quasar | 358b3681682b402dba9c1bf1297193fe257d8cc11e51c2924c657eb2057beb04

Analysis

max time kernel
151s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

380cd105672b970a3783c0036ebaf09d.exe
Size

1.0MB
MD5

380cd105672b970a3783c0036ebaf09d
SHA1

112ee91c03921b1aaa3ca9b901054a62a11b0268
SHA256

358b3681682b402dba9c1bf1297193fe257d8cc11e51c2924c657eb2057beb04
SHA512

e3e7954328a98af7b4dd3ec0efa2c390f6d10b8e2037e582043902482f7e90241b0565c0da7972f14193efe517a305441306cb7c32b2f444ba5c58c1c7c5f2da
SSDEEP

24576:Lw/UH7Q9OEKM4TbVOD6s6F+2iYNenwhhWZ0ZnLsm:FH7QAHTbVOD6sl2Zhh

Score

10^/10

quasar venomrat sep05 evasion persistence rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

SEP05

23.105.131.187:7812

Mutex

VNM_MUTEX_mn3z5p1P4yabWtL9nJ

Attributes

encryption_key
R5zGfMq4QEUio50PoLwo
install_name
Windows Defender Security.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update Service
subdirectory
Windows Security Firewall

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/memory/2984-9-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

380cd105672b970a3783c0036ebaf09d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	380cd105672b970a3783c0036ebaf09d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	380cd105672b970a3783c0036ebaf09d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	380cd105672b970a3783c0036ebaf09d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	380cd105672b970a3783c0036ebaf09d.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2984-9-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

380cd105672b970a3783c0036ebaf09d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	380cd105672b970a3783c0036ebaf09d.exe

Executes dropped EXE 2 IoCs

Processes:

Windows Defender Security.exeWindows Defender Security.exe

pid process

4088 Windows Defender Security.exe
2304 Windows Defender Security.exe

pid	process
4088	Windows Defender Security.exe
2304	Windows Defender Security.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

380cd105672b970a3783c0036ebaf09d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	380cd105672b970a3783c0036ebaf09d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	380cd105672b970a3783c0036ebaf09d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

380cd105672b970a3783c0036ebaf09d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rQDLJjyJSH = "C:\\Users\\Admin\\AppData\\Roaming\\AyBtHTTCxa\\gSGYsYDHyz.exe"	380cd105672b970a3783c0036ebaf09d.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

36 ip-api.com

flow	ioc
36	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

380cd105672b970a3783c0036ebaf09d.exeWindows Defender Security.exe380cd105672b970a3783c0036ebaf09d.exe

description	pid	process	target process
PID 3064 set thread context of 2984	3064	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 4088 set thread context of 2304	4088	Windows Defender Security.exe	Windows Defender Security.exe
PID 652 set thread context of 3008	652	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1840 schtasks.exe
3860 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1328 PING.EXE

pid	process
1840	schtasks.exe
3860	schtasks.exe

pid	process
1328	PING.EXE

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

380cd105672b970a3783c0036ebaf09d.exepowershell.exe380cd105672b970a3783c0036ebaf09d.exe380cd105672b970a3783c0036ebaf09d.exe380cd105672b970a3783c0036ebaf09d.exe

pid	process
3064	380cd105672b970a3783c0036ebaf09d.exe
3064	380cd105672b970a3783c0036ebaf09d.exe
3884	powershell.exe
3884	powershell.exe
3884	powershell.exe
2984	380cd105672b970a3783c0036ebaf09d.exe
2984	380cd105672b970a3783c0036ebaf09d.exe
2984	380cd105672b970a3783c0036ebaf09d.exe
2984	380cd105672b970a3783c0036ebaf09d.exe
2984	380cd105672b970a3783c0036ebaf09d.exe
2984	380cd105672b970a3783c0036ebaf09d.exe
2984	380cd105672b970a3783c0036ebaf09d.exe
2984	380cd105672b970a3783c0036ebaf09d.exe
652	380cd105672b970a3783c0036ebaf09d.exe
652	380cd105672b970a3783c0036ebaf09d.exe
3008	380cd105672b970a3783c0036ebaf09d.exe
3008	380cd105672b970a3783c0036ebaf09d.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

380cd105672b970a3783c0036ebaf09d.exe380cd105672b970a3783c0036ebaf09d.exepowershell.exeWindows Defender Security.exe380cd105672b970a3783c0036ebaf09d.exe380cd105672b970a3783c0036ebaf09d.exe

description	pid	process
Token: SeDebugPrivilege	3064	380cd105672b970a3783c0036ebaf09d.exe
Token: SeDebugPrivilege	2984	380cd105672b970a3783c0036ebaf09d.exe
Token: SeDebugPrivilege	3884	powershell.exe
Token: SeDebugPrivilege	2304	Windows Defender Security.exe
Token: SeDebugPrivilege	2304	Windows Defender Security.exe
Token: SeDebugPrivilege	652	380cd105672b970a3783c0036ebaf09d.exe
Token: SeDebugPrivilege	3008	380cd105672b970a3783c0036ebaf09d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Windows Defender Security.exe

pid process

2304 Windows Defender Security.exe

pid	process
2304	Windows Defender Security.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

380cd105672b970a3783c0036ebaf09d.exe380cd105672b970a3783c0036ebaf09d.exeWindows Defender Security.exeWindows Defender Security.execmd.execmd.exe380cd105672b970a3783c0036ebaf09d.exe

description	pid	process	target process
PID 3064 wrote to memory of 1324	3064	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 3064 wrote to memory of 1324	3064	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 3064 wrote to memory of 1324	3064	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 3064 wrote to memory of 2984	3064	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 3064 wrote to memory of 2984	3064	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 3064 wrote to memory of 2984	3064	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 3064 wrote to memory of 2984	3064	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 3064 wrote to memory of 2984	3064	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 3064 wrote to memory of 2984	3064	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 3064 wrote to memory of 2984	3064	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 3064 wrote to memory of 2984	3064	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 2984 wrote to memory of 1840	2984	380cd105672b970a3783c0036ebaf09d.exe	schtasks.exe
PID 2984 wrote to memory of 1840	2984	380cd105672b970a3783c0036ebaf09d.exe	schtasks.exe
PID 2984 wrote to memory of 1840	2984	380cd105672b970a3783c0036ebaf09d.exe	schtasks.exe
PID 2984 wrote to memory of 4088	2984	380cd105672b970a3783c0036ebaf09d.exe	Windows Defender Security.exe
PID 2984 wrote to memory of 4088	2984	380cd105672b970a3783c0036ebaf09d.exe	Windows Defender Security.exe
PID 2984 wrote to memory of 4088	2984	380cd105672b970a3783c0036ebaf09d.exe	Windows Defender Security.exe
PID 2984 wrote to memory of 3884	2984	380cd105672b970a3783c0036ebaf09d.exe	powershell.exe
PID 2984 wrote to memory of 3884	2984	380cd105672b970a3783c0036ebaf09d.exe	powershell.exe
PID 2984 wrote to memory of 3884	2984	380cd105672b970a3783c0036ebaf09d.exe	powershell.exe
PID 4088 wrote to memory of 2304	4088	Windows Defender Security.exe	Windows Defender Security.exe
PID 4088 wrote to memory of 2304	4088	Windows Defender Security.exe	Windows Defender Security.exe
PID 4088 wrote to memory of 2304	4088	Windows Defender Security.exe	Windows Defender Security.exe
PID 4088 wrote to memory of 2304	4088	Windows Defender Security.exe	Windows Defender Security.exe
PID 4088 wrote to memory of 2304	4088	Windows Defender Security.exe	Windows Defender Security.exe
PID 4088 wrote to memory of 2304	4088	Windows Defender Security.exe	Windows Defender Security.exe
PID 4088 wrote to memory of 2304	4088	Windows Defender Security.exe	Windows Defender Security.exe
PID 4088 wrote to memory of 2304	4088	Windows Defender Security.exe	Windows Defender Security.exe
PID 2304 wrote to memory of 3860	2304	Windows Defender Security.exe	schtasks.exe
PID 2304 wrote to memory of 3860	2304	Windows Defender Security.exe	schtasks.exe
PID 2304 wrote to memory of 3860	2304	Windows Defender Security.exe	schtasks.exe
PID 2984 wrote to memory of 4840	2984	380cd105672b970a3783c0036ebaf09d.exe	cmd.exe
PID 2984 wrote to memory of 4840	2984	380cd105672b970a3783c0036ebaf09d.exe	cmd.exe
PID 2984 wrote to memory of 4840	2984	380cd105672b970a3783c0036ebaf09d.exe	cmd.exe
PID 4840 wrote to memory of 1184	4840	cmd.exe	cmd.exe
