quasar | d0f1227b1a363081126ff63e603a98edfd5cebe7f9daaeae12b91f1c9e919921

Analysis

max time kernel
59s
max time network
64s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/07/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260725-dse52ayfle
SHA256 d0f1227b1a363081126ff63e603a98edfd5cebe7f9daaeae12b91f1c9e919921
MD5 15455c9ebe864058e108a9ca1033e778
SHA1 2e50ce1c7b8c9e5eb60499b0475e806480ab8f89
SHA512 1d5bc21df87b625a276756869b9eb9465669035bfa6b8a3f5e53288ff137ed0389f60679eaadd22e6fe58f589d30c1bdbbb8ecb6fca185ad8b405e1b02e0d1d8
SSDEEP 49152:tyhJJHPNCC7J98vBgJh99oG4znXhOxUuxGtTHHB72eh2NT:tyhrHPh7J98vGJh99tTx
TLSH
T1A0E56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping execution quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

quickgpt.io
malware.quickgpt.io

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/3176-1-0x0000000000A10000-0x0000000000D3C000-memory.dmp	family_quasar

Executes a command shell one-liner 1 TTPs 15 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1612	cmd.exe
3468	cmd.exe
2084	cmd.exe
2000	cmd.exe
2900	cmd.exe
248	cmd.exe
2360	cmd.exe
3692	cmd.exe
2480	cmd.exe
4876	cmd.exe
6052	cmd.exe
3648	cmd.exe
4092	cmd.exe
1028	cmd.exe
2952	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3176	messenger_update.exe

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cjy8na2QJXrR.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:2900
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:848
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    PID:4344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\emGUnPMRF10M.bat" "
      4⤵
      Executes a command shell one-liner
      PID:3648
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        
        PID:5456
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ThJaY9yt6cvq.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:248
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        
        PID:5108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\en8rWqRaeFWY.bat" "
        8⤵
        Executes a command shell one-liner
        
        PID:1612
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        
        PID:964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Mh7xUEImJQv4.bat" "
        10⤵
        Executes a command shell one-liner
        
        PID:3468
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        
        PID:4888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RF7Xg5CC0vt5.bat" "
        12⤵
        Executes a command shell one-liner
        
        PID:2480
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        
        PID:2244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\t2Pijtjo2RkG.bat" "
        14⤵
        Executes a command shell one-liner
        
        PID:4092
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        
        PID:4800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ETcQ2cBaiUBG.bat" "
        16⤵
        Executes a command shell one-liner
        
        PID:1028
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        
        PID:5860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ufKA8ha7AZ1X.bat" "
        18⤵
        Executes a command shell one-liner
        
        PID:2360
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        
        PID:3560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6JkQHSNgMVw8.bat" "
        20⤵
        Executes a command shell one-liner
        
        PID:2952
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        
        PID:4464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YV8aGJCZxv4s.bat" "
        22⤵
        Executes a command shell one-liner
        
        PID:3692
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        
        PID:1812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2uhANQ2xaDCy.bat" "
        24⤵
        Executes a command shell one-liner
        
        PID:2084
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        
        PID:3248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Jws5AxdPsKEb.bat" "
        26⤵
        Executes a command shell one-liner
        
        PID:2000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        
        PID:1528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iGn6RDmstTPK.bat" "
        28⤵
        Executes a command shell one-liner
        
        PID:6052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        
        PID:3276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\j0tpGaEiOOWv.bat" "
        30⤵
        Executes a command shell one-liner
        
        PID:4876
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        
        PID:4156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2uhANQ2xaDCy.bat

Path C:\Users\Admin\AppData\Local\Temp\2uhANQ2xaDCy.bat
Size 185B
SHA256 99f45f3c344debc1641050a4dc395d90841c3b1408df0a8057684bc78836b1b8
MD5 aaedac9c4f566d5fa9ddf7c630602be6
SHA1 89314b259db9ed9fa51f5df55961905b005d5b13
SHA512 71bb4c16418ca200de45bfd91851f3ae98ccdb314fb9af844510ec6d4f1f3fc0ee4387a41ac9b2167fb4d0efa8e1aa81db34ca2db7a87dbf781196cb5154a946
TLSH
T162C0120185958A5E45046C0A19E9668CF0D9089969497FA04511C8AD13D6C58B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

