quasar | 251378348a702c2e19c5d0757f921497cdfe69c1cc908e52a61e0d54c655a5be

Analysis

max time kernel
19s
max time network
20s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04-02-2025 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.2MB
MD5

76be66d7518dce8b34eb7d9b2fc39f49
SHA1

5e11492ccd1ff35570ca819a1a833b763f984f1b
SHA256

251378348a702c2e19c5d0757f921497cdfe69c1cc908e52a61e0d54c655a5be
SHA512

1a67d53663aca80b90cd19bb47559bd9bc1fd0d3fe6336006d1f3355982023467955894283ae72fe0566ee1f71fe61b3732c2897e41ed4cd64f3b23eedd388c4
SSDEEP

49152:QvRuf2NUaNmwzPWlvdaKM7ZxTwPuoLaoNdSTHHB72eh2NT:Qvsf2NUaNmwzPWlvdaB7ZxTw2o2

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

98.218.3.74:4800

2601:147:8500:53c0:959e:b4e0:7099:8e90:4800

Mutex

dd229ccb-39cd-4301-9413-ea14fa25ce22

Attributes

encryption_key
F023A1C93603AFE96871B3F0323AA7B852FA745F
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
discord
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/2916-1-0x0000000000700000-0x0000000000A34000-memory.dmp	family_quasar
behavioral1/files/0x001e00000002aa94-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2284	Client.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2384	schtasks.exe
688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1076	msedge.exe
1076	msedge.exe
4640	identity_helper.exe
4640	identity_helper.exe
2328	msedge.exe
2328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	Client-built.exe
Token: SeDebugPrivilege	2284	Client.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2284	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2384	2916	Client-built.exe	77
PID 2916 wrote to memory of 2384	2916	Client-built.exe	77
PID 2916 wrote to memory of 2284	2916	Client-built.exe	79
PID 2916 wrote to memory of 2284	2916	Client-built.exe	79
PID 2284 wrote to memory of 688	2284	Client.exe	80
PID 2284 wrote to memory of 688	2284	Client.exe	80
PID 1076 wrote to memory of 3352	1076	msedge.exe	85
PID 1076 wrote to memory of 3352	1076	msedge.exe	85
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 4532	1076	msedge.exe	86
PID 1076 wrote to memory of 1508	1076	msedge.exe	87
PID 1076 wrote to memory of 1508	1076	msedge.exe	87
PID 1076 wrote to memory of 4360	1076	msedge.exe	88
PID 1076 wrote to memory of 4360	1076	msedge.exe	88
PID 1076 wrote to memory of 4360	1076	msedge.exe	88
PID 1076 wrote to memory of 4360	1076	msedge.exe	88
PID 1076 wrote to memory of 4360	1076	msedge.exe	88
PID 1076 wrote to memory of 4360	1076	msedge.exe	88
PID 1076 wrote to memory of 4360	1076	msedge.exe	88
PID 1076 wrote to memory of 4360	1076	msedge.exe	88
PID 1076 wrote to memory of 4360	1076	msedge.exe	88
PID 1076 wrote to memory of 4360	1076	msedge.exe	88
PID 1076 wrote to memory of 4360	1076	msedge.exe	88
PID 1076 wrote to memory of 4360	1076	msedge.exe	88
PID 1076 wrote to memory of 4360	1076	msedge.exe	88
PID 1076 wrote to memory of 4360	1076	msedge.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2384
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff590b3cb8,0x7fff590b3cc8,0x7fff590b3cd8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,16187136709046951212,3687144693836546428,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,16187136709046951212,3687144693836546428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1844,16187136709046951212,3687144693836546428,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,16187136709046951212,3687144693836546428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,16187136709046951212,3687144693836546428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,16187136709046951212,3687144693836546428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,16187136709046951212,3687144693836546428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1844,16187136709046951212,3687144693836546428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1844,16187136709046951212,3687144693836546428,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1844,16187136709046951212,3687144693836546428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f162b3130bcd69a09cf13271b3c3ea07

SHA1
63327f056cfbdb76c1270aeadcf7bd8083bc744f

SHA256
5422e01a42c17c6dbad34ac0889d296ddb456818ef072452021fcab81f8f2a18

SHA512
aa8fb5058d9c4a45b1e5d73a26241f59576bf4e5767bb82e0a7ae25dfd7f2f570c6ca8d23ede13cdae7fd32e0e3c147ad8918fe7c7df949552d069911e7530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
23ba98bddf55ba5f149caa1e23379798

SHA1
4b0f65801e6163d2a99e1075562ee396fc554412

SHA256
0a37ab3bb6281f0168dad6762f88db40f0eb702abeb74b66917b433cfeb482e5

SHA512
2a0c80f8dcde8b469873d81031ca0fce81331be3260cf9c34653f2ddc1c89b184c7e5f78b95b38188e92d6c7118bce573e61ebe2c9cc837b1bf1c27ebeff4eee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
412b59ecdf127d3eb8e0dd8a87accdd9

SHA1
64a385985e0f18efcda90c2219347a4016f98475

SHA256
c73c30273fedbc5eed06ba8760a38d1449000e29bbdb371633ba743e67c9d3f7

SHA512
848b4cd3e0f3ea4198bc18ef513ef31ae114b2b83d809b549edc516af5fcce0bf11f796693e631af65707826e655c166145e3a897af509695d7e337290ea9b0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
11d55029f0f0045d03b9f348f3d8d0b0

SHA1
ca998bc38cede1769870ec2329d2ce1b4cbce7fa

SHA256
23fed481949474924d644168ef931c0dbbab14ea92c502c22c3ddc26aeabd0c0

SHA512
e50698a59a95852a47a194850be424e8fe8d2d47cde31c9cf55c915e508a66056222a13710060b825af62ffd5bce87e48a63bf1e2506716318e0bf3e6cfd59c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
143bddd416cf7b6c56ae0d68f7589e0b

SHA1
8e0482e8fe8c69adf0af012fc8061ca5da0e1d79

SHA256
91d1e4f3a37017db780052fd57e2f8fb041bd2e341cbbde4c36a124c74f8c1a4

SHA512
f531d60a7837db3f679b24c24da8b73a2de6f483245a2b7e0c7fc6db257c863ad9151da5a051c6eb898845653e5c67f1c739a696ce2a78f31c5fd2485cf12349

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.2MB

MD5
76be66d7518dce8b34eb7d9b2fc39f49

SHA1
5e11492ccd1ff35570ca819a1a833b763f984f1b

SHA256
251378348a702c2e19c5d0757f921497cdfe69c1cc908e52a61e0d54c655a5be

SHA512
1a67d53663aca80b90cd19bb47559bd9bc1fd0d3fe6336006d1f3355982023467955894283ae72fe0566ee1f71fe61b3732c2897e41ed4cd64f3b23eedd388c4

Download Submit
memory/2284-60-0x00007FFF4BCD0000-0x00007FFF4C792000-memory.dmp

Filesize
10.8MB

Download
memory/2284-13-0x000000001C9F0000-0x000000001CAA2000-memory.dmp

Filesize
712KB

Download
memory/2284-12-0x000000001C8E0000-0x000000001C930000-memory.dmp

Filesize
320KB

Download
memory/2284-11-0x00007FFF4BCD0000-0x00007FFF4C792000-memory.dmp

Filesize
10.8MB

Download
memory/2284-9-0x00007FFF4BCD0000-0x00007FFF4C792000-memory.dmp

Filesize
10.8MB

Download
memory/2916-0-0x00007FFF4BCD3000-0x00007FFF4BCD5000-memory.dmp

Filesize
8KB

Download
memory/2916-10-0x00007FFF4BCD0000-0x00007FFF4C792000-memory.dmp

Filesize
10.8MB

Download
memory/2916-2-0x00007FFF4BCD0000-0x00007FFF4C792000-memory.dmp

Filesize
10.8MB

Download
memory/2916-1-0x0000000000700000-0x0000000000A34000-memory.dmp

Filesize
3.2MB

Download