PID 4840 wrote to memory of 1184	4840	cmd.exe	cmd.exe
PID 4840 wrote to memory of 1184	4840	cmd.exe	cmd.exe
PID 2984 wrote to memory of 5052	2984	380cd105672b970a3783c0036ebaf09d.exe	cmd.exe
PID 2984 wrote to memory of 5052	2984	380cd105672b970a3783c0036ebaf09d.exe	cmd.exe
PID 2984 wrote to memory of 5052	2984	380cd105672b970a3783c0036ebaf09d.exe	cmd.exe
PID 5052 wrote to memory of 4908	5052	cmd.exe	BackgroundTransferHost.exe
PID 5052 wrote to memory of 4908	5052	cmd.exe	BackgroundTransferHost.exe
PID 5052 wrote to memory of 4908	5052	cmd.exe	BackgroundTransferHost.exe
PID 5052 wrote to memory of 1328	5052	cmd.exe	PING.EXE
PID 5052 wrote to memory of 1328	5052	cmd.exe	PING.EXE
PID 5052 wrote to memory of 1328	5052	cmd.exe	PING.EXE
PID 5052 wrote to memory of 652	5052	cmd.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 5052 wrote to memory of 652	5052	cmd.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 5052 wrote to memory of 652	5052	cmd.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 652 wrote to memory of 4748	652	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 652 wrote to memory of 4748	652	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 652 wrote to memory of 4748	652	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 652 wrote to memory of 3008	652	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 652 wrote to memory of 3008	652	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 652 wrote to memory of 3008	652	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 652 wrote to memory of 3008	652	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 652 wrote to memory of 3008	652	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 652 wrote to memory of 3008	652	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 652 wrote to memory of 3008	652	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe
PID 652 wrote to memory of 3008	652	380cd105672b970a3783c0036ebaf09d.exe	380cd105672b970a3783c0036ebaf09d.exe

C:\Users\Admin\AppData\Local\Temp\380cd105672b970a3783c0036ebaf09d.exe
"C:\Users\Admin\AppData\Local\Temp\380cd105672b970a3783c0036ebaf09d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\380cd105672b970a3783c0036ebaf09d.exe
  "C:\Users\Admin\AppData\Local\Temp\380cd105672b970a3783c0036ebaf09d.exe"
  2⤵
  PID:1324
- C:\Users\Admin\AppData\Local\Temp\380cd105672b970a3783c0036ebaf09d.exe
  "C:\Users\Admin\AppData\Local\Temp\380cd105672b970a3783c0036ebaf09d.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Checks computer location settings
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Windows Update Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\380cd105672b970a3783c0036ebaf09d.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1840
- - C:\Users\Admin\AppData\Roaming\Windows Security Firewall\Windows Defender Security.exe
    "C:\Users\Admin\AppData\Roaming\Windows Security Firewall\Windows Defender Security.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Users\Admin\AppData\Roaming\Windows Security Firewall\Windows Defender Security.exe
      "C:\Users\Admin\AppData\Roaming\Windows Security Firewall\Windows Defender Security.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2304
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows Update Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Security Firewall\Windows Defender Security.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:3860
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      PID:1184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\t13DzzvAF4Ff.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:4908
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\380cd105672b970a3783c0036ebaf09d.exe
      "C:\Users\Admin\AppData\Local\Temp\380cd105672b970a3783c0036ebaf09d.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:652
    - - C:\Users\Admin\AppData\Local\Temp\380cd105672b970a3783c0036ebaf09d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\380cd105672b970a3783c0036ebaf09d.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\380cd105672b970a3783c0036ebaf09d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\380cd105672b970a3783c0036ebaf09d.exe"
        5⤵
        