6JkQHSNgMVw8.bat

Path C:\Users\Admin\AppData\Local\Temp\6JkQHSNgMVw8.bat
Size 185B
SHA256 3744e93b7317df52e20173cd8bba66c507bc630773475e50d39a87500262be45
MD5 ea974b3b05790df3d5efe5008a3286e0
SHA1 16383535e12193e8ddcb1a1162c01528f5d3b670
SHA512 4693e87cc6eca55a5671c58f4198e3e8f9a8048c5439e5c184aa0cf447fb5884afab6d7212f3994f2737bcff8faf64b3c971726cac42e1444b640bbc44a83fc1
TLSH
T1C7C012015385CA5F49445C1B19A96A8CF0E5089D6949BFE04902889D13D6C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

ETcQ2cBaiUBG.bat

Path C:\Users\Admin\AppData\Local\Temp\ETcQ2cBaiUBG.bat
Size 185B
SHA256 8dfab298519a0fe280526219ff82b2b7612529d7edc1d670d94a071df8671f1e
MD5 750669d8d2c3c30a46bbbe08be893d2c
SHA1 8ffd9121bc9db1b22a2e613832514a55bfc14026
SHA512 be714cdc7e7dea98dbc05fbf4e4b51ee4a8b27613f30124e74a40d3bdec1336b2ea7ca5d1c5d83bb19126e14ddf7ac174d67dde0cc8e905a928f684a6d76cf1f
TLSH
T1E9C0124151818A6E46146C2B19EAA6CCF0D5089929497FA04901885C63D2C98B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

Jws5AxdPsKEb.bat

Path C:\Users\Admin\AppData\Local\Temp\Jws5AxdPsKEb.bat
Size 185B
SHA256 6b916bfac8461c95211e48ba0cb2a912ae5d18477fda7de578cc214fe1e66b50
MD5 b1056ea9c81af11e30fd0e9d25b69696
SHA1 87fdeca26845c118a3abcc9c8b0e27a1b2b5e5a3
SHA512 11b6b76389813af456061222e0cc469611af8c6ee91a660589755ceb838571db4adbea8b21423395fe37a498198b396d5062663a4f9ea90a19cf87765c4c0624
TLSH
T114C0120141828A5E49045C1A59EA76CCF0E509A92D497FA146418C9C13D2C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

Mh7xUEImJQv4.bat

Path C:\Users\Admin\AppData\Local\Temp\Mh7xUEImJQv4.bat
Size 185B
SHA256 40787ee3ee6f19ba929df3f1c4ad5b71719847193064040560f3611f0ab54ba4
MD5 ffc3a24225e716a0978abbe3952392fb
SHA1 7a71c19aa79c8fd98ddfd8be0063af0b805f5242
SHA512 e2f9b01988028fd6654640ef675db988388876a11bc344bc5f377ed81252795d45a9d7ae01e19946d93ff8a7cf513422e56827c2f70389f1a7881061c1195c6e
TLSH
T135C012014181CA6E45045C1B19AA678CF09A48B96A497FA445158C5D63D2C68B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

RF7Xg5CC0vt5.bat

Path C:\Users\Admin\AppData\Local\Temp\RF7Xg5CC0vt5.bat
Size 185B
SHA256 d24ad5a28906c91aaf252b458ee9fd7784bc8a7add45a7fe57fd54e80a8bbb2e
MD5 3ce658e912d6a1eba78bb4192303ae17
SHA1 dc88922e6ccb79bba5df51f595d643659509a6d0
SHA512 edab38b6184bc976e5270ef712c39794e007c40ebd125d5b93b2f0f995e8e982cbe9d8d4085b4b59ebca2c8fe41704f8627d5c5e5d9772b2a1d8838729ddf435
TLSH
T161C0120141868A6E45145C1A19A9A6CCF096099D2D497FA54A01885C63E2CA9B9CF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

