez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tSSBpQMZcW = "C:\\Users\\Admin\\AppData\\Roaming\\eWTPJijJLE\\WbFBTiQzDg.exe"	Aimtxznnlqlhr.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
13	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

Aimtxznnlqlhr.exeMvjdejeez.exeWindow Security Health Service.exe

description	pid	Process	procid_target
PID 564 set thread context of 4412	564	Aimtxznnlqlhr.exe	86
PID 1112 set thread context of 1480	1112	Mvjdejeez.exe	90
PID 3584 set thread context of 4204	3584	Window Security Health Service.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1908	4412	WerFault.exe	86

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exe

pid	Process
3548	schtasks.exe
4832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

Mvjdejeez.exepowershell.exeAimtxznnlqlhr.exe

pid	Process
1112	Mvjdejeez.exe
1112	Mvjdejeez.exe
1112	Mvjdejeez.exe
1112	Mvjdejeez.exe
1112	Mvjdejeez.exe
1112	Mvjdejeez.exe
1112	Mvjdejeez.exe
1112	Mvjdejeez.exe
3632	powershell.exe
3632	powershell.exe
4412	Aimtxznnlqlhr.exe
4412	Aimtxznnlqlhr.exe
4412	Aimtxznnlqlhr.exe
4412	Aimtxznnlqlhr.exe
4412	Aimtxznnlqlhr.exe
4412	Aimtxznnlqlhr.exe
4412	Aimtxznnlqlhr.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Mvjdejeez.exeAimtxznnlqlhr.exepowershell.exeWindow Security Health Service.exe

description	pid	Process
Token: SeDebugPrivilege	1112	Mvjdejeez.exe
Token: SeDebugPrivilege	4412	Aimtxznnlqlhr.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	4204	Window Security Health Service.exe
Token: SeDebugPrivilege	4204	Window Security Health Service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Window Security Health Service.exe

pid	Process
4204	Window Security Health Service.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

BitcoinFakeTransaction.exeAimtxznnlqlhr.exeMvjdejeez.exeAimtxznnlqlhr.exeWindow Security Health Service.exeWindow Security Health Service.execmd.exe

