quasar | hxxps://github[.]com/quasar/Quasar

Analysis

max time kernel
1739s
max time network
1690s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 00:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/quasar/Quasar

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/2104-234-0x000001AD32770000-0x000001AD328A8000-memory.dmp	family_quasar
behavioral1/memory/2104-237-0x000001AD32C90000-0x000001AD32CA6000-memory.dmp	family_quasar

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
34	camo.githubusercontent.com
35	camo.githubusercontent.com
36	raw.githubusercontent.com
37	raw.githubusercontent.com
38	raw.githubusercontent.com
39	raw.githubusercontent.com
31	camo.githubusercontent.com
33	camo.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 49 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\NodeSlot = "3"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 78003100000000008f57404b1100557365727300640009000400efbe874f7748545895012e000000c70500000000010000000000000000003a00000000005d34af0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 7e003100000000005458a60111004465736b746f7000680009000400efbe8f57404b5458a6012e00000086e101000000010000000000000000003e00000000009c02b9004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0 = 66003100000000005458ba0110005155415341527e312e3100004c0009000400efbe5458a6015458bb012e000000e3da0100000015000000000000000000000000000000e8777e005100750061007300610072002000760031002e0034002e00310000001a000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 50003100000000008f577354100041646d696e003c0009000400efbe8f57404b545895012e0000007ce10100000001000000000000000000000000000000e6154800410064006d0069006e00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2596	explorer.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
4236	msedge.exe
4236	msedge.exe
4408	identity_helper.exe
4408	identity_helper.exe
2176	msedge.exe
2176	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2104	Quasar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	Quasar.exe
Token: SeManageVolumePrivilege	1728	svchost.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
2104	Quasar.exe
2104	Quasar.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
2104	Quasar.exe
2104	Quasar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2596	explorer.exe
2596	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4132	4236	msedge.exe	84
PID 4236 wrote to memory of 4132	4236	msedge.exe	84
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 1052	4236	msedge.exe	85
PID 4236 wrote to memory of 884	4236	msedge.exe	86
PID 4236 wrote to memory of 884	4236	msedge.exe	86
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87
PID 4236 wrote to memory of 4376	4236	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/quasar/Quasar
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5adf46f8,0x7ffb5adf4708,0x7ffb5adf4718
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,7445531073875406746,13369968847633735947,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4404

C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe
"C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2104
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12"
  2⤵
  PID:2520

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2596

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
fa5e145b5e637dd2b3e39cfd09ae469b

SHA1
c8e97a3cfc643ef9ce64c9b11fbb08faeb496eba

SHA256
8c61700b6918e7c9f06219a8d540a6b1d4bde8b04d254783d64bf3791e73a1e2

SHA512
b198ef35e1d97b83ab47488bcf99cf67cad203079a7b9b8b445045d0aa11ba6df6dbcd409d1a081489ba16d1b74697a874d705996d1bde782a6ab8f4791ac86a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
663B

MD5
e0c8ba5acacb79299dc526c5daa1d0ce

SHA1
0ee66ba200a26340b183e6296b6772904e6465dc

SHA256
2afc4f4876503a33efdf70f73706fe5756d29d064dfa84db1aec8b373c895962

SHA512
ce81aa6f76c9247002fccd9ca18ff9bdd93e4bed6c5d0b60d01d7108a223eff2010d270bcff4935a27ca443c2c0b71451edb6e7829c4a8e8cb3746dd65318625

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1fa0bd1abd831e01302d848ec99f07fa

SHA1
00062287dea72c5648b84d585c9e04634861b7ef

SHA256
33b9b0eace6df40d72f141552baae9fa3816d82a8480d40bc3ee94d9e614f312

SHA512
ab431bb44868ef34bb1842b8a09144a3379491e37648f98284e9248e10a2b0c6cff5a739488305f7f3b8432fe3f86c75599f59c0a2bbbc26024eb1e36256ca00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
62929b8888e37c8b7726d2fdd4c4f306

SHA1
8b918222e8e4a5d07a6510173ee6a69fb7b218f9

SHA256
cdaa7bc31bf4c84407fdf928e1fa2dc52ff9e1476febd6a7ebffda926bd44a1d

SHA512
426555112607ad01d8ded3923a93586d3b42032202ab80cde11b491e5b0d51d15cd3b8396135dac5df3341fb00f54d5de1b60be206403cc8eb554ab719931871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ad02d1ca7e6917fe6e7fd6ec61abb76e

SHA1
c324d1248e64d0c2c39ab9dc565fa7e6a3cfae61

SHA256
ff75cce677d49f7d823b88af55483dcb28b33a7edc3225efbb03f7928e605386

SHA512
19ef174adbadcc739f1d5f8ef2b8be3255dbcfba2ae38c1addbb4b21c92791c9ea9a4fc6f44675744582d13103b37e010b33ba1a4eb939869bf1341b41f8eba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fdc28f6dbd72bf5f3f1285c53d12ba99

SHA1
a472e311c14a1535d5539ff4ea8bcc3ed1253f57

SHA256
5dc8f3bcc66466fb77159afa0747276eb0b3c4dd7b38ac9453ecb95220dd76c0

SHA512
cccf14d4a0264a706729c42536311874889dc183b5a6902931e635616a026fefad244b4e79be9b349138cf822bf7e1003abbed8003b9cad4a3dae70028aa57cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c9bac9b9ff2554a43c497ac3d88a869b

SHA1
bb8d065b927e6db55343b216b0e3d780b3b32a24

SHA256
afd428849de4fdf50c853f1bb0350820240a0b188dde6c155c2865cb8fe4f324

SHA512
0fe3fd1378be0f976d66f67ba05905cf4c5ce881b748e533f949f4891cfb733f67d2bc80b605adfee8d469177cfb83e3bf1b43067b1f0dda0f8a08ea3033381c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7d03b40f3da0dd81f17e53d1a162ad80

SHA1
2651c38296a3cc7acabb07018f5433075b3b1c79

SHA256
ca3223cfa9e760080c38788b7f40ce1c7a567b10f5c81ead174d9db2af53a104

SHA512
54fa2aac351ce68f21731402dfa5bed9a2821f07c2f0f447aeb3b93be7b781478ac42fd9b4db02474876b554021c25e2e6dbe1a01ef23fcdfa264b0651fad095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580616.TMP

Filesize
1KB

MD5
dc9d40cce186b8cd5be7042251973d2d

SHA1
19e5c3438df3575d52fbfddb246f5ef2336327fb

SHA256
c53c8f1fd559e389c99ddb79a5e1fc5d7497f4f8c128d86500fb354e79afdda6

SHA512
e9e44639a8f908bf3b5506c3c799c5c275e2850168a820a2022ea0949897bde9d28c1e46840b458acac3d8425e6571f69850619e12c68aedced410dd333e9640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
54bb63da7eed504ae026a9d682240ce6

SHA1
a8bc1f0e5c53e2a1eeb061f0947b465a9fa8e46e

SHA256
58ca479eda8a43e6cbdc03e28d8031694c5b098ecc9565d4f3633b4bcd16a706

SHA512
0614adc235fa6e62f392dd7ccf01357db091c3abe0427d0daa64efe196003fb28ca0364d22fdbff7ae708d4950120b7c25c0957e2c814a4cbe804938e07ffcd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1fa605e12a2ee1e9080e334f975b0eb1

SHA1
d13ac4d394fabaa864df41b4a2f81139b0e7bab8

SHA256
ff6bd36f6641cf6b8445b5393950a0b9a50717e7481cbca86a14acf1416e3dfb

SHA512
e75e46ca0dd2348b0d8f03cf7c3e38ecd94ca5d1d44b738907e509a0d068f9d134eecd37974f1ac87aa17d7a501ccd6a27500c10ba6a14ffc40d60890f4a9330

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12

Filesize
4KB

MD5
5f46d158b01a50e5325e274705b0083a

SHA1
a7e61d35285bea1a81a9ea6193ee009495552dc4

SHA256
de7b40068862b96e19398bd266cfa90c3fabb748bfd2ce1295815cad56c8e4db

SHA512
352ccc33b0ff0bd7e94f47d40b74e21e4476011bda77d6bf314a3fa2145eaa41a4abb6ed394a18cee0f4f7d5485d1cffc7e369158c49cd8f780530d4fcf516e7

