quasar | fcd5b843d50ec2f973aaa27e54b6bf045931cc3cb8d9bea4edaade352fe0f7d5

Analysis

max time kernel
237s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uni/Uni - Copy (14) - Copy.exe
Size

409KB
MD5

b70fdac25a99501e3cae11f1b775249e
SHA1

3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
SHA256

51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
SHA512

43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
SSDEEP

12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

Score

10^/10

quasar seroxen spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

panel-slave.gl.at.ply.gg:57059

panel-slave.gl.at.ply.gg:27892

Mutex

$Sxr-rpL8EItHN3pqIQQVy2

Attributes

encryption_key
Lme7VBS3l58VwLM69PNM
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SeroXen
subdirectory
SubDir

Signatures

Quasar RAT 3 IoCs
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Processes:

schtasks.exe

pid process

4072 schtasks.exe
13 ip-api.com
36 api.ipify.org

pid	process
4072	schtasks.exe
13	ip-api.com
36	api.ipify.org

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral10/memory/5064-1-0x0000000000C00000-0x0000000000C6C000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar

Executes dropped EXE 2 IoCs

Processes:

Client.exeXuhpOXGoWC4g.exe

pid process

4636 Client.exe
1896 XuhpOXGoWC4g.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 ip-api.com
36 api.ipify.org
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeSCHTASKS.exeschtasks.exeSCHTASKS.exe

pid process

4072 schtasks.exe
3572 SCHTASKS.exe
2976 schtasks.exe
5484 SCHTASKS.exe

pid	process
4636	Client.exe
1896	XuhpOXGoWC4g.exe

flow	ioc
13	ip-api.com
36	api.ipify.org

pid	process
4072	schtasks.exe
3572	SCHTASKS.exe
2976	schtasks.exe
5484	SCHTASKS.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 51 IoCs

Processes:

msedge.exemsedge.exeOpenWith.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

1736 vlc.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
3908	msedge.exe
3908	msedge.exe
1500	msedge.exe
1500	msedge.exe
5036	identity_helper.exe
5036	identity_helper.exe
3576	msedge.exe
3576	msedge.exe
6024	msedge.exe
6024	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

1736 vlc.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1500 msedge.exe
1500 msedge.exe
1500 msedge.exe
1500 msedge.exe
1500 msedge.exe
1500 msedge.exe

pid	process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Uni - Copy (14) - Copy.exeClient.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	5064	Uni - Copy (14) - Copy.exe
Token: SeDebugPrivilege	4636	Client.exe
Token: 33	3248	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3248	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

vlc.exemsedge.exe

pid	process
1736	vlc.exe
1736	vlc.exe
1736	vlc.exe
1736	vlc.exe
1736	vlc.exe
1736	vlc.exe
1736	vlc.exe
1736	vlc.exe
1736	vlc.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

vlc.exemsedge.exe

pid	process
1736	vlc.exe
1736	vlc.exe
1736	vlc.exe
1736	vlc.exe
1736	vlc.exe
1736	vlc.exe
1736	vlc.exe
1736	vlc.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

Client.exeXuhpOXGoWC4g.exeOpenWith.exeOpenWith.exevlc.exemsedge.exemsedge.exe

pid process

4636 Client.exe
1896 XuhpOXGoWC4g.exe
1068 OpenWith.exe
2120 OpenWith.exe
1736 vlc.exe
3576 msedge.exe
6024 msedge.exe

pid	process
4636	Client.exe
1896	XuhpOXGoWC4g.exe
1068	OpenWith.exe
2120	OpenWith.exe
1736	vlc.exe
3576	msedge.exe
6024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Uni - Copy (14) - Copy.exeClient.exemsedge.exe

description	pid	process	target process
PID 5064 wrote to memory of 4072	5064	Uni - Copy (14) - Copy.exe	schtasks.exe
PID 5064 wrote to memory of 4072	5064	Uni - Copy (14) - Copy.exe	schtasks.exe
PID 5064 wrote to memory of 4072	5064	Uni - Copy (14) - Copy.exe	schtasks.exe
PID 5064 wrote to memory of 4636	5064	Uni - Copy (14) - Copy.exe	Client.exe
PID 5064 wrote to memory of 4636	5064	Uni - Copy (14) - Copy.exe	Client.exe
PID 5064 wrote to memory of 4636	5064	Uni - Copy (14) - Copy.exe	Client.exe
PID 5064 wrote to memory of 3572	5064	Uni - Copy (14) - Copy.exe	SCHTASKS.exe
PID 5064 wrote to memory of 3572	5064	Uni - Copy (14) - Copy.exe	SCHTASKS.exe
PID 5064 wrote to memory of 3572	5064	Uni - Copy (14) - Copy.exe	SCHTASKS.exe
PID 4636 wrote to memory of 2976	4636	Client.exe	schtasks.exe
PID 4636 wrote to memory of 2976	4636	Client.exe	schtasks.exe
PID 4636 wrote to memory of 2976	4636	Client.exe	schtasks.exe
PID 4636 wrote to memory of 1896	4636	Client.exe	XuhpOXGoWC4g.exe
PID 4636 wrote to memory of 1896	4636	Client.exe	XuhpOXGoWC4g.exe
PID 4636 wrote to memory of 1896	4636	Client.exe	XuhpOXGoWC4g.exe
PID 1500 wrote to memory of 8	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 8	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1808	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3908	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3908	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3140	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3140	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3140	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3140	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3140	1500	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (14) - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (14) - Copy.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (14) - Copy.exe" /rl HIGHEST /f
2⤵
- Quasar RAT
- Creates scheduled task(s)
PID:4072

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2976

C:\Users\Admin\AppData\Local\Temp\XuhpOXGoWC4g.exe
"C:\Users\Admin\AppData\Local\Temp\XuhpOXGoWC4g.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1896

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Client.exe" /tr "'C:\Users\Admin\AppData\Roaming\SubDir\Client.exe'" /sc onlogon /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:5484

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Uni - Copy (14) - Copy.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (14) - Copy.exe'" /sc onlogon /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:3572

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c4 0x504
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1068

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2120

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ConvertStart.mpa"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff9f13c46f8,0x7ff9f13c4708,0x7ff9f13c4718
2⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
2⤵
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
2⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:2364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4704 /prefetch:8
2⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
2⤵
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
2⤵
PID:900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
2⤵
PID:4328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
2⤵
PID:4116

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3304 /prefetch:8
2⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3304 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4440 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4724 /prefetch:8
2⤵
PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2992 /prefetch:8
2⤵
PID:516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4728 /prefetch:2
2⤵
PID:5512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2240,4743016190200841606,16664862966938586991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
2⤵
PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2d79af72c6e9a10e93c9d4d2241d17d5

SHA1
686ae0baba9ff5eade3e98fa7d6a1a4d543347e1

SHA256
226cc9633d23b04a26f9a7089e8dadcc8a490751589b3b8b1fdfd704c145eb8e

SHA512
dd7aad7c81b1f2af0fa8ed88e04e34310e5bf91cf222e6e4b3985563634596cbcfcc608dee843f1895ae8229d3fe9fa56938b95716eb9c8f6f3e82ed66bee005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5444bdbf5d2ba68179dbf8e3e1dd1041

SHA1
f4d9686f90e0a330a72ee82ff1f882a0ee3ddf33

SHA256
8dbd5d0587d3c0cadf982ee24d61a2e50837f9f42300e978311dd4b64c073110

SHA512
7c975c23d9459f593bca6918082330046d9486a6f77f910c43a6a842013473065a519c79c9fc21ee4f85831c71ad5e6c7ecf4a59d377dc06fad0ae57bbabf8d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
f3f52d337b62adac1e3079a396c86a30

SHA1
bfc8be205de16eb7e37c4c7d701d6ebc46d1495a

SHA256
571907bf4d341bbeaac776cf7e9e167b8395aa2c61554fb1fe297eb5c325da75

SHA512
d1c65e8a1d064a78c126bf338e47b8a39b265a8aa6be9ad5465603962fc5c8d48d20c3d9055222d821d1c46c14118afae490cededdb29db0bb4fb854989be072

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
6fc3734350b78c5f5e3303deba553a08

SHA1
56e5a56b19b75854c1bc3b69f55a2eb0272ca549

SHA256
ebc89d8ce16936f83de489c62de085aac854009176eb1d9ac6ee7e961b4fd1a5

SHA512
4a9ca4cbdf66214e7ce2688e7c0128c79e8eabab2c6dc8c1e3d4d3128c12cd7be3cba534a996203f55ec4505949a2d7e50bb9d25d2131e60895daf34688a3cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
58f8ea79cc2751bfef99fbcb26e9b1de

SHA1
20c4111d1cb9f8aa8c937542e8328183aa16886b

SHA256
740fc940d5b64d78aa5c29697e62fd8b79ece8e4c38ed96e96d4499954a762b7

SHA512
c39cbe8efab354eb84061882c52a3614571363e6cc765f1e20fc7e10f6dbd9e8ea04aa27dc8c7530de821d618aa3c6c3f1ecbb77a326ef69ab40da8ad3c136ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
463850bc82f3180b4aadb1471f3770ec

SHA1
1cc1456b77edf3e0f4a5feec836531fc69daae4f

SHA256
00fa41e5a697abad500b62369c1f9a9412562b7205df33251ec6d6e8dc16c548

SHA512
ab296a1b89cbe2aaf6fe382687efbc1d0a152a09d0df8c13af29b2c7b350eb737581c6741d8607c672eee1b6e8a4ea5228952941db37ecc8c4008e5e9b54281c

Download Submit
C:\Users\Admin\AppData\Local\Temp\XuhpOXGoWC4g.exe
Filesize
277KB

MD5
dac0c5b2380cbdd93b46763427c9f8df

SHA1
038089e1a0ac8375be797fc3ce7ae719abc72834

SHA256
d02538788fb57f568ece292f5fc20e9775c86d504de67f57e22534f84adc73c6

SHA512
05cc1f6bf25a6545a06c735ae7a4a7fc25489bdb9fbc8d5797be623982662c4a93cba2d20bfe14313ef1548eaaa691e55fabdd8e3d3e45de9ab42dc62f9a7023

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
409KB

MD5
b70fdac25a99501e3cae11f1b775249e

SHA1
3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

SHA256
51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

SHA512
43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

Download Submit
\??\pipe\LOCAL\crashpad_1500_WRZAYZXWSFGOJLKA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1736-91-0x00007FFA058E0000-0x00007FFA05901000-memory.dmp

Filesize
132KB

Download
memory/1736-96-0x000001CFA1850000-0x000001CFA1867000-memory.dmp

Filesize
92KB

Download
memory/1736-165-0x00007FF9F39B0000-0x00007FF9F4A60000-memory.dmp

Filesize
16.7MB

Download
memory/1736-126-0x00007FF9F39B0000-0x00007FF9F4A60000-memory.dmp

Filesize
16.7MB

Download
memory/1736-78-0x00007FF621120000-0x00007FF621218000-memory.dmp

Filesize
992KB

Download
memory/1736-81-0x00007FFA05FA0000-0x00007FFA05FB8000-memory.dmp

Filesize
96KB

Download
memory/1736-82-0x00007FFA05C60000-0x00007FFA05C77000-memory.dmp

Filesize
92KB

Download
memory/1736-83-0x00007FFA05C40000-0x00007FFA05C51000-memory.dmp

Filesize
68KB

Download
memory/1736-84-0x00007FFA05AD0000-0x00007FFA05AE7000-memory.dmp

Filesize
92KB

Download
memory/1736-79-0x00007FFA05E50000-0x00007FFA05E84000-memory.dmp

Filesize
208KB

Download
memory/1736-89-0x00007FFA05910000-0x00007FFA05951000-memory.dmp

Filesize
260KB

Download
memory/1736-80-0x00007FF9F56F0000-0x00007FF9F59A6000-memory.dmp

Filesize
2.7MB

Download
memory/1736-88-0x00007FF9F4A60000-0x00007FF9F4C6B000-memory.dmp

Filesize
2.0MB

Download
memory/1736-87-0x00007FFA05960000-0x00007FFA05971000-memory.dmp

Filesize
68KB

Download
memory/1736-86-0x00007FFA05980000-0x00007FFA0599D000-memory.dmp

Filesize
116KB

Download
memory/1736-85-0x00007FFA05AB0000-0x00007FFA05AC1000-memory.dmp

Filesize
68KB

Download
memory/1736-98-0x000001CFA1C30000-0x000001CFA1C41000-memory.dmp

Filesize
68KB

Download
memory/1736-90-0x00007FF9F39B0000-0x00007FF9F4A60000-memory.dmp

Filesize
16.7MB

Download
memory/1736-97-0x000001CFA1C00000-0x000001CFA1C2F000-memory.dmp

Filesize
188KB

Download
memory/1736-92-0x00007FFA058C0000-0x00007FFA058D8000-memory.dmp

Filesize
96KB

Download
memory/1736-95-0x00007FFA05640000-0x00007FFA05651000-memory.dmp

Filesize
68KB

Download
memory/1736-94-0x00007FFA05660000-0x00007FFA05671000-memory.dmp

Filesize
68KB

Download
memory/1736-93-0x00007FFA058A0000-0x00007FFA058B1000-memory.dmp

Filesize
68KB

Download
memory/4636-17-0x0000000006BE0000-0x0000000006BEA000-memory.dmp

Filesize
40KB

Download
memory/4636-19-0x00000000747B0000-0x0000000074F60000-memory.dmp

Filesize
7.7MB

Download
memory/4636-269-0x00000000747B0000-0x0000000074F60000-memory.dmp

Filesize
7.7MB

Download
memory/4636-12-0x00000000747B0000-0x0000000074F60000-memory.dmp

Filesize
7.7MB

Download
memory/4636-13-0x00000000747B0000-0x0000000074F60000-memory.dmp

Filesize
7.7MB

Download
memory/4636-20-0x00000000747B0000-0x0000000074F60000-memory.dmp

Filesize
7.7MB

Download
memory/4636-18-0x00000000065B0000-0x00000000065EC000-memory.dmp

Filesize
240KB

Download
memory/5064-4-0x00000000747B0000-0x0000000074F60000-memory.dmp

Filesize
7.7MB

Download
memory/5064-5-0x0000000005760000-0x00000000057C6000-memory.dmp

Filesize
408KB

Download
memory/5064-0-0x00000000747BE000-0x00000000747BF000-memory.dmp

Filesize
4KB

Download
memory/5064-3-0x00000000056C0000-0x0000000005752000-memory.dmp

Filesize
584KB

Download
memory/5064-15-0x00000000747B0000-0x0000000074F60000-memory.dmp

Filesize
7.7MB

Download
memory/5064-6-0x0000000006360000-0x0000000006372000-memory.dmp

Filesize
72KB

Download
memory/5064-2-0x0000000005C70000-0x0000000006214000-memory.dmp

Filesize
5.6MB

Download
memory/5064-1-0x0000000000C00000-0x0000000000C6C000-memory.dmp

Filesize
432KB

Download