description	pid	Process	procid_target
PID 4732 wrote to memory of 1112	4732	BitcoinFakeTransaction.exe	84
PID 4732 wrote to memory of 1112	4732	BitcoinFakeTransaction.exe	84
PID 4732 wrote to memory of 1112	4732	BitcoinFakeTransaction.exe	84
PID 4732 wrote to memory of 564	4732	BitcoinFakeTransaction.exe	85
PID 4732 wrote to memory of 564	4732	BitcoinFakeTransaction.exe	85
PID 4732 wrote to memory of 564	4732	BitcoinFakeTransaction.exe	85
PID 564 wrote to memory of 4412	564	Aimtxznnlqlhr.exe	86
PID 564 wrote to memory of 4412	564	Aimtxznnlqlhr.exe	86
PID 564 wrote to memory of 4412	564	Aimtxznnlqlhr.exe	86
PID 1112 wrote to memory of 4268	1112	Mvjdejeez.exe	87
PID 1112 wrote to memory of 4268	1112	Mvjdejeez.exe	87
PID 1112 wrote to memory of 4268	1112	Mvjdejeez.exe	87
PID 564 wrote to memory of 4412	564	Aimtxznnlqlhr.exe	86
PID 564 wrote to memory of 4412	564	Aimtxznnlqlhr.exe	86
PID 564 wrote to memory of 4412	564	Aimtxznnlqlhr.exe	86
PID 564 wrote to memory of 4412	564	Aimtxznnlqlhr.exe	86
PID 564 wrote to memory of 4412	564	Aimtxznnlqlhr.exe	86
PID 1112 wrote to memory of 2148	1112	Mvjdejeez.exe	88
PID 1112 wrote to memory of 2148	1112	Mvjdejeez.exe	88
PID 1112 wrote to memory of 2148	1112	Mvjdejeez.exe	88
PID 1112 wrote to memory of 4700	1112	Mvjdejeez.exe	91
PID 1112 wrote to memory of 4700	1112	Mvjdejeez.exe	91
PID 1112 wrote to memory of 4700	1112	Mvjdejeez.exe	91
PID 1112 wrote to memory of 2344	1112	Mvjdejeez.exe	89
PID 1112 wrote to memory of 2344	1112	Mvjdejeez.exe	89
PID 1112 wrote to memory of 2344	1112	Mvjdejeez.exe	89
PID 1112 wrote to memory of 1480	1112	Mvjdejeez.exe	90
PID 1112 wrote to memory of 1480	1112	Mvjdejeez.exe	90
PID 1112 wrote to memory of 1480	1112	Mvjdejeez.exe	90
PID 1112 wrote to memory of 1480	1112	Mvjdejeez.exe	90
PID 1112 wrote to memory of 1480	1112	Mvjdejeez.exe	90
PID 1112 wrote to memory of 1480	1112	Mvjdejeez.exe	90
PID 1112 wrote to memory of 1480	1112	Mvjdejeez.exe	90
PID 1112 wrote to memory of 1480	1112	Mvjdejeez.exe	90
PID 4412 wrote to memory of 3548	4412	Aimtxznnlqlhr.exe	95
PID 4412 wrote to memory of 3548	4412	Aimtxznnlqlhr.exe	95
PID 4412 wrote to memory of 3548	4412	Aimtxznnlqlhr.exe	95
PID 4412 wrote to memory of 3584	4412	Aimtxznnlqlhr.exe	97
PID 4412 wrote to memory of 3584	4412	Aimtxznnlqlhr.exe	97
PID 4412 wrote to memory of 3584	4412	Aimtxznnlqlhr.exe	97
PID 4412 wrote to memory of 3632	4412	Aimtxznnlqlhr.exe	98
PID 4412 wrote to memory of 3632	4412	Aimtxznnlqlhr.exe	98
PID 4412 wrote to memory of 3632	4412	Aimtxznnlqlhr.exe	98
PID 3584 wrote to memory of 4204	3584	Window Security Health Service.exe	100
PID 3584 wrote to memory of 4204	3584	Window Security Health Service.exe	100
PID 3584 wrote to memory of 4204	3584	Window Security Health Service.exe	100
PID 3584 wrote to memory of 4204	3584	Window Security Health Service.exe	100
PID 3584 wrote to memory of 4204	3584	Window Security Health Service.exe	100
PID 3584 wrote to memory of 4204	3584	Window Security Health Service.exe	100
PID 3584 wrote to memory of 4204	3584	Window Security Health Service.exe	100
PID 3584 wrote to memory of 4204	3584	Window Security Health Service.exe	100
PID 4204 wrote to memory of 4832	4204	Window Security Health Service.exe	101
PID 4204 wrote to memory of 4832	4204	Window Security Health Service.exe	101
PID 4204 wrote to memory of 4832	4204	Window Security Health Service.exe	101
PID 4412 wrote to memory of 1340	4412	Aimtxznnlqlhr.exe	106
PID 4412 wrote to memory of 1340	4412	Aimtxznnlqlhr.exe	106
PID 4412 wrote to memory of 1340	4412	Aimtxznnlqlhr.exe	106
PID 1340 wrote to memory of 4580	1340	cmd.exe	108
PID 1340 wrote to memory of 4580	1340	cmd.exe	108
PID 1340 wrote to memory of 4580	1340	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\BitcoinFakeTransaction\BitcoinFakeTransaction.exe
"C:\Users\Admin\AppData\Local\Temp\BitcoinFakeTransaction\BitcoinFakeTransaction.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe
  "C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe
    "C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe"
    3⤵
    - Executes dropped EXE
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe
    "C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe"
    3⤵
    - Executes dropped EXE
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe
    "C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe"
    3⤵
    - Executes dropped EXE
    PID:2344
- - C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe
    "C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe"
    3⤵
    - Executes dropped EXE
    PID:1480
- - C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe
    "C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe"
    3⤵
    - Executes dropped EXE
    PID:4700
- C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe
  "C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe
    "C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Checks computer location settings
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "window update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:3548
  - - C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe
      "C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3584
    - - C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe
        
        "C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4204
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "window update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe" /rl HIGHEST /f
        6⤵
        Creates scheduled task(s)
        
        PID:4832
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3632
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1340
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
        5⤵
        
        PID:4580
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 2512
      4⤵
      Program crash
      PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4412 -ip 4412
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Window Security Health Service.exe.log

Filesize
507B

MD5
8cf94b5356be60247d331660005941ec

SHA1
fdedb361f40f22cb6a086c808fc0056d4e421131

SHA256
52a5b2d36f2b72cb02c695cf7ef46444dda73d4ea82a73e0894c805fa9987bc0

SHA512
b886dfc8bf03f8627f051fb6e2ac40ae2e7713584695a365728eb2e2c87217830029aa35bd129c642fa03dde3f7a7dd5690b16248676be60a6bb5f497fb23651

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
C:\Users\Admin\AppData\Local\Temp\JpzYvteRjugY.bat

Filesize
210B

MD5
090e285f5635127637fd2897b84be199

SHA1
62aa00c1215cc454dd48efefe46eb566b5fdb9c4

SHA256
ceefef8ab462a7766e99776d5b96562d63d03c0a508e977348e5069a145bfe7a

SHA512
2e00ed063dd2238f4f297931abc56d8631b5d774137ef46c074bfb9abd7b9fa3dd08e0b46676aa369d4170a5715d6ba06d8fe597f15da42f40ac0f46fb20adb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe

Filesize
206KB

MD5
01af6f42da188981c1a00494199fdfbc

SHA1
3147729b4e4df80628e658ae173bb6b8c7fd4479

SHA256
4b128169df80bba5f09ca7fb7aefdc03ccca3b7c4ef3f5af5af582af217f3b50

SHA512
d73233fde28540b5203484e5303453322cdeaadfec1373745d3c6d9569d511387ddcb882f261f76825673ce5608d628432ea5066da384bac8d2c2e4a067222e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe

Filesize
206KB

MD5
01af6f42da188981c1a00494199fdfbc

SHA1
3147729b4e4df80628e658ae173bb6b8c7fd4479

SHA256
4b128169df80bba5f09ca7fb7aefdc03ccca3b7c4ef3f5af5af582af217f3b50

SHA512
d73233fde28540b5203484e5303453322cdeaadfec1373745d3c6d9569d511387ddcb882f261f76825673ce5608d628432ea5066da384bac8d2c2e4a067222e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe

Filesize
206KB

MD5
01af6f42da188981c1a00494199fdfbc

SHA1
3147729b4e4df80628e658ae173bb6b8c7fd4479

SHA256
4b128169df80bba5f09ca7fb7aefdc03ccca3b7c4ef3f5af5af582af217f3b50

SHA512
d73233fde28540b5203484e5303453322cdeaadfec1373745d3c6d9569d511387ddcb882f261f76825673ce5608d628432ea5066da384bac8d2c2e4a067222e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe

Filesize
206KB

MD5
01af6f42da188981c1a00494199fdfbc

SHA1
3147729b4e4df80628e658ae173bb6b8c7fd4479

SHA256
4b128169df80bba5f09ca7fb7aefdc03ccca3b7c4ef3f5af5af582af217f3b50

SHA512
d73233fde28540b5203484e5303453322cdeaadfec1373745d3c6d9569d511387ddcb882f261f76825673ce5608d628432ea5066da384bac8d2c2e4a067222e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe

Filesize
206KB

MD5
01af6f42da188981c1a00494199fdfbc

SHA1
3147729b4e4df80628e658ae173bb6b8c7fd4479

SHA256
4b128169df80bba5f09ca7fb7aefdc03ccca3b7c4ef3f5af5af582af217f3b50

SHA512
d73233fde28540b5203484e5303453322cdeaadfec1373745d3c6d9569d511387ddcb882f261f76825673ce5608d628432ea5066da384bac8d2c2e4a067222e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe

Filesize
206KB

MD5
01af6f42da188981c1a00494199fdfbc

SHA1
3147729b4e4df80628e658ae173bb6b8c7fd4479

SHA256
4b128169df80bba5f09ca7fb7aefdc03ccca3b7c4ef3f5af5af582af217f3b50

SHA512
d73233fde28540b5203484e5303453322cdeaadfec1373745d3c6d9569d511387ddcb882f261f76825673ce5608d628432ea5066da384bac8d2c2e4a067222e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe

Filesize
206KB

MD5
01af6f42da188981c1a00494199fdfbc

SHA1
3147729b4e4df80628e658ae173bb6b8c7fd4479

SHA256
4b128169df80bba5f09ca7fb7aefdc03ccca3b7c4ef3f5af5af582af217f3b50

SHA512
d73233fde28540b5203484e5303453322cdeaadfec1373745d3c6d9569d511387ddcb882f261f76825673ce5608d628432ea5066da384bac8d2c2e4a067222e0

Download Submit
C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
memory/564-143-0x0000000005B20000-0x00000000060C4000-memory.dmp

Filesize
5.6MB

Download
memory/564-145-0x0000000005610000-0x00000000056AC000-memory.dmp

Filesize
624KB

Download
memory/564-136-0x0000000000000000-mapping.dmp

Download
memory/564-141-0x0000000000B70000-0x0000000000C1C000-memory.dmp

Filesize
688KB

Download
memory/564-144-0x0000000005570000-0x0000000005602000-memory.dmp

Filesize
584KB

Download
memory/1112-134-0x0000000000000000-mapping.dmp

Download
memory/1112-142-0x0000000000520000-0x000000000055A000-memory.dmp

Filesize
232KB

Download
memory/1340-189-0x0000000000000000-mapping.dmp

Download
memory/1480-158-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1480-157-0x0000000000000000-mapping.dmp

Download
memory/1480-160-0x0000000005D10000-0x0000000005D1A000-memory.dmp

Filesize
40KB

Download
memory/2148-151-0x0000000000000000-mapping.dmp

Download
memory/2344-155-0x0000000000000000-mapping.dmp

Download
memory/3548-164-0x0000000000000000-mapping.dmp

Download
memory/3584-165-0x0000000000000000-mapping.dmp

Download
memory/3632-183-0x0000000007220000-0x000000000723A000-memory.dmp

Filesize
104KB

Download
memory/3632-187-0x0000000007560000-0x000000000757A000-memory.dmp

Filesize
104KB

Download
memory/3632-184-0x0000000007290000-0x000000000729A000-memory.dmp

Filesize
40KB

Download
memory/3632-185-0x00000000074A0000-0x0000000007536000-memory.dmp

Filesize
600KB

Download
memory/3632-180-0x0000000070200000-0x000000007024C000-memory.dmp

Filesize
304KB

Download
memory/3632-167-0x0000000000000000-mapping.dmp

Download
memory/3632-188-0x0000000007540000-0x0000000007548000-memory.dmp

Filesize
32KB

Download
memory/3632-179-0x00000000064E0000-0x0000000006512000-memory.dmp

Filesize
200KB

Download
memory/3632-171-0x0000000004940000-0x0000000004976000-memory.dmp

Filesize
216KB

Download
memory/3632-182-0x0000000007860000-0x0000000007EDA000-memory.dmp

Filesize
6.5MB

Download
memory/3632-186-0x0000000007450000-0x000000000745E000-memory.dmp

Filesize
56KB

Download
memory/3632-174-0x0000000004FE0000-0x0000000005608000-memory.dmp

Filesize
6.2MB

Download
memory/3632-175-0x0000000004F50000-0x0000000004F72000-memory.dmp

Filesize
136KB

Download
memory/3632-176-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/3632-177-0x0000000005F20000-0x0000000005F3E000-memory.dmp

Filesize
120KB

Download
memory/3632-181-0x00000000064C0000-0x00000000064DE000-memory.dmp

Filesize
120KB

Download
memory/4204-169-0x0000000000000000-mapping.dmp

Download
memory/4268-146-0x0000000000000000-mapping.dmp

Download
memory/4412-163-0x0000000006A60000-0x0000000006A9C000-memory.dmp

Filesize
240KB

Download
memory/4412-162-0x00000000064F0000-0x0000000006502000-memory.dmp

Filesize
72KB

Download
memory/4412-161-0x0000000005780000-0x00000000057E6000-memory.dmp

Filesize
408KB

Download
memory/4412-148-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4412-147-0x0000000000000000-mapping.dmp

Download
memory/4580-190-0x0000000000000000-mapping.dmp

Download
memory/4700-153-0x0000000000000000-mapping.dmp

Download
memory/4732-132-0x00000000004C0000-0x00000000005C0000-memory.dmp

Filesize
1024KB

Download
memory/4732-140-0x00007FFF2CB60000-0x00007FFF2D621000-memory.dmp

Filesize
10.8MB

Download
memory/4732-133-0x00007FFF2CB60000-0x00007FFF2D621000-memory.dmp

Filesize
10.8MB

Download
memory/4832-178-0x0000000000000000-mapping.dmp

Download