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\settings.xml

Filesize
371B

MD5
482b40c0d7aa8a3d1bbf44e34b4d2ca5

SHA1
d6d24c92b01a2d8a1e9cd5a15669443091f1c7a7

SHA256
40adac53b3488585f0bd0dfc919d7d145184d4b78ee7641d721bfdf141571c31

SHA512
64774f6c520ba1b99c353d79747e78d07dce9220ba9d4a0d81d8abd6d593ef32941b73d7795e1666b0777571bca194d9ac7b6b4394c1b2bde32387ea4ee2f813

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.4.1.zip

Filesize
128KB

MD5
cf48e6778ffd9ecfb862978dee7a30c5

SHA1
1c2b6d594c8bd048e32642b81d25e40d287abbb1

SHA256
b19793eea0d918e8981ef8083827088e06f929711298d9f4c0c01854f0db7493

SHA512
b964163abfba0f13524d574a02b12a0f0626d569d0d3d1fe428c61f32e4ecf52f4905723b6fa69d97ac5268eff1850d41a623e42d30e167aef4658229c19c5f4

Download Submit
memory/1728-410-0x000001AC13DE0000-0x000001AC13DE1000-memory.dmp

Filesize
4KB

Download
memory/1728-409-0x000001AC13DE0000-0x000001AC13DE1000-memory.dmp

Filesize
4KB

Download
memory/1728-407-0x000001AC13DB0000-0x000001AC13DB1000-memory.dmp

Filesize
4KB

Download
memory/1728-411-0x000001AC13EF0000-0x000001AC13EF1000-memory.dmp

Filesize
4KB

Download
memory/1728-391-0x000001AC0BA40000-0x000001AC0BA50000-memory.dmp

Filesize
64KB

Download
memory/1728-375-0x000001AC0B940000-0x000001AC0B950000-memory.dmp

Filesize
64KB

Download
memory/2104-258-0x000001AD50010000-0x000001AD5033E000-memory.dmp

Filesize
3.2MB

Download
memory/2104-280-0x000001AD344F0000-0x000001AD34500000-memory.dmp

Filesize
64KB

Download
memory/2104-281-0x000001AD344F0000-0x000001AD34500000-memory.dmp

Filesize
64KB

Download
memory/2104-275-0x000001AD344F0000-0x000001AD34500000-memory.dmp

Filesize
64KB

Download
memory/2104-274-0x000001AD344F0000-0x000001AD34500000-memory.dmp

Filesize
64KB

Download
memory/2104-330-0x000001AD4DA50000-0x000001AD4DA68000-memory.dmp

Filesize
96KB

Download
memory/2104-331-0x000001AD4DAC0000-0x000001AD4DB10000-memory.dmp

Filesize
320KB

Download
memory/2104-332-0x000001AD4F400000-0x000001AD4F4B2000-memory.dmp

Filesize
712KB

Download
memory/2104-333-0x000001AD4DB10000-0x000001AD4DB5C000-memory.dmp

Filesize
304KB

Download
memory/2104-270-0x00007FFB46C20000-0x00007FFB476E1000-memory.dmp

Filesize
10.8MB

Download
memory/2104-354-0x000001AD344F0000-0x000001AD34500000-memory.dmp

Filesize
64KB

Download
memory/2104-357-0x000001AD344F0000-0x000001AD34500000-memory.dmp

Filesize
64KB

Download
memory/2104-365-0x00007FFB46C20000-0x00007FFB476E1000-memory.dmp

Filesize
10.8MB

Download
memory/2104-248-0x000001AD344F0000-0x000001AD34500000-memory.dmp

Filesize
64KB

Download
memory/2104-247-0x000001AD344F0000-0x000001AD34500000-memory.dmp

Filesize
64KB

Download
memory/2104-237-0x000001AD32C90000-0x000001AD32CA6000-memory.dmp

Filesize
88KB

Download
memory/2104-236-0x000001AD344F0000-0x000001AD34500000-memory.dmp

Filesize
64KB

Download
memory/2104-235-0x00007FFB46C20000-0x00007FFB476E1000-memory.dmp

Filesize
10.8MB

Download
memory/2104-234-0x000001AD32770000-0x000001AD328A8000-memory.dmp

Filesize
1.2MB

Download