        PID:4748

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\380cd105672b970a3783c0036ebaf09d.exe.log

Filesize
507B

MD5
8cf94b5356be60247d331660005941ec

SHA1
fdedb361f40f22cb6a086c808fc0056d4e421131

SHA256
52a5b2d36f2b72cb02c695cf7ef46444dda73d4ea82a73e0894c805fa9987bc0

SHA512
b886dfc8bf03f8627f051fb6e2ac40ae2e7713584695a365728eb2e2c87217830029aa35bd129c642fa03dde3f7a7dd5690b16248676be60a6bb5f497fb23651

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pflxhsqz.rzv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\t13DzzvAF4Ff.bat

Filesize
229B

MD5
cfccfc8d6b470650d20c31147edfda14

SHA1
3612de925cbd08abefbad80b17204ce320056819

SHA256
5fabd80cd2ed45c8e369ab38f0a968d53125c04b7ea67e5e2f90d4a05d8f5595

SHA512
de223cb1aad72617ab87c453c78f5fd34ecbdb034850923d7447370ef843d81db5cdd4c21fa82aa364f845034d650bea0827a4d000b5f382d37668bb1dc526f0

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Security Firewall\Windows Defender Security.exe

Filesize
608KB

MD5
86fdf913f4a8f5d2942554967aadcd06

SHA1
9917132cb6f6af42563d076786cb8568f520e82c

SHA256
63594b21d8bea9108be42512b6f2c290169a3b755a5d9517469b9aeda999cafd

SHA512
c309d9a01f34c3478e3bc563d31da85ea60ea301e1fb3e5c10277e7dda21d7c80b463005afeed4e0d7bd5bf11d8a20905e700f44d72a95af9d4572982e1802ff

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Security Firewall\Windows Defender Security.exe

Filesize
157KB

MD5
ec9c3482e8078ff415519a41c5738c50

SHA1
01dab5954d5d52e60de39b63081e56be7a2a19ea

SHA256
9206075c82c96c0f4c0a6b8b16c1fa1694fd7ba2f8d5fce73eda524be550408c

SHA512
7bd56727e5737803209b62b2ed4a76f9506fc9c0e8ca795633eac8eff88f27b168a8d4b7dc9867a7942ec2a0b119cf61c7e2149eb5f5a761d402a4ceee9da6e9

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Security Firewall\Windows Defender Security.exe

Filesize
84KB

MD5
48fc60d3282c922e350e8d08457d7a51

SHA1
a9402f3f7d2d0ab665c15477d58c72a6882a59d2

SHA256
dddd2e8eca9806d28e0f720f911b54e53e92431de111d0a5b16ad7332a2f0a37

SHA512
bfad43be91b5b4f141381572fee957197f6b9eae08f300e417a0db41aee37d33fca2746a6b1be74b7d5c6b6175c56e56a069ba3e01c290a362363bf7681a6192

Download Submit
memory/652-84-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/652-86-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/652-89-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/2304-50-0x00000000071D0000-0x00000000071DA000-memory.dmp

Filesize
40KB

Download
memory/2304-85-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/2304-38-0x0000000005A00000-0x0000000005A10000-memory.dmp

Filesize
64KB

Download
memory/2304-88-0x0000000005A00000-0x0000000005A10000-memory.dmp

Filesize
64KB

Download
memory/2304-31-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-9-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2984-16-0x0000000006D40000-0x0000000006D7C000-memory.dmp

Filesize
240KB

Download
memory/2984-51-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-15-0x00000000067C0000-0x00000000067D2000-memory.dmp

Filesize
72KB

Download
memory/2984-14-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Filesize
408KB

Download
memory/2984-12-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-83-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-78-0x00000000057D0000-0x00000000057E0000-memory.dmp

Filesize
64KB

Download
memory/3008-90-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/3008-91-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/3064-5-0x0000000005970000-0x0000000005A02000-memory.dmp

Filesize
584KB

Download
memory/3064-3-0x00000000019F0000-0x00000000019FC000-memory.dmp

Filesize
48KB

Download
memory/3064-2-0x00000000019C0000-0x00000000019D0000-memory.dmp

Filesize
64KB

Download
memory/3064-1-0x0000000000EC0000-0x0000000000FC8000-memory.dmp

Filesize
1.0MB

Download
memory/3064-13-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/3064-4-0x00000000060C0000-0x0000000006664000-memory.dmp

Filesize
5.6MB

Download
memory/3064-0-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/3064-8-0x0000000005900000-0x000000000590A000-memory.dmp

Filesize
40KB

Download
memory/3064-6-0x0000000005B10000-0x0000000005BAC000-memory.dmp

Filesize
624KB

Download
memory/3884-45-0x0000000006430000-0x0000000006784000-memory.dmp

Filesize
3.3MB

Download
memory/3884-71-0x0000000007E20000-0x0000000007E2E000-memory.dmp

Filesize
56KB

Download
memory/3884-53-0x0000000006EB0000-0x0000000006EE2000-memory.dmp

Filesize
200KB

Download
memory/3884-52-0x000000007F360000-0x000000007F370000-memory.dmp

Filesize
64KB

Download
memory/3884-47-0x0000000006900000-0x000000000694C000-memory.dmp

Filesize
304KB

Download
memory/3884-54-0x00000000706E0000-0x000000007072C000-memory.dmp

Filesize
304KB

Download
memory/3884-64-0x0000000006E70000-0x0000000006E8E000-memory.dmp

Filesize
120KB

Download
memory/3884-65-0x0000000007B00000-0x0000000007BA3000-memory.dmp

Filesize
652KB

Download
memory/3884-67-0x0000000007BF0000-0x0000000007C0A000-memory.dmp

Filesize
104KB

Download
memory/3884-66-0x0000000008230000-0x00000000088AA000-memory.dmp

Filesize
6.5MB

Download
memory/3884-68-0x0000000007C60000-0x0000000007C6A000-memory.dmp

Filesize
40KB

Download
memory/3884-69-0x0000000007E70000-0x0000000007F06000-memory.dmp

Filesize
600KB

Download
memory/3884-70-0x0000000007DF0000-0x0000000007E01000-memory.dmp

Filesize
68KB

Download
memory/3884-48-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/3884-72-0x0000000007E30000-0x0000000007E44000-memory.dmp

Filesize
80KB

Download
memory/3884-73-0x0000000007F30000-0x0000000007F4A000-memory.dmp

Filesize
104KB

Download
memory/3884-74-0x0000000007F10000-0x0000000007F18000-memory.dmp

Filesize
32KB

Download
memory/3884-77-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/3884-46-0x00000000068E0000-0x00000000068FE000-memory.dmp

Filesize
120KB

Download
memory/3884-44-0x0000000006320000-0x0000000006386000-memory.dmp

Filesize
408KB

Download
memory/3884-40-0x0000000005B00000-0x0000000005B22000-memory.dmp

Filesize
136KB

Download
memory/3884-25-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/3884-27-0x0000000005B80000-0x00000000061A8000-memory.dmp

Filesize
6.2MB

Download
memory/3884-24-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/3884-26-0x0000000002FC0000-0x0000000002FF6000-memory.dmp

Filesize
216KB

Download
memory/4088-32-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/4088-23-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4088-22-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download