ThJaY9yt6cvq.bat

Path C:\Users\Admin\AppData\Local\Temp\ThJaY9yt6cvq.bat
Size 185B
SHA256 1a77da76958a3fbb3f4e182935b49ce59ccc651381caa0ffe411b0ca5b61cdeb
MD5 b347424f73b74d7a58efa8c14a9b0c42
SHA1 b0d3dc2e03191ce3172d434470d8c10ced9fc001
SHA512 6cf6a88b5ea500d679495b7a01f5facaab7aa09ff1c33514693b959d2ba418cc212757d4b3a7c60ff5ef20f8aee7e67aee1719806b4a95447c62ec3e04b48630
TLSH
T194C012014191CA5E55045C0A19A9668CF0E908AD2D897FA14901885C17D6C59B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

YV8aGJCZxv4s.bat

Path C:\Users\Admin\AppData\Local\Temp\YV8aGJCZxv4s.bat
Size 185B
SHA256 9c38bfffd32af0b0e7df433c89dc4e4d9f0d384de9cd0e98bdc374f4b0c42e1a
MD5 59d64674969ef45ca1580df037dfd3ee
SHA1 23425229bf2386fbd14a3129939ca1368486decd
SHA512 a22dd28f1f8ceadd92c8dc7e62c139b5c7b1899a381ebbab8d955195202b0d0f9257966f616289d6ee01d59d7648e90b12cbfa812fb6c69f375f44227fc40800
TLSH
T18AC0124142928A6E46045C1A19AA67CCF095089939497FA045418C5C63D2C5CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

cjy8na2QJXrR.bat

Path C:\Users\Admin\AppData\Local\Temp\cjy8na2QJXrR.bat
Size 185B
SHA256 d60a8cd2a84b319e9f6217fec0b8986912354278dd7975c04715fa9b57ea6dc2
MD5 8a70d2e77795ae532bd5271981e6f5f5
SHA1 45f0ea727272ed3233dca1589fae8c2bebb94b25
SHA512 24ea33538fd8c74cc77ff4872f75d69083c54db0b587c65f357cea908471464549216878a11e28fcf9572c680d7c5b96a95b979f5f344f47d4700bbc629c3e96
TLSH
T180C0120145918A5E4A445C0A19A9668CF0D5089D6989BFA44A05C89C17D6C5CB5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

emGUnPMRF10M.bat

Path C:\Users\Admin\AppData\Local\Temp\emGUnPMRF10M.bat
Size 185B
SHA256 109678c4f80aeda052fbda183feb6857a3b7fbe1f11c1b70dfdadf659fdf1a5f
MD5 d1518d76f46a53f945fbf15fbb11a057
SHA1 e7293bf230f955ee3a37ed929988d0e67f3f7008
SHA512 049d8fee8b16f8e1ba3339e0e73e7ebdf25000347075c180cd87e8986c1f9d07e5379933fa36905ff8b70c435452b6a5a62a48a53a327288aa4e478c212cefcf
TLSH
T1B2C0120141918A5E99045C0A59AAA68CF0A509992A497FA54611885C17D6C5CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

en8rWqRaeFWY.bat

Path C:\Users\Admin\AppData\Local\Temp\en8rWqRaeFWY.bat
Size 185B
SHA256 053a63a2eb0f3fbdcb63b6397a042961573108be46553a734376de0a41d93093
MD5 9c693465e42180c757702ccb4a388af1
SHA1 9e966a9310640ad99271f0b9cafa077c51444e09
SHA512 deb4c3c0953482161e73357eaf71f740fe6c1886862f1cd89e189eaad4d1fa8268493544dbb860829baf509441fe001f118d67c81c9ec904696e77894d9c5347
TLSH
T11AC0120181858A5E59145D0A29A9668DF0AA09DD2D497FA04611CC5C23D2C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

iGn6RDmstTPK.bat

Path C:\Users\Admin\AppData\Local\Temp\iGn6RDmstTPK.bat
Size 185B
SHA256 118ac74a223d1671e708ec25f112c0eee7bd7a7101cc39a0f0664393357760c5
MD5 7911cbd91aed598ff5e4b0913e3f9349
SHA1 e61c7be563125e46db9561cf9805e439a991d629
SHA512 4e6484e7bedd6fa732c496847cdeecf265fcfc00923c6d47db2a4dbcc57eb576ea0d72a9e5d93c9cb575d3f1401f1a2299978a008d04fcd60f3fd25cef9007cd
TLSH
T15DC0120146828A5E85145C4A19E9679CF1AA089A29497FA44501C85C17D2CA9B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

j0tpGaEiOOWv.bat

Path C:\Users\Admin\AppData\Local\Temp\j0tpGaEiOOWv.bat
Size 185B
SHA256 e5b4c5e2c0f08e773e65d38970a9f11ef5a496d1ff7866454941ba0d082277a8
MD5 36dd1e3c86726f2f7efeb308b238f8ba
SHA1 8a1b4713d950c1780cf78017880da9e6191a92a6
SHA512 58edf367b778d8b17b43680d73f6793fff8cef985f6ef359c0cfdb2331a2e0493f2f0e571107aafe329ccd6d4e8f20af8a77ff9537e3e8c1c824b6cd3a63cfd1
TLSH
T199C0220041818A1E06040C0A18A9638CF09508982948BFA006008C8C23C3C58B6DF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

t2Pijtjo2RkG.bat

Path C:\Users\Admin\AppData\Local\Temp\t2Pijtjo2RkG.bat
Size 185B
SHA256 7c8df3368d3074c628d52fa554a4e1250613f077c09071607383fb0528db63f3
MD5 af523b1901a8e2807e0962d02825f61f
SHA1 222a52497715bb134d063983758942b66c64e86c
SHA512 455654c975613c99c7e67ee8e0057b39f57b4e9354e08e3f6d230e3166c045adb9a61aea4fa332fb1f4e50457e732d90d4a2bb9e324005d752d7d192c3c3b6c2
TLSH
T162C012014281CE5E45085C0A19A9B68CF0A6099929497FA049018C5C53D7C68B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

ufKA8ha7AZ1X.bat

Path C:\Users\Admin\AppData\Local\Temp\ufKA8ha7AZ1X.bat
Size 185B
SHA256 e9ea8575f4e5f9b38ab4babe14c225fd0cfd674cb7fda2544a6d2eb3754cb83c
MD5 af171801f4cceef63b94c5d36bc5ccd0
SHA1 fc318749c43149158d3967c64ff3802cf56d3c39
SHA512 cd73a9a9a0bdda68017f473b25ef03fcae97bd7b278bc085155d3da500fe4cfca5e281039691569bc46329b26def56b99b75710f2df688885b6fd5e60ea4a251
TLSH
T1EFC022014181CB1E05040C0B09A9768CF0D508982E08BFA04A00884C23D2C5DB4CB382
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3176-11-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/3176-6-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/3176-1-0x0000000000A10000-0x0000000000D3C000-memory.dmp

Download

memory/3176-2-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/3176-3-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/3176-4-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/3176-5-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/3176-14-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/3176-22-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/3176-7-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/3176-8-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/3176-10-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/3176-9-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/3176-0-0x00007FFD8D74F000-0x00007FFD8D750000-memory.dmp

Download

memory/3176-12-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/3176-13-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-30-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-44-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-36-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-35-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-34-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-33-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-32-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-31-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-29-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-28-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-27-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-26-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-25-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-24-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

memory/4344-23-0x00007FFD8D5C0000-0x00007FFD8DF64000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads