quasar | 33aa4a0eab47abb20a58663a71e9de847c1c667ef56ed6596d732b67d4249332

Analysis

max time kernel
59s
max time network
62s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260715-c8jbyscz8w
SHA256 33aa4a0eab47abb20a58663a71e9de847c1c667ef56ed6596d732b67d4249332
MD5 51903303cd7043d4e8315b5ed6a5779e
SHA1 2bf7508123f3a8146efc97ad73dc1bcc7138225a
SHA512 2966c11a709e71cdefc0408f49af6f3c8dc7b83fb92b0002e6187f8e53b0f94d186ff1fe9d51ed84b6c1226c0b344f82a7538805b5e9a7882a3c66f0a91aa87f
SSDEEP 49152:EyhJJHPNCC7J98vBgJh99oG4znXkIxUuxGHTHHB72eh2NT:EyhrHPh7J98vGJh99tqx
TLSH
T1FCE56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

xoilacxyw.io
malware.xoilacxyw.io

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/3916-1-0x0000000000370000-0x000000000069C000-memory.dmp	family_quasar

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3916	messenger_update.exe

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gg0iyAstvSYM.bat" "
  2⤵
  PID:5320
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    PID:2384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dDFXpgw3hrD2.bat" "
      4⤵
      PID:5620
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        
        PID:1344
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\x1t1Wqt47A8p.bat" "
        6⤵
        
        PID:5224
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        
        PID:3336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2PGwKFKNErx2.bat" "
        8⤵
        
        PID:240
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        
        PID:4808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\L6Ma1xnFJwuy.bat" "
        10⤵
        
        PID:6052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        
        PID:1056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YVoUQkUyFd83.bat" "
        12⤵
        
        PID:1976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        
        PID:4324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3smkUcaoLfrA.bat" "
        14⤵
        
        PID:4656
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        
        PID:2528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b87JenDsdx9a.bat" "
        16⤵
        
        PID:3364
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        
        PID:3828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fy7VNZ4raAoO.bat" "
        18⤵
        
        PID:1184
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        
        PID:4480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPxooqCkSfpG.bat" "
        20⤵
        
        PID:1684
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        
        PID:5008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VONeM3VCTEIe.bat" "
        22⤵
        
        PID:2356
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        
        PID:1584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6jdykWRZRkTH.bat" "
        24⤵
        
        PID:2732
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        
        PID:5088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QIqpJyXYGP3O.bat" "
        26⤵
        
        PID:1552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        
        PID:4680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vKYSUht1HWsb.bat" "
        28⤵
        
        PID:5332
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        
        PID:5440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\n4kOtAQ3eZ7t.bat" "
        30⤵
        
        PID:1572
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        
        PID:5636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

2PGwKFKNErx2.bat

Path C:\Users\Admin\AppData\Local\Temp\2PGwKFKNErx2.bat
Size 185B
SHA256 4777f801bdc9c1d28e12bf22db9761699b67eae9ae9f16519f35ee434f975d8d
MD5 154ccfaf225bafb412bded4458514afc
SHA1 b2d0fc09f5ae5a929d1c3f7ae5229de7b450032e
SHA512 64b894b27b960c1646f786c8cb9ddcdc874e93f897d5b82c704b7c0758b38ab1fd4a932d5e78796e273a9716b3a54a97f0089e73478a2037b2c6c926ff952a21
TLSH
T19FC0120155958A5E56045C0A59E9B68CF09508A929497FA04601CC6C23E7C98B5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

3smkUcaoLfrA.bat

Path C:\Users\Admin\AppData\Local\Temp\3smkUcaoLfrA.bat
Size 185B
SHA256 bd0a2c056c07c1fcb2a2adfb83a408d9e4ea4b26b8945b9c90f586905120bfdb
MD5 c031d2e6be6c36a1b0e27384dcd0515d
SHA1 1e86971d01e3e8792f330aac803ba82b78715640
SHA512 19489ebf143a1d0ea964e6c35051d1f291e6251c2c88c907f836880515d678a9a57708b5b1993ba291cf267752a44ece44b34c7ce248d47eb0a0183031977d41
TLSH
T117C0120142928A6E55445C1A19A9A68CF1D5089D2A497FA04501885D17D3CA9B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

6jdykWRZRkTH.bat

Path C:\Users\Admin\AppData\Local\Temp\6jdykWRZRkTH.bat
Size 185B
SHA256 efd63dcea12de74b546252eb881ddeb0a93b913c49a8894749daafab709fbb5b
MD5 0d67274e7c3ca9239acc5ef4dcb8b4c2
SHA1 35dcd8f8454ea59e554d3f914a3d8def16002bcb
SHA512 afb91445b92ca8de2407a3bb2dcb70131c0a36ffa74df9211e859bdfa130d2a6a06525d0164d61edb00239fee95c882db3da8e1fb94b862973d72222da906a65
TLSH
T14DC0120151958A5E46045C0A19A976CCF0D608A929497FA54A11885C63D2C6CB5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

L6Ma1xnFJwuy.bat

Path C:\Users\Admin\AppData\Local\Temp\L6Ma1xnFJwuy.bat
Size 185B
SHA256 35250bc0eba05c8f3193708ebe3e8aff01caba92fe7ff13e69f630e3c37b916b
MD5 629de2e53e743c1dc680328ce030ba8f
SHA1 a998854736b4c86e9e1d9cdbeb229fab9cabda84
SHA512 4b43dff90d6bb89dc2a4a28a103fa7be06c41f421ef3162b984a85b686590bd2ec7c9040c981049178022ead2e0cae686379948eb2a7a8eebf03b31f8edaee97
TLSH
T198C0220041828A1F05202C0A18A97A8CF095089D2948BFA00A00C84C13C3C58B4CB382
MD5 SHA1 SHA512 TLSH

Submit Download

QIqpJyXYGP3O.bat

Path C:\Users\Admin\AppData\Local\Temp\QIqpJyXYGP3O.bat
Size 185B
SHA256 fb648b9b6df840b4cb3149365412362d4ca7e492f0db5e4e0732aa826927e230
MD5 6825b5063a57751b357bdd1c261ef3c8
SHA1 d3b4192564aca23c67668f158f3141dafad95bbf
SHA512 dde4013158cfe94e65492e0458d9ef49780c61427681b72340a39c11ef42c02b67b80983296abce1701a8112e558bf92b240a6352dfd7bef91cc19146e266815
TLSH
T194C0120141818A5E4A145C0A5DAA66CDF0DA099929497FA18501889E13D2C98B9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

VONeM3VCTEIe.bat

Path C:\Users\Admin\AppData\Local\Temp\VONeM3VCTEIe.bat
Size 185B
SHA256 4763675f03b4c00495bf4d93af96e265d383d06d4513bde43ef0fd45caa1d6af
MD5 9e5f4dd3504a21b619a4f01ca55b477f
SHA1 97d41fbabe55d238a3e19672b67ebde6a2520e0d
SHA512 620211109f5bfd93d42936fbe2e71a7e14881a41977070d16e29a4cce81bc351274df66c3b13dc69f4a907a28a6f555012fc4d7ba40412e4c3d6a517529dbb2b
TLSH
T1FDC012019692CA5E45045C0B1DA9A78CF19509D96A49BFA04611CC5C27E3C58B9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

YVoUQkUyFd83.bat

Path C:\Users\Admin\AppData\Local\Temp\YVoUQkUyFd83.bat
Size 185B
SHA256 aea66af6721e1befac48d4e70c3ee8261337b36d8254e4a72da4b065674e9015
MD5 6596cfcb54a1d5b195481687af45c520
SHA1 ef30df3c3232935f9cbc6990365b70627756ee40
SHA512 08411db805c24afc99c5e8092276833a985f168d75f87fa065b348d25cc8b97fd328f1d0c4e73f4140470a60f3cdae0f35448c2f1575082343ba4583aef75797
TLSH
T1E0C012014281CA5E45045C1A19AA668CF1E508A96A8DBFA049118C9C23D2C98B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

b87JenDsdx9a.bat

Path C:\Users\Admin\AppData\Local\Temp\b87JenDsdx9a.bat
Size 185B
SHA256 e69233a0be216c58c0e8135c042888d5fe60a19243d248361313a308934dced7
MD5 98fbc411c9a6df3c708d33b7eb969b2b
SHA1 2ffac42e4ee09dd54ecc7248dc70c109eb817919
SHA512 c8c8394549eeef6ff3074b59a2c3d29934f7a8289446e95bd7e4118fa615c29ed966fc921dce6d05fc4f556ac503b6d397751d3236720766470f1e7789e98a43
TLSH
T1FFC0120185928A5E56045C0A19A9768DF0A9089969497FA08541885C63D2C59B5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

dDFXpgw3hrD2.bat

Path C:\Users\Admin\AppData\Local\Temp\dDFXpgw3hrD2.bat
Size 185B
SHA256 56d980d22b15b425a889e5155fa9e9cb214802479b4f2b59ef88925bb41e482b
MD5 b193446301fd399a3c8bc3f4146cbc87
SHA1 1188c440308bb9fb5964dbd3ff766437216d01b9
SHA512 4a27d011b969936ff0aff78069f4f25d8502c3ae4eaa63533368a3d6d0046f7efec75972246cdf549224fd211ed5bf315d440e516e82f769a62ee4ef0637fe1d
TLSH
T12DC0120141968A5E59045C0A19B9A6CCF096099929497FE04601C89C13D3C9CB5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

fy7VNZ4raAoO.bat

Path C:\Users\Admin\AppData\Local\Temp\fy7VNZ4raAoO.bat
Size 185B
SHA256 2d0f09a25ddfdbbf0b247d02ee238b98ffb2d0e3265f59c175bcf5baa1b71ef0
MD5 7f1678ebe8f2eb98391ebb7bbe25a12f
SHA1 58c0fada5dfe823f185ebb52c7f7fbf7a9990f51
SHA512 8eee57d586a10b14fa27b3f916ee5e61bb9218a32478b480f1c9e991d4f2ea9a83eeacd9104cc93c8604495934cfbc62ec79c29fbf032d4c574c946a03ffd471
TLSH
T150C0120141818A5E49545C1A59AAA6CCF0D909996D497FE146418C5C13D3C5CB5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

gPxooqCkSfpG.bat

Path C:\Users\Admin\AppData\Local\Temp\gPxooqCkSfpG.bat
Size 185B
SHA256 176fa3e28a54ccdc7049ff1ece3ea0c248ff3f9868d6a6a235a3e832e64e7ad7
MD5 21d7afda46593d578398966ce0256a6e
SHA1 b452285a2b3a3422e6d40bdd302c84e04d31fff4
SHA512 80eaee903f9d37df21db3209a7a631b10503c3ad89833094ceb44413df7b59012caed2b82c717c1848fd783db868d7f6a4cf3507e0a75eb28e3370bd5082c519
TLSH
T176C012019181CA5E49145C4A19A9768CF09508992A497FA049118C5C23E3C5CB9CB783
MD5 SHA1 SHA512 TLSH

Submit Download

gg0iyAstvSYM.bat

Path C:\Users\Admin\AppData\Local\Temp\gg0iyAstvSYM.bat
Size 185B
SHA256 34f849c69fe3905be2a4cbe8410b52635d8fa72ff80e52dcdf5b920d26187b26
MD5 cdb1656f6839de456e781d0b72c77c46
SHA1 0740f436ecffb35586e6c157aa76e5bb0e06cce0
SHA512 ec12877732fba81fda13587eb38de1b58608325c5ce940e082d33fc30eafd62c5826ae74dfbb6eaafcf31cbcf3d3d5c686fe1fef9ba3d9a6bfb1459c12ebc81b
TLSH
T12FC0120196828A6E49045C0B1DAAF68CF09509992D4ABFA04505C85C23D2D58B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

n4kOtAQ3eZ7t.bat

Path C:\Users\Admin\AppData\Local\Temp\n4kOtAQ3eZ7t.bat
Size 185B
SHA256 b31ce7ee8383b81d4e9bc5fbe0fbb4bcb7c29590500ad8962df4b9b6947eccdd
MD5 167ad17204d0a6a24d066aba84456818
SHA1 e599f985f91bdc10002674a7f76e0ae64ddc363d
SHA512 59790525296a0d03ddd91584420d50b7328e9478a3624b4111d20b67e0a9ee23b10b1c6a76d2d47bbfbc793d83be4979fe4fe1d7052a002a7aac45351537264e
TLSH
T15EC0120192868A5E45045C0A59AAB68CF09508992A497FA04511CC5D23D6C5CB5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

vKYSUht1HWsb.bat

Path C:\Users\Admin\AppData\Local\Temp\vKYSUht1HWsb.bat
Size 185B
SHA256 6b4edb930f17835308178252fdcbdc5994ff52d17424bcdc688abc336dc7accb
MD5 c956c8bd932d4d522e705ee13cfacf27
SHA1 e28d4bd2442369c261e5a61090e228b1c321373e
SHA512 5486365de6c0ab55c9df78f1210673d8d2b1e1fbe69234cd9900a66c2b98e6fae00f8ca13eb6225830d74d6103459232799abc84c6b666acc75e312c8116416d
TLSH
T140C012024182CA5E4A045C1A19A9A68CF0A5099D6E497FA04A01889C17D6C58B5CB783
MD5 SHA1 SHA512 TLSH

Submit Download

x1t1Wqt47A8p.bat

Path C:\Users\Admin\AppData\Local\Temp\x1t1Wqt47A8p.bat
Size 185B
SHA256 56c20bc020ccc6e493f7120f02dae5fc3f44e8989c53ee5da2d5640af1d0293f
MD5 9e453a36854d174ec1a91f271b7c72b0
SHA1 a8e62e5bb8ac6c551507613cdd859f8369dc5088
SHA512 a2eae902911bbe5297a19d3aae09c82d9e394712d9e96e530576ba4ebf230210ce944ddc3bae9ab8f5d524647e88b7669773f93acb0573663f5194ef3746f110
TLSH
T114C0220141828A5E05000C0A08E9628CF0E908A829087FA04600CC6C13D2C68B4CB382
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2384-29-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/2384-36-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/2384-23-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/2384-24-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/2384-25-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/2384-26-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/2384-27-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/2384-43-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/2384-28-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/2384-30-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/2384-31-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/2384-32-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/2384-33-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/2384-34-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/2384-35-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-8-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-7-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-0-0x00007FF8EA99F000-0x00007FF8EA9A0000-memory.dmp

Download

memory/3916-13-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-12-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-11-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-14-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-10-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-21-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-9-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-6-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-5-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-4-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-3-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-2-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/3916-1-0x0000000000370000-0x000000000069C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads