quasar | hxxps://gofile[.]io/d/ttia5b

Analysis

max time kernel
206s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/ttia5b
Sample240224-a5secaea9x

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.1.190:4782

Mutex

5df2cd7e-6571-470a-a39d-a1719f75fbf7

Attributes

encryption_key
A2A75FACA1C06678218490A9901AB58F2060EBFC
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
client
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 14 IoCs

resource	yara_rule
behavioral1/files/0x00070000000230fa-76.dat	family_quasar
behavioral1/files/0x00070000000230fa-96.dat	family_quasar
behavioral1/files/0x00070000000230fa-94.dat	family_quasar
behavioral1/memory/5048-115-0x00000000002F0000-0x0000000000614000-memory.dmp	family_quasar
behavioral1/files/0x00070000000230fa-118.dat	family_quasar
behavioral1/files/0x00070000000230fa-121.dat	family_quasar
behavioral1/files/0x000a00000002311e-131.dat	family_quasar
behavioral1/files/0x0007000000023127-134.dat	family_quasar
behavioral1/files/0x0007000000023127-135.dat	family_quasar
behavioral1/files/0x0007000000023127-140.dat	family_quasar
behavioral1/files/0x00070000000230fa-156.dat	family_quasar
behavioral1/files/0x00070000000230fa-199.dat	family_quasar
behavioral1/files/0x00070000000230fa-203.dat	family_quasar
behavioral1/files/0x00070000000230fa-215.dat	family_quasar

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
5048	Client-built.exe
4392	Client-built.exe
3392	Client-built.exe
5088	Client.exe
3788	Client.exe
224	Client-built.exe
3344	Client-built.exe
3800	Client-built.exe
1180	Client-built.exe
1784	Client-built.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4296	schtasks.exe
4756	schtasks.exe
4268	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 288523.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\SubDir\Client.exe\:SmartScreen:$DATA	Client-built.exe
File created	C:\Users\Admin\AppData\Roaming\SubDir\Client.exe\:SmartScreen:$DATA	Client-built.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
1932	msedge.exe
1932	msedge.exe
2876	identity_helper.exe
2876	identity_helper.exe
32	msedge.exe
32	msedge.exe
3392	Client-built.exe
3392	Client-built.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	Client-built.exe
Token: SeDebugPrivilege	4392	Client-built.exe
Token: SeDebugPrivilege	3392	Client-built.exe
Token: SeDebugPrivilege	5088	Client.exe
Token: SeDebugPrivilege	3788	Client.exe
Token: SeDebugPrivilege	224	Client-built.exe
Token: SeDebugPrivilege	3344	Client-built.exe
Token: SeDebugPrivilege	3800	Client-built.exe
Token: SeDebugPrivilege	1180	Client-built.exe
Token: SeDebugPrivilege	1784	Client-built.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
3788	Client.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
3788	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3788	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 3416	1932	msedge.exe	38
PID 1932 wrote to memory of 3416	1932	msedge.exe	38
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 868	1932	msedge.exe	88
PID 1932 wrote to memory of 4012	1932	msedge.exe	89
PID 1932 wrote to memory of 4012	1932	msedge.exe	89
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90
PID 1932 wrote to memory of 1724	1932	msedge.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/ttia5b
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffccc8a46f8,0x7ffccc8a4708,0x7ffccc8a4718
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:32
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:5048
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4268
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:4392
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4296
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3788
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:4756
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:2736
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,8495850859380615974,5547556111996180387,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1252

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3600

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3800

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1180

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client-built.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client-built.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef
MD5 360dd5debf8bf7b89c4d88d29e38446c
SHA1 65afff8c78aeb12c577a523cb77cd58d401b0f82
SHA512 0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6
MD5 6fbbaffc5a50295d007ab405b0885ab5
SHA1 518e87df81db1dded184c3e4e3f129cca15baba1
SHA512 011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 288B
SHA256 e1387d3ab81c6e96eb0e9c0f1dddd836c3c5cad5584ce70602b027bfe74b3541
MD5 8d0763f0122353bb579f43d5e785406b
SHA1 e02be1cac1ab9e35a65acc3d127656d4956625e5
SHA512 cad46874d3ac9d312414cc57ab73c9cc0139e132f2ae1941490d446ab0581b640d27438a9dc603a1b838624bb6137f7800a258d6c9d917cebc267dc8b98483e9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 317B
SHA256 b5e81a7c7d80feaaa10ee7bc8aaef9f21a5c1e4b03b3823ed115022311d674a0
MD5 afc6cddd7e64d81e52b729d09f227107
SHA1 ad0d3740f4b66de83db8862911c07dc91928d2f6
SHA512 844edb69585153c378a7c97709983776fc9303a32fb5ef8122ecca32adfc0b265f5ef7118ee07814da5c020ac7ba1bf2a2f66d46312e4d8e6df99aab2e5f9b2a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d193487d574fe9468a7cc358c99edb19c0755e997b808f006e808101baf750e9
MD5 4e2091de5c31820e482dacb7b6a3954c
SHA1 7c6db509cde97807ecbb7f23d50c829fb8be42e5
SHA512 686d3fd490b3c4eb4de752e82d51b3ad38df3731830b205e3b267e0b4efe0526f6fe1298ba4cf3d814f35d4f96c9d48e13f3fe471164d53d1ac76ccfa860299e
SSDEEP 96:n5k8sQ3Sxm/FDmqr1UaStwpvWMoiVmdeKu91jltnlJ+cYwUWQyV+VD7AiEwb:n5kyPUUaaWGWM6u9hlfJ+czrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 42097f5584f7bd82c104a8e16a755c6f02aa076a353ff4b25dbe5fc9ae622613
MD5 43801225a7f2774a7cf80b9f71cc59b5
SHA1 017217756b6bb1d846a61e1e8a5ab4a8fb23b710
SHA512 5f2c37e1172abb8c0601255c533d17397cf66918094ce8841c1ee759e32551efdc4851cf21049413085990a934fd432301067eeafebbcad76f83c41a67eaa20e
SSDEEP 96:n5kpSxm/FQYmqr1gaStwpvWMoiVmdeHltKYJ+cYwUWQyV+VD7ziEwb:n5kpPOUKaWGWMXlLJ+czrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5affe67e4c3095b1fba16525301722476ffd48daeee44c7b621e924ccf6b508e
MD5 bcc36c19388d73aac03a6ad94dbff5ca
SHA1 bbaf3f585f286176ebaceb41d7ddd08a0974ae20
SHA512 9bb49e1a7a9c488c6090859ac170f64160f64da88d5a59796656c9d8b382d352a1618ef4f743a4477b64e2566ef70eb149fa54b692009b7d55b8beb9ca5822b3
SSDEEP 96:n5kpSxm/FDmqr1UaStwpvWMoiVmdeKu91jltnYJ+cYwUWQyV+VD7AiEwb:n5kpPUUaaWGWM6u9hlqJ+czrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c442f66330c7a11f4abbd06d2d8c1e3f6c475a92e0e7fe5a7cd4c571846b871c
MD5 e682df64831ace87e655a4b3997261e7
SHA1 08af4fb3e65475b145cd639bacb3e1630c72c94c
SHA512 e1f3c0a22eec1918624a8bcf21fabb9f22457a67f1d918a792063b155570ea6b50021d5c7a00bc917116a02190bd0d8a0a515507a88da5ad6e952b866473696f
SSDEEP 192:9oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuptNe2RU2Akb6A/9xUX1MPey:x9iIxuERzA83h09RZxYPB8A/9E1MeuB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fdcaae0b6dc6221b37922741c9e82748d621c8aed1bde6b4cc5acd9f7ee35e24
MD5 c4d19c6684373c7105ab1a1b20579c32
SHA1 20d8946cf17091cb39c5a46624972dcf764becd0
SHA512 246c3fe6667f4de8f4a7dbbf43f6d59460c17c60c0514b83758750e673cdaa6f608022654276c4de77394d97c5b322874db42ce4fe5fbe06209989f1b7cc9ee0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuptNe2RU2Akb6AB9xUX1MPey:A9iIxuERzA83h09RZxYPB8AB9E1MeuB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 1.9MB
SHA256 1051fb9c44291bb67c922ab071358c17b199f9ae78d38154a33b4bd005df1e18
MD5 08067accc93e7cf4dce5bc71e8dac991
SHA1 521039396b8246333d2182e7da534a1486def9fb
SHA512 f3af63c61e9f6a678909b5b1889c319f1673c1a2ba5d65aee5ac6a0de947d5b216bce3230b3c37cfa525ba10369db4df5106fd3ff84a63f464f6825457ed7b56
SSDEEP 24576:3vCotTaHX2XaSaSFNNgPjluEiFFo2AKoUX3Y3YN3qHcCAT:3vht62XlaSFNWPjljiFa2RoUYI+Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 1.2MB
SHA256 9d82bb48b09bb41fb7ba74f3c86374d305c1ff500e6c0f9870572e21fee1a290
MD5 df2e114bd67d5556b7e70ee4e3de00ac
SHA1 8246fca6b7ff88620fb90cbfef2b4277a6817943
SHA512 8229b25a58a6da9d26e81fc2eaffb0a220c433c7bcae358b86490c8e93c9e883e404f8e60b3b119ffbb86b092d54f35281c2a87fe365c6b856ec61c6bcafca83
SSDEEP 24576:3vCotTaHX2XaSaSFNNgPjluEiFFo2AKoUX3p:3vht62XlaSFNWPjljiFa2RoUp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 628KB
SHA256 249be82df31864ba271fa7c8b981bf85dfbc15b70ffddcdb03c522a785aabf85
MD5 e99b90531e06acc91f438d90403a330c
SHA1 c5bcc8a8f20964d29f2ea1ba7822fdbb5c9527d7
SHA512 95cc42044c222ade4d5597ad6ab2c88fb5325fc093bec720039d617228e6ff24fe3a208d25144ed35648bc599a974e60f0bb7e8762596679c846123dbcb12c70
SSDEEP 12288:5vgMzKMZeLNbWHi2EIlOnefLBCmaquy+2gnF34:3vCotTaHX2P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 1.9MB
SHA256 3c0cbe83537f7aedcaa8bb7fb46c2370a79340d1e552df1705055fb722d7f66d
MD5 71e200ad2d8e00c8c7b0d7c863994b1f
SHA1 cf96fb11786e71b2987334da19d15394760978ca
SHA512 ffcb9f4524cdc90a04702cc6d50706d91cba66510ac5efb3590ca57ac97d76e75b974c538281794436e0731d4f0ed7bca456647d5f40d382a45fc1f5ef4ca842
SSDEEP 24576:3vCotTaHX2XaSaSFNNgPjluEiFFo2AKoUX3Y3YN3qHcCAWv:3vht62XlaSFNWPjljiFa2RoUYI+xv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client-built.exe

Path C:\Users\Admin\Downloads\Client-built.exe
Size 135KB
SHA256 c7b00b2425630acedd71ab72ede5c28be37e051ba4eeeb37088f46aed2a33cb3
MD5 34f041172c7a03e02f85c3046675fef3
SHA1 487b4c4b47e5d1ba5df6243efe286d3f6efe1ba5
SHA512 2d88b8d0aadfcc59af4f1877ebb684744e08c9e62507a9bb2e487e3261dde09c35f2d1bf7e3c189a7fe1aa5889a63941d696c1bc5dd0e7136f20f8b02834f6c5
SSDEEP 3072:CcFQ52gMzKMeFMnVrw/NueTkz6LNbWHP86y25Qs:CcvgMzKM4oNeTjLNbWHP6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client-built.exe

Path C:\Users\Admin\Downloads\Client-built.exe
Size 1.0MB
SHA256 bec71090c5e6f9ad5d1a891576ca65000e0a04a08f619444504ee5b35dae6612
MD5 003a096e9059dfab79b61cc502c815b5
SHA1 f83e1bc3a3c1afd5cf623b7e50801e31e5c8283f
SHA512 d692be80f74363b777cc783811057876013f33a89a576bc143e7738732005ef5deb5bf57cb0043a4df5866578303a2b96a0297d5890c1c48bf865a59a0f73398
SSDEEP 12288:5vgMzKMZeLNbWHi2EIlOnefLBCmaquy+2gnF3C/kcPkPfSaSFN+8gPjluEiFFo2+:3vCotTaHX2XaSaSFNNgPjluEiFFo2Af
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client-built.exe

Path C:\Users\Admin\Downloads\Client-built.exe
Size 3.1MB
SHA256 efa6907fae9a269436627c780d19368e8df247a0ee775836e658f2c60c509405
MD5 8591609d54b8f4f2a6396a8f5f14fc84
SHA1 ea7ed30d8d124cfde9b2f148c1419ad46c924f12
SHA512 1131f22ab7475a8ba829597750ee1fc35aba74b324591c5084348bef55e4884efe4c59a51a91e8076ceecc69e3e59678190c85aa066430bb32ff349f2419ef67
SSDEEP 49152:3vht62XlaSFNWPjljiFa2RoUYI+xDiEQsXkCxSLoGIhUcTHHB72eh2NT:3vL62XlaSFNWPjljiFXRoUYI+xD5c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client-built.exe

Path C:\Users\Admin\Downloads\Client-built.exe
Size 3.1MB
SHA256 38398ab46924093b02bc24de538befee3b0f410df4310780948d084d500fade8
MD5 82bc6170455b8e150c18ec85427357fc
SHA1 c2c19e9ba8a12b66364b478ac8c76f3bcecbf834
SHA512 cd40c731c199bbe1838157b14fbfcc068600f12b831f9e1e259cf3ac2bd991267b74b77b3a5dc4c64cb1b8bb04873b551cd7f9fe66880972ede797868b5812fd
SSDEEP 49152:3vht62XlaSFNWPjljiFa2RoUYI+xDiEQsXkCxSLoGIhUcTHHB72eh2NTk:3vL62XlaSFNWPjljiFXRoUYI+xD5cW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client-built.exe

Path C:\Users\Admin\Downloads\Client-built.exe
Size 761KB
SHA256 af3b841c48c468408cf48147b3ae7bdfc464f61d29754890c446f6b38e10666d
MD5 83180dc0d921d9cc63999c28fd13ce2b
SHA1 1ac632e7fa900aa31957f83e3192d3d9f3ee579c
SHA512 4b56ba50c0b283b3becf965dcc6ad33e6b391132d6a6a45f22ab0eef4bcd6ce243f254a4b3ecb99ab5c81e5a9e9175fc6c67e92e9c6c695049f7466c5f1842f3
SSDEEP 12288:5vgMzKMZeLNbWHi2EIlOnefLBCmaquy+2gnF3C/kcd:3vCotTaHX2X1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client-built.exe

Path C:\Users\Admin\Downloads\Client-built.exe
Size 2.6MB
SHA256 dd5fefcbd966bda990dad152ad73538ef7d01c8f377ef7444a659dc462a7350f
MD5 bdeb128c49cf169d577fcbc668fe0a49
SHA1 bef460e2b8f51e630dcf935ca100845460cd8c78
SHA512 c18f6249342844b0712840398c879013cb80fa63add27d33bd14c94a551cbcbefeb1a2857ae3148f904f2ea3ff61af3cbe7ed21b8e0d175864a7622380a468b3
SSDEEP 49152:3vht62XlaSFNWPjljiFa2RoUYI+xDiEQsXkCxSLoGIM:3vL62XlaSFNWPjljiFXRoUYI+xD5cP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client-built.exe

Path C:\Users\Admin\Downloads\Client-built.exe
Size 2.1MB
SHA256 5fd78d0384e4de231856e84719d77633e9d8849ba60278441557bea16e75716e
MD5 c3246d94b6a3c7a010ef47ce057c6b92
SHA1 e610bdd8cc7762d7a601e1289bef33291232aa23
SHA512 2db4ebe15034dbdc5b4c60c797ac4b3cddab5fe00ee790f1589cfc8371fcb5fc4c9a318634acfcc335b0383646e675ffaf9412bf133cc2682a73bcd703363ff0
SSDEEP 49152:3vht62XlaSFNWPjljiFa2RoUYI+xDiEQsI:3vL62XlaSFNWPjljiFXRoUYI+xDW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client-built.exe

Path C:\Users\Admin\Downloads\Client-built.exe
Size 2.3MB
SHA256 5497be5a3da5b434afc61f5ad92f532dd784e81c40670f0f184432939231d888
MD5 6812c94d29ccc9f44b577f5191e6bc47
SHA1 00a4aa1e7aac08d758b6971a1bf70c1ba2c06e4f
SHA512 5d65863ae1a69352dca415057370a295cc12c2949524e7d3405083188d5c028be28c7a815ccbb8de15b5c3010e7fdde9172415cd7a433df54f8af06fd2520eaa
SSDEEP 49152:3vht62XlaSFNWPjljiFa2RoUYI+xDiEQsc:3vL62XlaSFNWPjljiFXRoUYI+xD2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 288523.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 288523.crdownload
Size 2.5MB
SHA256 8decb545d938122ed1cd45bfaa49ac9832ef88059ee4073c2bd6a8dd76721bed
MD5 dd5234f7e91664709b673210229b4029
SHA1 8d59189dd046372f624bbc4b05d11cbcf8faf5de
SHA512 7da07ad1e46671f8390cba37e58782fa34c818cd4be15f5a2e7bfea04b9d1f1d91b52755157ce3aab7578559bab5d32e601929256f5199db4a0afa9f454f3c9f
SSDEEP 49152:3vht62XlaSFNWPjljiFa2RoUYI+xDiEQsXkCxSLU:3vL62XlaSFNWPjljiFXRoUYI+xD5cU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-158-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/224-159-0x000000001B090000-0x000000001B0A0000-memory.dmp

Download

memory/224-169-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/1180-212-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/1180-208-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/1180-209-0x0000000001760000-0x0000000001770000-memory.dmp

Download

memory/1784-218-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/1784-217-0x000000001B390000-0x000000001B3A0000-memory.dmp

Download

memory/1784-216-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/3344-202-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/3344-201-0x0000000000F60000-0x0000000000F70000-memory.dmp

Download

memory/3344-200-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/3392-153-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/3392-157-0x000000001BB70000-0x000000001BB80000-memory.dmp

Download

memory/3392-130-0x000000001BB70000-0x000000001BB80000-memory.dmp

Download

memory/3392-129-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/3788-142-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/3788-171-0x0000000002B20000-0x0000000002B30000-memory.dmp

Download

memory/3788-170-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/3788-146-0x000000001C890000-0x000000001C942000-memory.dmp

Download

memory/3788-145-0x000000001C780000-0x000000001C7D0000-memory.dmp

Download

memory/3788-228-0x000000001D1C0000-0x000000001D6E8000-memory.dmp

Download

memory/3800-205-0x000000001B780000-0x000000001B790000-memory.dmp

Download

memory/3800-206-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/3800-204-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/4392-119-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/4392-143-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/4392-120-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Download

memory/5048-137-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/5048-117-0x000000001B240000-0x000000001B250000-memory.dmp

Download

memory/5048-116-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/5048-115-0x00000000002F0000-0x0000000000614000-memory.dmp

Download

memory/5088-144-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download

memory/5088-139-0x000000001BD50000-0x000000001BD60000-memory.dmp

Download

memory/5088-138-0x00007FFCBAD40000-0x00007FFCBB801000-memory.dmp

Download