quasar | f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2.exe
Size 3.1MB
Sample240319-dk37wsfh63
SHA256 f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2
MD5 130640fbdce6bb6006df6e0d007d4feb
SHA1 876ec1f095e2dbe0847f12ca30179abc1b4becf1
SHA512 ae36223501b934038c4455d2a978dd545fc5e1ffde9aebea24a9962770e542a743d274a62946641763df8e5e29eecaf59c42f6a8d264d01c197808d7e00a8788
SSDEEP 49152:CvDI22SsaNYfdPBldt698dBcjHUkRJ6ebR3LoGdX4THHB72eh2NT:Cv822SsaNYfdPBldt6+dBcjHUkRJ6YH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

authapi-41985.portmap.host:41985

Mutex

50fd280e-bda2-413a-9ebd-86236f4b0beb

Attributes

encryption_key
E429F24E279E8B25742D0F5347151B0F90D031CA
install_name
system.exe
log_directory
Logs
reconnect_delay
3000
startup_key
system
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 8 IoCs

resource	yara_rule
behavioral2/memory/1588-0-0x0000000000060000-0x0000000000384000-memory.dmp	family_quasar
behavioral2/files/0x00020000000227ea-6.dat	family_quasar
behavioral2/files/0x00020000000227ea-7.dat	family_quasar
behavioral2/files/0x00020000000227ea-20.dat	family_quasar
behavioral2/files/0x00020000000227ea-29.dat	family_quasar
behavioral2/files/0x00020000000227ea-69.dat	family_quasar
behavioral2/files/0x00020000000227ea-93.dat	family_quasar
behavioral2/files/0x00020000000227ea-101.dat	family_quasar

Detects Windows executables referencing non-Windows User-Agents 8 IoCs

resource	yara_rule
behavioral2/memory/1588-0-0x0000000000060000-0x0000000000384000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x00020000000227ea-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x00020000000227ea-7.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x00020000000227ea-20.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x00020000000227ea-29.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x00020000000227ea-69.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x00020000000227ea-93.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x00020000000227ea-101.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 8 IoCs

resource	yara_rule
behavioral2/memory/1588-0-0x0000000000060000-0x0000000000384000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x00020000000227ea-6.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x00020000000227ea-7.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x00020000000227ea-20.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x00020000000227ea-29.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x00020000000227ea-69.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x00020000000227ea-93.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x00020000000227ea-101.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing common artifacts observed in infostealers 8 IoCs

resource	yara_rule
behavioral2/memory/1588-0-0x0000000000060000-0x0000000000384000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x00020000000227ea-6.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x00020000000227ea-7.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x00020000000227ea-20.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x00020000000227ea-29.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x00020000000227ea-69.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x00020000000227ea-93.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x00020000000227ea-101.dat	INDICATOR_SUSPICIOUS_GENInfoStealer

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	system.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	system.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	system.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	system.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	system.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	system.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	system.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	system.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	system.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	system.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	system.exe

Executes dropped EXE 12 IoCs

pid	Process
3392	system.exe
2616	system.exe
1068	system.exe
4804	system.exe
4028	system.exe
2128	system.exe
3496	system.exe
4324	system.exe
3972	system.exe
4504	system.exe
3228	system.exe
2324	system.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir\system.exe	system.exe
File opened for modification	C:\Windows\system32\SubDir\system.exe	f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2.exe
File opened for modification	C:\Windows\system32\SubDir\system.exe	system.exe
File opened for modification	C:\Windows\system32\SubDir	system.exe
File opened for modification	C:\Windows\system32\SubDir\system.exe	system.exe
File opened for modification	C:\Windows\system32\SubDir	system.exe
File opened for modification	C:\Windows\system32\SubDir	system.exe
File opened for modification	C:\Windows\system32\SubDir\system.exe	system.exe
File opened for modification	C:\Windows\system32\SubDir\system.exe	system.exe
File opened for modification	C:\Windows\system32\SubDir	system.exe
File created	C:\Windows\system32\SubDir\system.exe	f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2.exe
File opened for modification	C:\Windows\system32\SubDir\system.exe	system.exe
File opened for modification	C:\Windows\system32\SubDir	system.exe
File opened for modification	C:\Windows\system32\SubDir\system.exe	system.exe
File opened for modification	C:\Windows\system32\SubDir	system.exe
File opened for modification	C:\Windows\system32\SubDir\system.exe	system.exe
File opened for modification	C:\Windows\system32\SubDir	system.exe
File opened for modification	C:\Windows\system32\SubDir	system.exe
File opened for modification	C:\Windows\system32\SubDir	system.exe
File opened for modification	C:\Windows\system32\SubDir	system.exe
File opened for modification	C:\Windows\system32\SubDir	system.exe
File opened for modification	C:\Windows\system32\SubDir\system.exe	system.exe
File opened for modification	C:\Windows\system32\SubDir	f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2.exe
File opened for modification	C:\Windows\system32\SubDir\system.exe	system.exe
File opened for modification	C:\Windows\system32\SubDir\system.exe	system.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4612	schtasks.exe
4848	schtasks.exe
1928	schtasks.exe
4404	schtasks.exe
2448	schtasks.exe
2548	schtasks.exe
5052	schtasks.exe
4676	schtasks.exe
3128	schtasks.exe
3520	schtasks.exe
4268	schtasks.exe
4416	schtasks.exe
2260	schtasks.exe

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
3664	PING.EXE
1184	PING.EXE
3508	PING.EXE
3200	PING.EXE
1428	PING.EXE
1516	PING.EXE
2272	PING.EXE
228	PING.EXE
4452	PING.EXE
5044	PING.EXE
1028	PING.EXE

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2.exe
Token: SeDebugPrivilege	3392	system.exe
Token: SeDebugPrivilege	2616	system.exe
Token: SeDebugPrivilege	1068	system.exe
Token: SeDebugPrivilege	4804	system.exe
Token: SeDebugPrivilege	4028	system.exe
Token: SeDebugPrivilege	2128	system.exe
Token: SeDebugPrivilege	3496	system.exe
Token: SeDebugPrivilege	4324	system.exe
Token: SeDebugPrivilege	3972	system.exe
Token: SeDebugPrivilege	4504	system.exe
Token: SeDebugPrivilege	3228	system.exe
Token: SeDebugPrivilege	2324	system.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
3392	system.exe
2616	system.exe
1068	system.exe
4804	system.exe
4028	system.exe
2128	system.exe
3496	system.exe
4324	system.exe
3972	system.exe
4504	system.exe
3228	system.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
3392	system.exe
2616	system.exe
1068	system.exe
4804	system.exe
4028	system.exe
2128	system.exe
3496	system.exe
4324	system.exe
3972	system.exe
4504	system.exe
3228	system.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4324	system.exe
3228	system.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1928	1588	f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2.exe	96
PID 1588 wrote to memory of 1928	1588	f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2.exe	96
PID 1588 wrote to memory of 3392	1588	f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2.exe	98
PID 1588 wrote to memory of 3392	1588	f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2.exe	98
PID 3392 wrote to memory of 4612	3392	system.exe	99
PID 3392 wrote to memory of 4612	3392	system.exe	99
PID 3392 wrote to memory of 1796	3392	system.exe	103
PID 3392 wrote to memory of 1796	3392	system.exe	103
PID 1796 wrote to memory of 1492	1796	cmd.exe	105
PID 1796 wrote to memory of 1492	1796	cmd.exe	105
PID 1796 wrote to memory of 5044	1796	cmd.exe	106
PID 1796 wrote to memory of 5044	1796	cmd.exe	106
PID 1796 wrote to memory of 2616	1796	cmd.exe	112
PID 1796 wrote to memory of 2616	1796	cmd.exe	112
PID 2616 wrote to memory of 3520	2616	system.exe	113
PID 2616 wrote to memory of 3520	2616	system.exe	113
PID 2616 wrote to memory of 4452	2616	system.exe	115
PID 2616 wrote to memory of 4452	2616	system.exe	115
PID 4452 wrote to memory of 4272	4452	cmd.exe	117
PID 4452 wrote to memory of 4272	4452	cmd.exe	117
PID 4452 wrote to memory of 1428	4452	cmd.exe	118
PID 4452 wrote to memory of 1428	4452	cmd.exe	118
PID 4452 wrote to memory of 1068	4452	cmd.exe	120
PID 4452 wrote to memory of 1068	4452	cmd.exe	120
PID 1068 wrote to memory of 4404	1068	system.exe	121
PID 1068 wrote to memory of 4404	1068	system.exe	121
PID 1068 wrote to memory of 3220	1068	system.exe	123
PID 1068 wrote to memory of 3220	1068	system.exe	123
PID 3220 wrote to memory of 3640	3220	cmd.exe	125
PID 3220 wrote to memory of 3640	3220	cmd.exe	125
PID 3220 wrote to memory of 1028	3220	cmd.exe	126
PID 3220 wrote to memory of 1028	3220	cmd.exe	126
PID 3220 wrote to memory of 4804	3220	cmd.exe	130
PID 3220 wrote to memory of 4804	3220	cmd.exe	130
PID 4804 wrote to memory of 4848	4804	system.exe	132
PID 4804 wrote to memory of 4848	4804	system.exe	132
PID 4804 wrote to memory of 3908	4804	system.exe	134
PID 4804 wrote to memory of 3908	4804	system.exe	134
PID 3908 wrote to memory of 3504	3908	cmd.exe	136
PID 3908 wrote to memory of 3504	3908	cmd.exe	136
PID 3908 wrote to memory of 2272	3908	cmd.exe	137
PID 3908 wrote to memory of 2272	3908	cmd.exe	137
PID 3908 wrote to memory of 4028	3908	cmd.exe	138
PID 3908 wrote to memory of 4028	3908	cmd.exe	138
PID 4028 wrote to memory of 4268	4028	system.exe	139
PID 4028 wrote to memory of 4268	4028	system.exe	139
PID 4028 wrote to memory of 3124	4028	system.exe	141
PID 4028 wrote to memory of 3124	4028	system.exe	141
PID 3124 wrote to memory of 220	3124	cmd.exe	143
PID 3124 wrote to memory of 220	3124	cmd.exe	143
PID 3124 wrote to memory of 228	3124	cmd.exe	144
PID 3124 wrote to memory of 228	3124	cmd.exe	144
PID 3124 wrote to memory of 2128	3124	cmd.exe	145
PID 3124 wrote to memory of 2128	3124	cmd.exe	145
PID 2128 wrote to memory of 2448	2128	system.exe	146
PID 2128 wrote to memory of 2448	2128	system.exe	146
PID 2128 wrote to memory of 5072	2128	system.exe	148
PID 2128 wrote to memory of 5072	2128	system.exe	148
PID 5072 wrote to memory of 4720	5072	cmd.exe	150
PID 5072 wrote to memory of 4720	5072	cmd.exe	150
PID 5072 wrote to memory of 1516	5072	cmd.exe	151
PID 5072 wrote to memory of 1516	5072	cmd.exe	151
PID 5072 wrote to memory of 3496	5072	cmd.exe	153
PID 5072 wrote to memory of 3496	5072	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2.exe
"C:\Users\Admin\AppData\Local\Temp\f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1928
- C:\Windows\system32\SubDir\system.exe
  "C:\Windows\system32\SubDir\system.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yrmAY6BOPHgZ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1492
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:5044
  - - C:\Windows\system32\SubDir\system.exe
      "C:\Windows\system32\SubDir\system.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:3520
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nLUje652Uumm.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4452
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4272
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:1428
      - C:\Windows\system32\SubDir\system.exe
        
        "C:\Windows\system32\SubDir\system.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1068
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system.exe" /rl HIGHEST /f
        7⤵
        Creates scheduled task(s)
        
        PID:4404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3n2vFDfx9osF.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3640
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:1028
        
        C:\Windows\system32\SubDir\system.exe
        
        "C:\Windows\system32\SubDir\system.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system.exe" /rl HIGHEST /f
        9⤵
        Creates scheduled task(s)
        
        PID:4848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\weHQoO0WzJc7.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3908
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3504
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:2272
        
        C:\Windows\system32\SubDir\system.exe
        
        "C:\Windows\system32\SubDir\system.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system.exe" /rl HIGHEST /f
        11⤵
        Creates scheduled task(s)
        
        PID:4268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yia4QScoz2DF.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:220
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        Runs ping.exe
        
        PID:228
        
        C:\Windows\system32\SubDir\system.exe
        
        "C:\Windows\system32\SubDir\system.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system.exe" /rl HIGHEST /f
        13⤵
        Creates scheduled task(s)
        
        PID:2448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HIs1HyUHLspi.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4720
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        Runs ping.exe
        
        PID:1516
        
        C:\Windows\system32\SubDir\system.exe
        
        "C:\Windows\system32\SubDir\system.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3496
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system.exe" /rl HIGHEST /f
        15⤵
        Creates scheduled task(s)
        
        PID:2548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SFGjQs2YcxDO.bat" "
        15⤵
        
        PID:932
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3700
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        Runs ping.exe
        
        PID:3664
        
        C:\Windows\system32\SubDir\system.exe
        
        "C:\Windows\system32\SubDir\system.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4324
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system.exe" /rl HIGHEST /f
        17⤵
        Creates scheduled task(s)
        
        PID:5052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\niWMHKjbG4BN.bat" "
        17⤵
        
        PID:1428
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:3652
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        Runs ping.exe
        
        PID:4452
        
        C:\Windows\system32\SubDir\system.exe
        
        "C:\Windows\system32\SubDir\system.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3972
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system.exe" /rl HIGHEST /f
        19⤵
        Creates scheduled task(s)
        
        PID:4416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WGVV92Y9P7yD.bat" "
        19⤵
        
        PID:3488
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:4456
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        Runs ping.exe
        
        PID:1184
        
        C:\Windows\system32\SubDir\system.exe
        
        "C:\Windows\system32\SubDir\system.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4504
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system.exe" /rl HIGHEST /f
        21⤵
        Creates scheduled task(s)
        
        PID:4676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kSUvomx8ZojI.bat" "
        21⤵
        
        PID:4820
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2260
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        Runs ping.exe
        
        PID:3508
        
        C:\Windows\system32\SubDir\system.exe
        
        "C:\Windows\system32\SubDir\system.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3228
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system.exe" /rl HIGHEST /f
        23⤵
        Creates scheduled task(s)
        
        PID:3128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OUgoHMebmeZS.bat" "
        23⤵
        
        PID:2084
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:5048
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        Runs ping.exe
        
        PID:3200
        
        C:\Windows\system32\SubDir\system.exe
        
        "C:\Windows\system32\SubDir\system.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system.exe" /rl HIGHEST /f
        25⤵
        Creates scheduled task(s)
        
        PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

system.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\system.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

3n2vFDfx9osF.bat

Path C:\Users\Admin\AppData\Local\Temp\3n2vFDfx9osF.bat
Size 196B
SHA256 d2aaa27fa9b424fc0160a0cfd3a38fe24de2681dfb2943e403f5c55cf1507155
MD5 2a02b2598e2923f232b9ee0c5a7a5864
SHA1 b5eda7b63b7f8145e1ad8823b489536c4a001aa5
SHA512 ddbb4d425044df16028da2b68e2276e003313c1b907512765d6a5753163795412fa784b16d5ea09b1241451b68916a9b226377e280ce3a20b836e11c9522d06c
MD5 SHA1 SHA512

Submit Download

HIs1HyUHLspi.bat

Path C:\Users\Admin\AppData\Local\Temp\HIs1HyUHLspi.bat
Size 196B
SHA256 f36779ad4e04070ff52ea592d90cdb00abcc89010f2819e6a87159210b6d60e2
MD5 116ea5af6354fe6c67f6b622a3a6108f
SHA1 134abf9c6819d9118ace730df42cefdaa9cf7e95
SHA512 e6aebc4c3f6d7d2a24b6cbd20f7bbbfcc0198597c00de188a0c2307167a91adef535f47f22d31c19b436fd5b4d45826c89e0f99ae92a7d33ef9bae57e331010e
MD5 SHA1 SHA512

Submit Download

OUgoHMebmeZS.bat

Path C:\Users\Admin\AppData\Local\Temp\OUgoHMebmeZS.bat
Size 196B
SHA256 8ecc21728981d10e536352890f4fd16c8399174beb02a7f4d489f6be16e4a97c
MD5 12a57857cee41d9728f4dd8d88cfe255
SHA1 c2f459a28aa5d036733a1f3e90d4b513122ab1ca
SHA512 4e036ca2a84b0e1603d103996af00a4d6a8f1803cc497079d61fa76234ec1232405b9ae471c6f48dd484e29cf98a80411d068f05992a315c81d5adb4ce99047f
MD5 SHA1 SHA512

Submit Download

SFGjQs2YcxDO.bat

Path C:\Users\Admin\AppData\Local\Temp\SFGjQs2YcxDO.bat
Size 196B
SHA256 2ec5ae5741b8dc966421e962fa3e8cc0cfe9404064c86373c4715dec083f76fe
MD5 17659153f0fbfaf22551b555b04c6655
SHA1 930044eefd9c4c5377bd74aa792dddf457e791be
SHA512 5a748e174684585256086a4611c48af2132b1d08b167d1ee5cf03af9ae67829249cfc988a66114fadedb6387119f7c14ec2a58ce5b15926f15d8bfa5b9d29d91
MD5 SHA1 SHA512

Submit Download

WGVV92Y9P7yD.bat

Path C:\Users\Admin\AppData\Local\Temp\WGVV92Y9P7yD.bat
Size 196B
SHA256 5f86be4e9318d7db3689252e78f62c56294cc088d08ba11703ca4679f65ce400
MD5 acaba7692a0b21481e8ce0c2dc298845
SHA1 7f7baf7168f67ba318cc9e1cfcd819d239335dff
SHA512 1a4d2ddc3ee2b5bb720a4efcf64dae8bb575ca2dea79964186d18202c1b8cef4b2de68cad7429a158f5177b203fe2ccf0ed4ad7afa4b45bb2ad79eab7d792057
MD5 SHA1 SHA512

Submit Download

kSUvomx8ZojI.bat

Path C:\Users\Admin\AppData\Local\Temp\kSUvomx8ZojI.bat
Size 196B
SHA256 936586da3b23b68344da6263f2cec93535cee1ba763fb23813caebef77e45d47
MD5 f8ecab280adeaa2546ab416f98f8e198
SHA1 e51ebcc55cb41c7a4c94a7689f4524518f7484c4
SHA512 ed0a9ea74cfba3579d899e6094ef997500b4dd1239c2ce493d9cf7f7f8c9d0b72a15fbd8dca0c28553467bf447c4220c7fc983f87d4593f5b68e2017f7ec2a6f
MD5 SHA1 SHA512

Submit Download

nLUje652Uumm.bat

Path C:\Users\Admin\AppData\Local\Temp\nLUje652Uumm.bat
Size 196B
SHA256 9a0766f321907af70e9ce61928cfc6db68451986b12b63c670e8b49eb6b38248
MD5 326b091fc8d141317cb1f473d22c8829
SHA1 f6c05001511e1730b47e7df29e259e5439898ebf
SHA512 e51944fce3be2cd5159b0db199339e1572baa85da4d6db1b14ef568e814885e7602875000249d561598f246984b4fbac6098e150a185c0000bd37108597c9e41
MD5 SHA1 SHA512

Submit Download

niWMHKjbG4BN.bat

Path C:\Users\Admin\AppData\Local\Temp\niWMHKjbG4BN.bat
Size 196B
SHA256 d1ae49624dd624de394a40a9ea27bbc3ba4d94e79a4c728d177cf74080cad5f7
MD5 ff913ec25056459a75815f97f5742204
SHA1 40eb3183784af53e5fe4f3b0dd3958f3e35cc917
SHA512 fa7268587ab30968c52ea048cf165f23609f7482b4af04f4b5ab6f7f5ecfd81649a010daec521bd06d8379b275d02e970d40ddc2d40327dba4a226517da56f61
MD5 SHA1 SHA512

Submit Download

weHQoO0WzJc7.bat

Path C:\Users\Admin\AppData\Local\Temp\weHQoO0WzJc7.bat
Size 196B
SHA256 5ff63509970c057cce8e07ee27fd926ac941345cf84d2bd6d949448dd8f9d7d0
MD5 7cb1bdeb232bfe27f6dfb547145a439a
SHA1 de46b0b34415e3279f8c89846f5a78c692948685
SHA512 b6a6e31164a6b54d1b3614b7aea52f896156f39ee79626936701706a04e7e26913d24687509a94860094d37b0485daccff5ef193de1effab59b0bd7631c7eb60
MD5 SHA1 SHA512

Submit Download

yia4QScoz2DF.bat

Path C:\Users\Admin\AppData\Local\Temp\yia4QScoz2DF.bat
Size 196B
SHA256 259ef287e8c908b87327676abf6a26417b5240707693c05ba2734027c6e0c0d4
MD5 9e3741865e35ac9df6a5fb6f2bf4d0aa
SHA1 5d5c3f2c67249f237e09bd8272ca9d21012dcd03
SHA512 6e3c7137f7244fa3726259ec8eb957399f46cf9cca887a53d06a648a32d38ba09b0c930b8f2bf7c31229f3e300ae433d18ba5a3443808115cc76d08b8aa0d384
MD5 SHA1 SHA512

Submit Download

yrmAY6BOPHgZ.bat

Path C:\Users\Admin\AppData\Local\Temp\yrmAY6BOPHgZ.bat
Size 196B
SHA256 974a96bf276f2795e6112a9cafbb63e242eca2c1aa695921da7d5ef65208915d
MD5 00eb458395cbad66ec4381b71aff7dde
SHA1 8ab33d32c9fcc2a9da9d7702ad87a959f78cae1b
SHA512 dcacf4d8b360cc0a9bd9d3f910503a58e51521d601bf38d50448bd09b51a95439a2002d4e608f044e6eb6c57f49aef8c7f2ea6d79cacbb3d5fa30d264c73888d
MD5 SHA1 SHA512

Submit Download

system.exe

Path C:\Windows\System32\SubDir\system.exe
Size 2.9MB
SHA256 77bbb7a01e5b5370d58ea160879f5b6097e306ceb753040629c7315f402a6b3d
MD5 7f37438268900571b343db25edc1aed0
SHA1 b374cc0d7dcf4fd2d8b054562198710d5327f2bf
SHA512 8f995fd5636dd8e64ec5c3a3a13ce23e63cfd94fd1460d39ff1c1ad4dba67e5e25e797dcdc368ad0ea7b109be574ac5adffb948fb45d7f52bbe41e3e63b5f81e
SSDEEP 49152:CvDI22SsaNYfdPBldt698dBcjHUkRJ6ebR3LoGdX4f:Cv822SsaNYfdPBldt6+dBcjHUkRJ6YHW
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\Windows\System32\SubDir\system.exe
Size 3.1MB
SHA256 f9cd91aa04919e9fe878fad738f5c8631f229da474552a245b29f0649fad96c2
MD5 130640fbdce6bb6006df6e0d007d4feb
SHA1 876ec1f095e2dbe0847f12ca30179abc1b4becf1
SHA512 ae36223501b934038c4455d2a978dd545fc5e1ffde9aebea24a9962770e542a743d274a62946641763df8e5e29eecaf59c42f6a8d264d01c197808d7e00a8788
SSDEEP 49152:CvDI22SsaNYfdPBldt698dBcjHUkRJ6ebR3LoGdX4THHB72eh2NT:Cv822SsaNYfdPBldt6+dBcjHUkRJ6YH
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\Windows\System32\SubDir\system.exe
Size 1.4MB
SHA256 ef90d9217297f3a4990497c567f12883f688f1508052f056a6060660baa7af1d
MD5 ddc0a4c75b74f1fff27fb6f9cd9bb852
SHA1 1c67c0e75bb2d4d55b4285408b60a1d2e32f1f9f
SHA512 b2f44e64c9a704fffca11bfdf2745dde4df90097dccda2916d5a2a6e843b8d9a0d6912c1b4b2dba0fa4e36e9934bed7107e6c64eaab89f137fbb67d39dd80d92
SSDEEP 24576:CvNpIA4Wnh2ShqaNYjjjhPBl/lt6/l8ImBcIz3491NR:CvDI22SsaNYfdPBldt698dBcjHz
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\Windows\System32\SubDir\system.exe
Size 1.3MB
SHA256 e28457b02a933fd683631ba9bea9cd884dd59bd55fa4ffe38f8d237ab7cc372f
MD5 a1f3c5c35447963d1e31c7d35c0a0a1d
SHA1 3d342de94c13be1874815332388f80465b7cce9c
SHA512 54a6e14902dc16f85363b68dea094cfb839c80ec67de4a25d9cffedc27e0829d7c7b6dfc3af25cc78fbcd248625c7fb4665da0977ca664d566a458405a92bf0b
SSDEEP 24576:CvNpIA4Wnh2ShqaNYjjjhPBl/lt6/l8ImBcIz34Y:CvDI22SsaNYfdPBldt698dBcjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\Windows\System32\SubDir\system.exe
Size 826KB
SHA256 1ea1c27117d8ad843784e433f58d660234262dbae05ca288780f0ae6b0cf2aeb
MD5 22d9bc7fe1b9d265d54e56de6afe66e0
SHA1 7b0e41fca61227675466a2560c00ad35f1fa7049
SHA512 b49d1fd90ca96aee751e767b8e346f83332596f7e246b79921c5ec485b78a0d7b01084799ea666e932ba80fcff6b7f7a134b57829130d9bac9cc32fca8ec3728
SSDEEP 12288:EvgMzKMZLg5y3Dx59tOGPxf5C5i4Wd95D2InhsygA4c4JS3o:CvNpIA4Wnh2Sho
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\Windows\System32\SubDir\system.exe
Size 1.8MB
SHA256 a717ed8143a780f40fad4410a5bd10e7023a19d958394bdc9696a593b757fef8
MD5 d7b53d19af4ded6d07b4c3cd6b2b7276
SHA1 9055724f92490cb74a871588bfa00f53382ae0cf
SHA512 01e2bd82eb701df55b6e88d9a49d2dd8248e1ee46faefb3ea6d02d4bee67bd362c3648e9195e01c29f2d6f186e3cc339c4202f9c4bd2ef4e367cef3945bf57b7
SSDEEP 24576:CvNpIA4Wnh2ShqaNYjjjhPBl/lt6/l8ImBcIz3491N3qjlv0j0ap:CvDI22SsaNYfdPBldt698dBcjHUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\Windows\system32\SubDir\system.exe
Size 967KB
SHA256 1941cfa20fc140a2a0758d1ce56f0e7d53c9748507856dd8ba4b66ae65f6e733
MD5 fea665f74b227c67394a39ce5703c278
SHA1 b5c7838ceb91e21062f8c61eb3c706c97aa10484
SHA512 9f4aa23ecb150835ca46f1c2a25b37c5fc688594e41908d312380f5a668a42edcd9f89c619f4d44de93ce30b322cd92a2807865802181eb6faea3a2786fdd5d7
SSDEEP 12288:EvgMzKMZLg5y3Dx59tOGPxf5C5i4Wd95D2InhsygA4c4JS3qaNYjjM0hPBl/lt65:CvNpIA4Wnh2ShqaNYjjjhPBl/lt65
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1068-36-0x00007FFAE2770000-0x00007FFAE3231000-memory.dmp

Download

memory/1068-30-0x00007FFAE2770000-0x00007FFAE3231000-memory.dmp

Download

memory/1068-31-0x000000001B0D0000-0x000000001B0E0000-memory.dmp

Download

memory/1588-0-0x0000000000060000-0x0000000000384000-memory.dmp

Download

memory/1588-10-0x00007FFAE2C90000-0x00007FFAE3751000-memory.dmp

Download

memory/1588-2-0x0000000002460000-0x0000000002470000-memory.dmp

Download

memory/1588-1-0x00007FFAE2C90000-0x00007FFAE3751000-memory.dmp

Download

memory/2128-54-0x00007FFAE2360000-0x00007FFAE2E21000-memory.dmp

Download

memory/2128-59-0x00007FFAE2360000-0x00007FFAE2E21000-memory.dmp

Download

memory/2128-55-0x000000001B080000-0x000000001B090000-memory.dmp

Download

memory/2324-102-0x00007FFAE2010000-0x00007FFAE2AD1000-memory.dmp

Download

memory/2324-103-0x00000000019D0000-0x00000000019E0000-memory.dmp

Download

memory/2616-22-0x00007FFAE2770000-0x00007FFAE3231000-memory.dmp

Download

memory/2616-27-0x00007FFAE2770000-0x00007FFAE3231000-memory.dmp

Download

memory/2616-23-0x000000001B3D0000-0x000000001B3E0000-memory.dmp

Download

memory/3228-94-0x00007FFAE2010000-0x00007FFAE2AD1000-memory.dmp

Download

memory/3228-95-0x0000000001950000-0x0000000001960000-memory.dmp

Download

memory/3228-100-0x00007FFAE2010000-0x00007FFAE2AD1000-memory.dmp

Download

memory/3392-12-0x000000001C760000-0x000000001C7B0000-memory.dmp

Download

memory/3392-13-0x000000001C870000-0x000000001C922000-memory.dmp

Download

memory/3392-11-0x000000001BB50000-0x000000001BB60000-memory.dmp

Download

memory/3392-19-0x00007FFAE2C90000-0x00007FFAE3751000-memory.dmp

Download

memory/3392-9-0x00007FFAE2C90000-0x00007FFAE3751000-memory.dmp

Download

memory/3496-67-0x00007FFAE21C0000-0x00007FFAE2C81000-memory.dmp

Download

memory/3496-63-0x0000000002DA0000-0x0000000002DB0000-memory.dmp

Download

memory/3496-62-0x00007FFAE21C0000-0x00007FFAE2C81000-memory.dmp

Download

memory/3972-83-0x00007FFAE21C0000-0x00007FFAE2C81000-memory.dmp

Download

memory/3972-79-0x000000001BE40000-0x000000001BE50000-memory.dmp

Download

memory/3972-78-0x00007FFAE21C0000-0x00007FFAE2C81000-memory.dmp

Download

memory/4028-47-0x000000001BAC0000-0x000000001BAD0000-memory.dmp

Download

memory/4028-51-0x00007FFAE2360000-0x00007FFAE2E21000-memory.dmp

Download

memory/4028-46-0x00007FFAE2360000-0x00007FFAE2E21000-memory.dmp

Download

memory/4324-71-0x0000000001470000-0x0000000001480000-memory.dmp

Download

memory/4324-70-0x00007FFAE21C0000-0x00007FFAE2C81000-memory.dmp

Download

memory/4324-75-0x00007FFAE21C0000-0x00007FFAE2C81000-memory.dmp

Download

memory/4504-87-0x000000001BC40000-0x000000001BC50000-memory.dmp

Download

memory/4504-91-0x00007FFAE1EC0000-0x00007FFAE2981000-memory.dmp

Download

memory/4504-86-0x00007FFAE1EC0000-0x00007FFAE2981000-memory.dmp

Download

memory/4804-38-0x00007FFAE2360000-0x00007FFAE2E21000-memory.dmp

Download

memory/4804-39-0x000000001C000000-0x000000001C010000-memory.dmp

Download

memory/4804-43-0x00007FFAE2360000-0x00007FFAE2E21000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads