Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    29/07/2024, 17:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Client-built.exe
  • Size 3.1MB
  • Sample240729-vk3psstglc
  • SHA256 031b3b1935b0eac9273bafb8b20484be97a1c3f9ea1bb611315042b32168f104
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
quasaroffice04discoveryspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • Office04

C2

  • 192.168.1.70:4782

Mutex

  • 34828de8-c350-4dd4-85c9-16051c0443f7

Attributes
  • encryption_key

    2F1B645695C7578786A6BD1B6CD3966DFF24BC11

  • install_name

    sigmaexecutor.exe.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    WIndows Updater

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
  • Drops file in System32 directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 57 IoCs
    adwarespyware
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "WIndows Updater" /sc ONLOGON /tr "C:\Windows\system32\SubDir\sigmaexecutor.exe.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2528
    • C:\Windows\system32\SubDir\sigmaexecutor.exe.exe
      "C:\Windows\system32\SubDir\sigmaexecutor.exe.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Windows\system32\schtasks.exe
        "schtasks" /create /tn "WIndows Updater" /sc ONLOGON /tr "C:\Windows\system32\SubDir\sigmaexecutor.exe.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2740
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2888
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1004

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          070E0202839D9D67350CD2613E78E416
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
          • Size 1KB
          • SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
          • MD5 SHA1 SHA512
          Submit Download

          75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
          • Size 1KB
          • SHA256 847c9ea57c6cf51908bf2b6533cf4ad846ace628b5978f1476af4176d5e0eac7
          • MD5 SHA1 SHA512
          Submit Download

          8B2B9A00839EED1DFDCCC3BFC2F5DF12
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
          • Size 1KB
          • SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
          • MD5 SHA1 SHA512
          Submit Download

          B46811C17859FFB409CF0E904A4AA8F8
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
          • Size 436B
          • SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
          • MD5 SHA1 SHA512
          Submit Download

          C02877841121CC45139CB51404116B25_4C78E1C22ED5954FB6E24DF3FFE2E5A1
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_4C78E1C22ED5954FB6E24DF3FFE2E5A1
          • Size 471B
          • SHA256 4c98c2e1dded68b1c1bdb09a90d92d21126137c4ab257757ab9bcddde08eb894
          • MD5 SHA1 SHA512
          Submit Download

          070E0202839D9D67350CD2613E78E416
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
          • Size 230B
          • SHA256 ea6d0a7206bdccaf530d2d379bff5556466f31e11671d1a6f4516a38b5d680e1
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 9741c00adf73a7b890a7b2810324b0e639ed20c3aa98375ae9c9f822e2a1cf5a
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 dafad94474359b4519d9617745e678c0049da419e66ee5eb6dff94dd10a020a2
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 1169df7e4f8a29e9c7099b76b65061bb9b705005cdfe0e62b8abb7efc783ad34
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 35e37985f3e7abdebf82e3c51b7a0c7417e76f24ce276200c978179971de4912
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 9ca944e53f30d4c8e3270a9332725d22dd4d304c394dd45020285c9d0915f779
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 22cfd375ac3a5fdcb073f3249826f37d9a5722e7795dfeb59285749ec51100e7
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 93ec43c01a10f59f6002a926da32007722dd62c4ab92441e478a8a734fbf0429
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 c3b28816da83f48f039088901f5952f09ce148e47f9dad6c19a4f692348244be
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 899916231c17626694cd7a5a8b0bacb2c639c1c1fa818ad58e2b2b74d34492e7
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 e743b2b64534817ae7617dcf3b30c605bf1cda546b548e7dbbfda0c50ffb1745
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 84dddfb0cead4f62766911f6b4322277c38b63901b3fe3c0cdfe9549d0a29425
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 b6e2f7bcd991aff174f53469291dffd2c1e1fc89eca05cbf7f66e251240b3c84
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 9ac1665cec655f1513f7ccd0844ee3f4b59e1a820060c999e66e4b4b4104fb83
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 e0eb025271becb6348bca8bc185216c0682ab35d43b8692c87b3ee84b364d585
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 ea0df0bc8f6ad27f41a79b480189d2c110b3ea26f9eee450716aedad56f56d1b
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 50f692c26a7fed93b18f48d86768e50011eba71bdcce5375c4df48c4afdf3924
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 e4507c73a6f1dfd7df45b8b962976eee8c25b4d1e3059b27a40c76c0c5aba8b0
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 d30c315cc29a12967987451b5086102d23d2b4046b95a3208b6752248a36eec2
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 d3b1230af5be01067a4513ffb01d77a294423482b4369c3f6ffb99d314e716f1
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 3ae01c92df0eef57b5ae28b0fbab077e969948b64ed90e43e7dcd632ededaf90
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 869c22625eecb3962f7270a4dad0ec441857c33b9b7d3fe93ce964c80f79e9ff
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 ff124d107407f31185adfcd31786a93228d0f451b4acb0bc865bfe5f5869c1aa
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 0d4d089f2692b3d961256c545c78b4f50f371f250a651dc9bb5ab316785e0f82
          • MD5 SHA1 SHA512
          Submit Download

          imagestore.dat
          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\0qn8gcy\imagestore.dat
          • Size 861B
          • SHA256 dc33d75c35cebe1b1c9ec7127964c6c55896a6a6e2ce01e85fa967bc35550210
          • MD5 SHA1 SHA512
          Submit Download

          imagestore.dat
          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\0qn8gcy\imagestore.dat
          • Size 25KB
          • SHA256 5a0daeacfd02bff5136c1f83a42faeadb5f47154e785a029094d7cc5560d4624
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          652737c39794d5ec26842c01_ggsans-Bold[1].eot
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\652737c39794d5ec26842c01_ggsans-Bold[1].eot
          • Size 87KB
          • SHA256 31cadfd42361952f026e828914ba899027499315ed5f5f55c4e181f2c2a74c06
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          652737c3cf7d717a309b578e_ggsans-ExtraBoldItalic[1].eot
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\652737c3cf7d717a309b578e_ggsans-ExtraBoldItalic[1].eot
          • Size 87KB
          • SHA256 6a54ec862c3433ea85b46ae936a6ce5db560a4d31dcbc91e46cb97b1a267af10
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          jquery.min[1].js
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\jquery.min[1].js
          • Size 87KB
          • SHA256 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          localize[1].js
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\localize[1].js
          • Size 63KB
          • SHA256 493d82284b4ed1d8f8a5aa726238b3d7c41f8ca6cb3779c2026f4e99fc55e54a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          main[1].js
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\main[1].js
          • Size 7KB
          • SHA256 d0cd2a2cf093bf3c1fc63888f3d87c3716bd4edae0f9b42de715e2538550bd15
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pxiByp8kv8JHgFVrLDz8Z1xlEw[1].woff
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\pxiByp8kv8JHgFVrLDz8Z1xlEw[1].woff
          • Size 10KB
          • SHA256 bd83479124cc5bc403c9e0d320840a5ea0e896e899689e5d37510444f5c7b763
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pxiByp8kv8JHgFVrLFj_Z1xlEw[1].woff
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\pxiByp8kv8JHgFVrLFj_Z1xlEw[1].woff
          • Size 10KB
          • SHA256 4b3616da45a51f661b450d11aa965d662837706a564bd677cfcf7cb50970d017
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pxiByp8kv8JHgFVrLGT9Z1xlEw[1].woff
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\pxiByp8kv8JHgFVrLGT9Z1xlEw[1].woff
          • Size 10KB
          • SHA256 316565c31e07631fe1a6a3f605ea1f40d529f7471d8fde952f863287d74bb7f6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          652737c35928b933259f0f31_ggsans-Semibold[1].eot
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\652737c35928b933259f0f31_ggsans-Semibold[1].eot
          • Size 86KB
          • SHA256 01414d5bedc053c8f498200b37489814a592beee4f20008296ca9255aeeff76f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          652737c3950eb10349a53936_ggsans-Medium[1].eot
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\652737c3950eb10349a53936_ggsans-Medium[1].eot
          • Size 86KB
          • SHA256 945fa4ce1b283384373e3cb88e49c1efd41294aef0b6a397803694f5dbec95f8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          652737c3cf7d717a309b579e_ggsans-SemiboldItalic[1].eot
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\652737c3cf7d717a309b579e_ggsans-SemiboldItalic[1].eot
          • Size 87KB
          • SHA256 26f0e374ef618c5fe6f20890da96643594a148ab19e86b0f67e717b102c4ad59
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          65273da61428bfb1c9a2b291_abcgintonord-800-extrabold[1].ttf
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\65273da61428bfb1c9a2b291_abcgintonord-800-extrabold[1].ttf
          • Size 125KB
          • SHA256 7a2862b72c7fc2ec7e074c23103167103b9dd77568ee95e965275d019525457f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pxiEyp8kv8JHgFVrJJfedA[1].woff
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\pxiEyp8kv8JHgFVrJJfedA[1].woff
          • Size 10KB
          • SHA256 49f0742d602fcc0092b7dbcb7c710849988b0a7094df8979af9c5f151f301d6d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          652737c3494978451827c5bc_ggsans-NormalItalic[1].eot
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\652737c3494978451827c5bc_ggsans-NormalItalic[1].eot
          • Size 81KB
          • SHA256 78c9c4a462f65ab3588f3eb2d34c51a705dc13146588f75ffbc1b87bd80cd8ff
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          65273da6fd070a45d9154a27_abcgintonord-800-extrabolditalic[1].ttf
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\65273da6fd070a45d9154a27_abcgintonord-800-extrabolditalic[1].ttf
          • Size 132KB
          • SHA256 af69ea0af38bfe7522165e0eb282349c009a9f7c9b86ba8b06572e563f68acac
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          css[1].css
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\css[1].css
          • Size 1KB
          • SHA256 527c2f3d1e93e6fe7bbe039b509e7b42842a36b045cd698ffd2a0aced6d709ae
          • MD5 SHA1 SHA512
          Submit Download

          discord-2022.2552833e3[1].js
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\discord-2022.2552833e3[1].js
          • Size 3.9MB
          • SHA256 67cda4cfab2e1ba5ce36da49091e104e3babc188dd1bbcf34334f0606066648e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          head[2].js
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\head[2].js
          • Size 8KB
          • SHA256 d0f3d41c97ac317ef29e187d8281a4a577b505bc79ee83d11e807de89d5b29a7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          loader[1].js
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\loader[1].js
          • Size 1KB
          • SHA256 76e16897be6d91bd127b5c6a7e3c60482a5606860cb87e3aeb0b2589265e1752
          • MD5 SHA1 SHA512
          Submit Download

          otBannerSdk[1].js
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\otBannerSdk[1].js
          • Size 335KB
          • SHA256 0152531ece5b19aa743208c31fd9f9284282bc97a2ec666de5cf770a9aeee0fa
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pxiByp8kv8JHgFVrLBT5Z1xlEw[1].woff
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\pxiByp8kv8JHgFVrLBT5Z1xlEw[1].woff
          • Size 9KB
          • SHA256 93cf4cf618de6250a3f50f7afb5ae798c14b1a4f794c6722d6b15bac0e45d81b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pxiByp8kv8JHgFVrLEj6Z1xlEw[1].woff
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\pxiByp8kv8JHgFVrLEj6Z1xlEw[1].woff
          • Size 10KB
          • SHA256 426316de2a499a38688cfcc92c143d25fa0c45c3afcf2074a84e3563dfa33c23
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          webfont[1].js
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\webfont[1].js
          • Size 12KB
          • SHA256 81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          62fddf0fde45a8baedcc7ee5_847541504914fd33810e70a0ea73177e%20(2)-1[1].png
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\62fddf0fde45a8baedcc7ee5_847541504914fd33810e70a0ea73177e%20(2)-1[1].png
          • Size 557B
          • SHA256 11848b5f1c8a7f294c6211c2f0d0dc83a8a28bfe1ef0829a8dacfdf475c5e5a2
          • MD5 SHA1 SHA512
          Submit Download

          652737c319ba7da75394c4b9_ggsans-BoldItalic[1].eot
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\652737c319ba7da75394c4b9_ggsans-BoldItalic[1].eot
          • Size 87KB
          • SHA256 09126fcd7dff721fdc23724e29931429e92befabc22c4f653847adda720f3ee3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          652737c32f7c60601a65e6cc_ggsans-MediumItalic[1].eot
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\652737c32f7c60601a65e6cc_ggsans-MediumItalic[1].eot
          • Size 87KB
          • SHA256 a62c6063b80ea078429e8b50caadf5d6589134214f01dc0a044101176ec70da4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          652737c35ca90c6ad859f588_ggsans-Normal[1].eot
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\652737c35ca90c6ad859f588_ggsans-Normal[1].eot
          • Size 85KB
          • SHA256 cc6d1cccf1a33ed30da53fd506efee6c8ca77551af30079920e7df67165b9c10
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bodyEnd[1].js
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\bodyEnd[1].js
          • Size 11KB
          • SHA256 f6c3092d9f27fdeb33f97bd2a1570fa41605f7ad30238eeeee9245f2517c2ada
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          discord-2022.1e799650c.min[1].css
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\discord-2022.1e799650c.min[1].css
          • Size 1.2MB
          • SHA256 6f2f8cd39926bcb0127e238d8749fb9a1c3ce43d63c6313d7d4f5762be548a4c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          e3t4euO8T-267oIAQAu6jDQyK3nVivU[1].woff
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\e3t4euO8T-267oIAQAu6jDQyK3nVivU[1].woff
          • Size 14KB
          • SHA256 3ce6b2a136c6dd26d48d0f43c14efa7b15105262d8a7d9c1bcc670087432056e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          favicon[1].ico
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\favicon[1].ico
          • Size 23KB
          • SHA256 128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          jquery-3.5.1.min.dc5e7f18c8[1].js
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\jquery-3.5.1.min.dc5e7f18c8[1].js
          • Size 87KB
          • SHA256 f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          otSDKStub[1].js
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\otSDKStub[1].js
          • Size 20KB
          • SHA256 03aa6fcac2902227e1b66a01b87824692f708bbf9bfe441784f8ed22d677f6de
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pxiByp8kv8JHgFVrLCz7Z1xlEw[1].woff
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\pxiByp8kv8JHgFVrLCz7Z1xlEw[1].woff
          • Size 10KB
          • SHA256 da36c91659b4490934d163c4013483e688996ee3cf8249499f945911df94c730
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pxiByp8kv8JHgFVrLDD4Z1xlEw[1].woff
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\pxiByp8kv8JHgFVrLDD4Z1xlEw[1].woff
          • Size 10KB
          • SHA256 5de30000c31ba3d99514ae0c30874ac0698b611fe296019f80875fb91b9d55fe
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          qsml[1].xml
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\qsml[1].xml
          • Size 548B
          • SHA256 10e7e48ac58b2ebffb142464d1ede329b033faf4428cbc039e040936e0dcf260
          • MD5 SHA1 SHA512
          Submit Download

          qsml[2].xml
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\qsml[2].xml
          • Size 549B
          • SHA256 34b83cd84f195ea15d9586c2c28ebdba2e0e33e52ea8fcf11943ab58d0d9ea7a
          • MD5 SHA1 SHA512
          Submit Download

          qsml[3].xml
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\qsml[3].xml
          • Size 550B
          • SHA256 b04bfe73fb71e053b5fdfb69876086aa7bf2c25fca5be2c79c3f8e9b4f94fb2e
          • MD5 SHA1 SHA512
          Submit Download

          CabEE57.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\CabEE57.tmp
          • Size 70KB
          • SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          TarEE79.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\TarEE79.tmp
          • Size 181KB
          • SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sigmaexecutor.exe.exe
          • Path C:\Windows\System32\SubDir\sigmaexecutor.exe.exe
          • Size 3.1MB
          • SHA256 031b3b1935b0eac9273bafb8b20484be97a1c3f9ea1bb611315042b32168f104
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/2184-1-0x00000000008A0000-0x0000000000BC4000-memory.dmp
          Download

          memory/2184-0-0x000007FEF5163000-0x000007FEF5164000-memory.dmp
          Download

          memory/2184-8-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp
          Download

          memory/2184-2-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp
          Download

          memory/3068-9-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp
          Download

          memory/3068-12-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp
          Download

          memory/3068-11-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp
          Download

          memory/3068-10-0x0000000000EA0000-0x00000000011C4000-memory.dmp
          Download

          memory/3068-87-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp
          Download