quasar | bcfe883efe407aeaedd8323573918466f0218bbd9249e0dee65f8c42f7afdd47

Analysis

max time kernel
59s
max time network
61s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260715-vdkkmsg14m
SHA256 bcfe883efe407aeaedd8323573918466f0218bbd9249e0dee65f8c42f7afdd47
MD5 38078b835e8497c6e8dae163c2b230a8
SHA1 dec8fb978f0bec134e4d3f25f2c14e709be29a4d
SHA512 87b1c681a4e197f04fd4126e50988a6d2c6e1a363af3f8c99ff0faa0a130f6349aab1b929d58ca5e9e35a06265615b47866af4c3c94d7566d30b9d65d86e8a8b
SSDEEP 49152:RycHGrTlKehOqJgBHA6F9oG4znXawxUuxGJTHHB72eh2NT:RycmrTJhOqJgVA6F9tkx
TLSH
T177E56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

up-00.com
malware.up-00.com

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/3472-1-0x0000000000CC0000-0x0000000000FEC000-memory.dmp	family_quasar

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3472	messenger_update.exe

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FQx7PW3QfuWd.bat" "
  2⤵
  PID:3360
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    PID:4780
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vAe2iGOFSRFV.bat" "
      4⤵
      PID:4584
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:384
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        
        PID:108
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GKMOYkyBLXgR.bat" "
        6⤵
        
        PID:5924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        
        PID:1648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OeRf2TtFr7AP.bat" "
        8⤵
        
        PID:2992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        
        PID:2664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1MXiDFY30Kek.bat" "
        10⤵
        
        PID:2428
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        
        PID:3224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Xv0FPCmVOYvJ.bat" "
        12⤵
        
        PID:6096
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        
        PID:1796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bGOGMxI5DJu1.bat" "
        14⤵
        
        PID:712
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        
        PID:4144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RuNWv2XGScju.bat" "
        16⤵
        
        PID:3312
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        
        PID:3436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YXG1U8SmdS2T.bat" "
        18⤵
        
        PID:4412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        
        PID:6072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iJcA4yYOOMeW.bat" "
        20⤵
        
        PID:1456
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        
        PID:6068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\41X5ITcE7OpL.bat" "
        22⤵
        
        PID:1700
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        
        PID:5600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qNFs4ten4th5.bat" "
        24⤵
        
        PID:2200
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        
        PID:4124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\m16TGxXF4SaQ.bat" "
        26⤵
        
        PID:5300
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        
        PID:1328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5RB8Y1iWt3S0.bat" "
        28⤵
        
        PID:4872
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        
        PID:2564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SqmROEcIaNRu.bat" "
        30⤵
        
        PID:2272
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        
        PID:700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\egNsRvXa5sPG.bat" "
        32⤵
        
        PID:4840
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        33⤵
        
        PID:4740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

1MXiDFY30Kek.bat

Path C:\Users\Admin\AppData\Local\Temp\1MXiDFY30Kek.bat
Size 185B
SHA256 76e2027b622363ae5beae22b087278704b581a5e166f03e8b3f6e870aad31ce3
MD5 da5f91bd1e840ccda3358008c07a7594
SHA1 2ed9f95139b70d1189267dd63ce2ff2a60477788
SHA512 f8a2c00242b0e41ee4e01e2a8fa90393a6ace2c239e22b4b28f2838a57e8ac546ecd86a1afa3582aec2e9fa14cc9b815bd65d2f7cd0fd5c48788479acf4d9c0b
TLSH
T103C0120145958A5E45046C1A19A9768CF1A509992E49BFA14541C85C53D7C98B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

41X5ITcE7OpL.bat

Path C:\Users\Admin\AppData\Local\Temp\41X5ITcE7OpL.bat
Size 185B
SHA256 ca0c0a693bcb88b71f017c9a1e48ba8e4e4b191cd8ed624df927632eecc1f34d
MD5 c7f897d7b5e2f503dcc5a54439b6edb2
SHA1 e4e3c1b5b2745860b0a5a004ba84b5d8bce20285
SHA512 235a535e236737e2f89b93275e98c012936b1014060942e5efaa35435817fde7d696d6232619acbf50b51638e07e06d4d51c56de95fe6363a0a98c6e7cc283f0
TLSH
T170C012015285CA6E49045C0A19A9668CF09508A939497FA449118C9D13D3C98B5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

5RB8Y1iWt3S0.bat

Path C:\Users\Admin\AppData\Local\Temp\5RB8Y1iWt3S0.bat
Size 185B
SHA256 6e578198d74cde62aad89d9e01bcbd53e8469f7f726bf8fa46e4a65291bd4d33
MD5 54a2710a68b700a477b5353b370b16eb
SHA1 ba4b0238337a05fe3d1c89ab0a352c4ccf2034f5
SHA512 98181c83af6d1b7de7fff9f6c42dcd5f53218d18498b51950556097c32846e17adeb467c509f4e8ebcdd044cc91efe8efaa5b223ac5801e189d8796accb91004
TLSH
T1AFC012015181CA5E45045C0A29A976CCF095089969497FA14601885D13D7C68B5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

FQx7PW3QfuWd.bat

Path C:\Users\Admin\AppData\Local\Temp\FQx7PW3QfuWd.bat
Size 185B
SHA256 6c8ef8efec5f7a10b63fb120de1203e72f87b704caa367789e50ae825fe440f7
MD5 5e6e8a1fdfea99fa7bbcd483955dd04d
SHA1 375bbf2bde86f0033852d5fad0001f1fabc9a386
SHA512 b045facae12db4cf4151ddc05ac72c880ced88dd1cd8138da81c3e5d4993f6c501101b9502a2fbc29867f4734531b79d013df0f008e014dd6555f1c6c08a53ce
TLSH
T1FBC0120141918A5E46145C1A1DE9768CF195089969497FA049418C9C53D3C5DB5DBB82
MD5 SHA1 SHA512 TLSH

Submit Download

GKMOYkyBLXgR.bat

Path C:\Users\Admin\AppData\Local\Temp\GKMOYkyBLXgR.bat
Size 185B
SHA256 0e2be83976dea718d9ea155c3e2a1d79fbc9adeafbe1dca41642cebac074191e
MD5 b4117a0ea9f183ad25b1aa3c76a7b904
SHA1 5199a0e8914bcf0884605cd1e8dead5047a6797b
SHA512 fe34329dd5c540b0cda01f76bec091f8c5eb57d7c2e07d97ed502d6b7d6ce6cbc2d5931260f71e1213da7600e66fbe5eb2be9efcb3a10cb36d7282c815a8d981
TLSH
T119C0120141818A6E45045C1A59E9668CF0E90D99294ABFA04542CC5D13D3C5CB5CBB92
MD5 SHA1 SHA512 TLSH

Submit Download

OeRf2TtFr7AP.bat

Path C:\Users\Admin\AppData\Local\Temp\OeRf2TtFr7AP.bat
Size 185B
SHA256 85295e39c8cbf8c52f84d12b10f6f0f7756a47f21bc6a222ac6bfa94480746c7
MD5 9333ff4ce4601e2369eeb466999d3b20
SHA1 5d2480e0e80c114db2384fe0e093531e95ebd8b7
SHA512 796244eb104a0e79ea94cf28c23b2cdc50b7a5cdab110d0ee7762858a251a9d63ff76b7d6822218615ef74d2beda374fec72470fba40265f35638da732bfd682
TLSH
T1E9C0120181818A6E55445C1A19A9778CF0990C992D497FA04511885D27D2C59B9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

RuNWv2XGScju.bat

Path C:\Users\Admin\AppData\Local\Temp\RuNWv2XGScju.bat
Size 185B
SHA256 51aa42014495e3f1797de99b0277c4bdcc81efec42a05d9caf58fa8883fc62f9
MD5 afb65037ee64ce21b448c2ef11273ec3
SHA1 2bee44b6b517a2791999b374dd4cbbb81c286ea6
SHA512 e1154d13ab90e6f17e5bdeaa7d51d8ae1178a0c17fcc40c58ebbe012bc0ae68ac4c6bbcfd20bd186416fe1b7be781d21a5dd09ef72c50be09f52b0c999de6b3e
TLSH
T119C0120151818B6E45045C1B19AAAA8CF0AA089D2D497FA54611CC5D17D2C9CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

SqmROEcIaNRu.bat

Path C:\Users\Admin\AppData\Local\Temp\SqmROEcIaNRu.bat
Size 185B
SHA256 a808b7f23fe2c4fe2321a012b2f279aa6757a246978b9944929db9e95f3b745e
MD5 74de83f3f138c98fbf11684981a3c394
SHA1 44a652cafbcba39b67c20538188bd04fd7b630fd
SHA512 940869458bfeea8bf54462c66bb8998f7e6561944c21962b48c4c5b8e548216a144bff9a04b629d7eb926add320bef955ea44d1c5ee6a8c95304e538fc9c7c24
TLSH
T153C0120145C18A5E45045C0A19ADA68CF09908A92949BFA04651C89D53D6C5CB5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

Xv0FPCmVOYvJ.bat

Path C:\Users\Admin\AppData\Local\Temp\Xv0FPCmVOYvJ.bat
Size 185B
SHA256 8c5ca2387a8bac48884516d8141475bd20f36bce2d3b8d353e668cbcd6f7cf08
MD5 2665c6888e0234795bcfa7927224da8b
SHA1 704150f19e52ed1528aea07943ebcd75991febd2
SHA512 ba8b422a9de3c52e36901cb9ba01e831a75e4f1a67dcbd7ae6aab881542d60aa549a5dec364d16a68db9481170fc50dd088e0e1c1b99aee829165c283d63946f
TLSH
T162C0120151858A6E86145C1A59EAF6CCF0A509992D49BFA449118C5C53D7C58B9CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

YXG1U8SmdS2T.bat

Path C:\Users\Admin\AppData\Local\Temp\YXG1U8SmdS2T.bat
Size 185B
SHA256 126e1e98f39f5542e09301f67c527409acfdc85419b0fe0681a765b0eb5b7cb7
MD5 b3d31255d6071d753ba64c9790db4052
SHA1 c63f32ae1f4480dadc4ac17d1cd9de39ff7cd627
SHA512 e75969f8c84770ac1e95f196e170825239be48f5fc971e877c63bb5531332a7069be7bed5ebc835c5c375cbba1336db93e46812227e6289640251020cd116c13
TLSH
T11AC012015182CA5E55145C4A19A9668CF09508992949BFA54601885C53D2C69B5DB783
MD5 SHA1 SHA512 TLSH

Submit Download

bGOGMxI5DJu1.bat

Path C:\Users\Admin\AppData\Local\Temp\bGOGMxI5DJu1.bat
Size 185B
SHA256 2fc96006e207ac1cb4fdbc30c105605a361e61a635b8d04651970a1054bc0317
MD5 da7efff6c989ee90b9c95201b3cf94e1
SHA1 ed53a2c13e2bd138bc2377b3ab6d74091ff18936
SHA512 19525df9809ab5ba115b42054d8c3cc627b2ac2634b4a058c4520ddb6d27c7234dd08faeb3ce4f1ab900797bf24745b8d2005ce8c2e008d67a7df85e827fe695
TLSH
T165C012014192CA5E55145C1B19AA678CF096089969497FE44601889C63D3C5CB5DF792
MD5 SHA1 SHA512 TLSH

Submit Download

egNsRvXa5sPG.bat

Path C:\Users\Admin\AppData\Local\Temp\egNsRvXa5sPG.bat
Size 185B
SHA256 e0c7d32eb81cd85fbee9074bfbd0557a333459f2b66f74efc65d108d06e46aab
MD5 38cc4586a69c641be78b583f8c27eb26
SHA1 1286dc893c4482b1905d5194c3c206b650da9ae8
SHA512 cd27250e52b241151d75844c19623ff9ef62a50db3278abf1918704c48443e9e13727e80a0cc8bc7751a1c92f80b9d34f318b8324e5a6ca8768100342a863cd2
TLSH
T1FBC0120141828A5E55146C0B1AEA668CF0990899294DBFA04A118C5D17D2D5DB9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

iJcA4yYOOMeW.bat

Path C:\Users\Admin\AppData\Local\Temp\iJcA4yYOOMeW.bat
Size 185B
SHA256 a0fc5c7609bdd4016a24301b239efa2fff535c3850f9c8afd373f8baa867231a
MD5 72feb31bc5abb738255539385e3dc266
SHA1 e304e20b29b436c481fca2b3f66996575e9d98c1
SHA512 395893ca57aa2370a171a444ccba2d2789fb79e4962e97e5911e9a49cf2453d254e78eff793dcf14b7df3314998da996e63e9324579c09c7b2d967893ed4ab7e
TLSH
T1D2C0120145818A6E45155C1B5DAA768CF199089929497FA44901885D13D3CA8B9CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

m16TGxXF4SaQ.bat

Path C:\Users\Admin\AppData\Local\Temp\m16TGxXF4SaQ.bat
Size 185B
SHA256 6714653de91c32b4566b5df5f33efabee1c5a6580820da8588db1138556b8e3b
MD5 9aa00008bac15b27bcd88ef89ddee91c
SHA1 1ae46d096dab4e06e00cb199d96789dba3492631
SHA512 2be90cc1bb71a6bb8e8c4993bd002e662d1886e5875f72101e36453874ee1be65369d6632231aab9c6213e8807e1663bc4806e5ecda1657b4f27f6821000b106
TLSH
T1F7C0120151818A5E55045C0B5DEAA6CCF095089D6949BFA04501C85D27D2C98B5DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

qNFs4ten4th5.bat

Path C:\Users\Admin\AppData\Local\Temp\qNFs4ten4th5.bat
Size 185B
SHA256 a4195d9a5efcb3048f532151ea35be51beed266771b97fba269edcbf8c41b901
MD5 dc1104079c510a7be3355b39d993a8a9
SHA1 b9524c1253fe2715b76f45a53e9a416d7a1f1e72
SHA512 86cc5133e72c9268048af9b7b96a6bd878041d492b5bb1caa0f1b059f2c811be05205bebd76a6102c97ba0ddf9dcf19dab4ce198e7aa84ff8a339d41bbbd92f6
TLSH
T17EC012415281CA5E46045C1A1AE9668CF095089D2949BFA04511885C53D6C68B5CF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

vAe2iGOFSRFV.bat

Path C:\Users\Admin\AppData\Local\Temp\vAe2iGOFSRFV.bat
Size 185B
SHA256 e1cec439c9ad213567ad3017ad09b14f95ac988020834031e0241c5a79ca07b6
MD5 87d988a22310264ee5647c181e68b841
SHA1 7f27abdf33ed8afcc596586007113b3920548904
SHA512 f189620d1f192d766dd98b2455a8cccc46051e315e6c14ebe12b41cce09edb27739e717253aa8a34820f4540dbc6040d6caed472d230499538ed8e9bba43a772
TLSH
T15CC0120141858A5F45145C0B59AA6B8CF1A908996A497FA04901886D17D3CA8B5CB783
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3472-11-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/3472-9-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/3472-1-0x0000000000CC0000-0x0000000000FEC000-memory.dmp

Download

memory/3472-2-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/3472-3-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/3472-4-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/3472-5-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/3472-6-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/3472-7-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/3472-8-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/3472-10-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/3472-0-0x00007FF8CFE3F000-0x00007FF8CFE40000-memory.dmp

Download

memory/3472-12-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/3472-13-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/3472-14-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/3472-21-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-23-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-29-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-35-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-34-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-33-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-31-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-36-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-30-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-43-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-28-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-32-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-27-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-26-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-25-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4780-24-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads