quasar | 108572af7b1a8d82048ad33539e87e8c8690911f3c63f9c435cb8322be738742

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_2326577a7576727e7b6e3ed3ff690446_icedid_luca-stealer_njrat.exe
Size 4.6MB
Sample260802-d1dbeacn7t
SHA256 108572af7b1a8d82048ad33539e87e8c8690911f3c63f9c435cb8322be738742
MD5 2326577a7576727e7b6e3ed3ff690446
SHA1 3c865dc54fc0644df9d2f0a5f6e3c8a3fe988eac
SHA512 1d567e5255122d45967c215d94505c1fe252e2cee163d727f82adf81a35778d7abc0e4afea694e241c073b01cb3a8d68bf056798d688c9291bfae90d55ed27c5
SSDEEP 24576:nm1bic7PIsN1OM1wau91PHKWGydL38EqXKzr2gduRXFzP5AtTQpFX+m5fi69ffff:m1N7TNzmdj09Mg9wcpwjMO6J6fM
TLSH
T19F268D72A203FDCE773E2ED498103A751C58389B6765C298FEC805FA31E6558DF289B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

office04 discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

10.0.2.15:4782

Mutex

6a75116d-b078-449b-8e78-6422db248fd4

Attributes

encryption_key
580E4D898C9D9175C2381CEEB0AED9D4C974D5C1
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c61c-9.dat	family_quasar
behavioral2/memory/3532-38-0x0000000000240000-0x0000000000564000-memory.dmp	family_quasar

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c61c-9.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3532-38-0x0000000000240000-0x0000000000564000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c61c-9.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3532-38-0x0000000000240000-0x0000000000564000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing common artifacts observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c61c-9.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/memory/3532-38-0x0000000000240000-0x0000000000564000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

Executes dropped EXE 3 IoCs

pid	Process
3532	fbp_pl_4492.exe
620	Client.exe
7152	Client.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4492	2026-08-02_2326577a7576727e7b6e3ed3ff690446_icedid_luca-stealer_njrat.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6008	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1940	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{EEEBE780-E3F6-40B8-B20D-40B06C16F9C3}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6004	schtasks.exe
4452	schtasks.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3532	fbp_pl_4492.exe
Token: SeDebugPrivilege	620	Client.exe
Token: SeDebugPrivilege	7152	Client.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3724	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 3724	4492	2026-08-02_2326577a7576727e7b6e3ed3ff690446_icedid_luca-stealer_njrat.exe	90
PID 3724 wrote to memory of 1828	3724	msedge.exe	91
PID 4492 wrote to memory of 3532	4492	2026-08-02_2326577a7576727e7b6e3ed3ff690446_icedid_luca-stealer_njrat.exe	92
PID 3724 wrote to memory of 4544	3724	msedge.exe	94
PID 3724 wrote to memory of 1940	3724	msedge.exe	95
PID 3724 wrote to memory of 4544	3724	msedge.exe	94
PID 3724 wrote to memory of 4544	3724	msedge.exe	94
PID 3724 wrote to memory of 260	3724	msedge.exe	96
PID 3724 wrote to memory of 260	3724	msedge.exe	96
PID 3724 wrote to memory of 1124	3724	msedge.exe	97
PID 3724 wrote to memory of 1124	3724	msedge.exe	97
PID 3724 wrote to memory of 5524	3724	msedge.exe	98
PID 3724 wrote to memory of 1124	3724	msedge.exe	97
PID 3724 wrote to memory of 5524	3724	msedge.exe	98
PID 3724 wrote to memory of 5524	3724	msedge.exe	98
PID 3724 wrote to memory of 3352	3724	msedge.exe	99
PID 3724 wrote to memory of 3352	3724	msedge.exe	99
PID 3724 wrote to memory of 3352	3724	msedge.exe	99
PID 3724 wrote to memory of 6272	3724	msedge.exe	100
PID 3724 wrote to memory of 6272	3724	msedge.exe	100
PID 3724 wrote to memory of 6272	3724	msedge.exe	100
PID 4492 wrote to memory of 6008	4492	2026-08-02_2326577a7576727e7b6e3ed3ff690446_icedid_luca-stealer_njrat.exe	101
PID 3724 wrote to memory of 3044	3724	msedge.exe	103
PID 3724 wrote to memory of 2808	3724	msedge.exe	104
PID 3724 wrote to memory of 3044	3724	msedge.exe	103
PID 3724 wrote to memory of 2808	3724	msedge.exe	104
PID 3724 wrote to memory of 5844	3724	msedge.exe	106
PID 3532 wrote to memory of 6004	3532	fbp_pl_4492.exe	108
PID 3532 wrote to memory of 620	3532	fbp_pl_4492.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-02_2326577a7576727e7b6e3ed3ff690446_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_2326577a7576727e7b6e3ed3ff690446_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\entretien.pdf
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe35d7c188,0x7ffe35d7c194,0x7ffe35d7c1a0
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1844,i,17981467346121979086,17700166403633824415,262144 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:2
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,5165258244459726874,5678928186034723797,524288 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,10429687188755561568,416218688932359505,524288 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13
    3⤵
    PID:260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,15219446238520994115,1548967748740623753,2097152 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,5055899985321990658,7179797768622551151,2097152 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5036,i,13628276304885167533,12114868393864270086,2097152 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:9
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5348,i,15913094806475296455,17838574518446285873,2097152 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:15
    3⤵
    PID:6272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,5052191848174079682,3249746255093661757,524288 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,9303724848276126798,16906182745369798788,524288 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,3817510784290962896,10935056734933737393,524288 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,3817510784290962896,10935056734933737393,524288 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,13343307511259331652,11767815441792620097,524288 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:6240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,5027428772280052427,1878092543448208229,524288 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,1146347598892510004,10233040186036094500,524288 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
    3⤵
    PID:668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,13233111931040587488,6614891606135725754,524288 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:14
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,8371165181747320541,6769596103500685859,524288 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=1236 /prefetch:14
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,10266984379489681094,1467640550890253702,524288 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,11474330616325596492,15318966552760901839,524288 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=924,i,4054107395088982753,17759707442589552904,262144 --field-trial-handle=2552,i,14280609260247494933,18255067637124579143,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:10
    3⤵
    PID:6288
- C:\Users\Admin\AppData\Local\Temp\fbp_pl_4492.exe
  "C:\Users\Admin\AppData\Local\Temp\fbp_pl_4492.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6004
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:620
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sd.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1208

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

99cf9b06-1f94-4cd8-986b-7316ef87ec46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\99cf9b06-1f94-4cd8-986b-7316ef87ec46.tmp
Size 28KB
SHA256 e2b1f2f53b5c1d3aa7b8fb919919d629aee5db5710e6a0c9ac115588a8da6f03
MD5 edff754c1c3fe2fc36592d8351e7467b
SHA1 6437a8bf7b6dc062c841530dd3da89642898d1e3
SHA512 e963b5ce4b4deb3cd59468d9e0e6c402d648c7f89d7efb899bcc0b297df5d560b4f3c8c67675a163fe4f1201deea33d49fe00d8182624049662104a144cbb688
SSDEEP 384:nUiFiZcIv8NLX8TUNTUlIRHPvuTH91EqfbYGTQR9XQjWELKkunTKwBODNZOCRW+t:vFQvQXwgxuhAGUIWELBunewBKZOYWa
TLSH
T173D26D36E868DDB3ECEA5FD8A7497247DEE411A3D5CC8AD8E6D95E0C008329D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 86a1940d2b6dfc8ed1ab83e0ef386e795db3012dcd12ed3ce2db4b5845e394f5
MD5 379880e5a55b4bbad4dd083af75e4c15
SHA1 ed8e8a3e6e368502887c2afd43f02605d2dde52b
SHA512 41cda5c97f19c20aef036678363bcc1c990ae1dbbcc3257462ab982445151ee224d288da7c338a249a0f7e2c0120fdeba5b0a735902db9a840b8e0d780c640b9
TLSH
T1E3F028A6C921BC371DFC1B1870A44B47FB94136B3B41995B3B3D921C8FB463B868691C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3a5de61f0575e6141f8f83638e34388dfeb2a3f75fcd3a9fc507a4db798dbe3a
MD5 22c1836c5b3b59881685e6e662ac560d
SHA1 af092c2b316419959e2f3b5c86af4048db949614
SHA512 e4dcae951f57c9b8babe1ad0baef1b74388a4ae1ee11387e8b4f916e7cd6f4f35af6b9cc5c0b9635a91536077f37d6275fc6f89905d8f9c71d6bd864172e8cef
TLSH
T174616F9D8BA92BE3FB2158F151E5448F76F094D92607BE1D43807EFC9806F2920D18E7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b52d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b52d.TMP
Size 3KB
SHA256 0891065c7bd3544ebfd448ddbffb941ecce7116b2d34e73703d27e51624f43dc
MD5 be068640f96fc602c560a59cb075f4b5
SHA1 89b26ef7df7d188e9fc4209db59bd14a90718b92
SHA512 9c3889650f599574c57b7a4d455f5ed3839df2b18bfac7b38f2f2d0546c78a37ce2ebea095e4302364a7c4306369dcf141c9a94b5431d141ab14c80ce5e7d923
TLSH
T120614B9D4B992BE3F72198F291E5448F36F494E9260BBE5D03417EFC9806F1920E18E7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5ea47b25853a8798aa4eb49b03d1c9ce746e2b43c2d498b125fbc4a295258013
MD5 525dbcfa6a95374775ac70ac897893ec
SHA1 3dc7d4de71c167eec2d0d1ad06a24bf45aafcb79
SHA512 4e9d54a8c281bebee49494083f7893eb76413466ec45a23bea9711bee55d41ba4bb6c67e4a47f6071a2fcf974536866c673d7cd149ecf09c00dc41215fc87d73
TLSH
T15A518EF783E8866DC91196F0E618BE2FCE2D0915432C3D5AC9E4AE1B93E3471D141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 206109ed6dc3a3658e73f90726e0d81205f473586730ad58f1e596f1d493f783
MD5 ea2ee3d3fecfb13e88f6febe436ab55a
SHA1 344906e9966f822372c6211cddbc3535b67aaac5
SHA512 61a24bbd56d59aece51425501f895327e26aee2ed53229021b670ea69ffc15d54ac37fe39a4a739aafcbfafc463a6057fce550d8385a19007e5c485096bd26bc
SSDEEP 384:sxRqf85/f2sqvPN/RITT0/5IW4NOKsGQUj5:s205/fqFWU/5IW4nsGQM
TLSH
T19A72D915AA289D7BCCCBD21DFA557F93D6FC1533A1505E44AAFC8A0C04E6AED211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 666393e6857b51626ba6c047a0348745b1fc464a4f53a075cb5187ea4dc5092a
MD5 1a184876ed49e7e4631c011c803b42e4
SHA1 2a9b319c5762c686943a462698bc25009df33716
SHA512 21e7af154d9d34604ca2198abef10fa7230221f23f68bba30b3c7fcd41582f4ceb3ff4b310bba3c1084c3b5479759b7aa00b2a7223c1edd156ab45160c42e1e3
SSDEEP 384:sxRqfq65/f2sfvFN/RITT0/5IW4dOxsGQU3w:s2i65/fd3WU/5IW4qsGQT
TLSH
T1DE72E915AA385D7B8CCFD219F6957F93D6F81533A1505E44AAFC8A0C04E7AED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c18d5de947ea3280b6ae1edacc345dbbf4f7960480d3972350a40cf6234bf9f5
MD5 b651419624a950ed2880d6c0991782d8
SHA1 9e6c6e119afb67c5b40d9abdb2b081e4b8a5f845
SHA512 a0314ab4d2295e444700cb3256fa65183c44e3069cf0d8fabfa367b297bec9e94dd6911fc42da29395f6cb69b74ec86282bda9bb38e1317aba27dfddba978f95
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEobbDwzro24u:Ob4YZnE7yTWg1NfwBu1jajobHwARu
TLSH
T170E2EB3B280CCB7E4F804ADDEC29BD9A6DA8018F5AD8C95447FA450C03C6BEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 fee90a9acb4fc99e5976c4db8bb6e96a4d4326ddc8ec334022a2cc888fe3922e
MD5 2843ca0f9f1ff269cbfcd51d54f0f45a
SHA1 19bd1cb556b8f0a900efafeb7fedbde273be6871
SHA512 d1baa63a277971a0aa83cc21bec16fd3babfe873181bf2f3659ba176cd2b1a212a28501113d49a6f485fa9330d0eb8a113cb00df056a8d1d7ff4e2793779313c
SSDEEP 768:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9R3Xg:yv+RpPYDDRPbIhJ9R3Xg
TLSH
T186B24C11713F5290387EA90C81B8981F86C2B4637519F52F7BA802A65F67E139DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3316a9d430a10998cb25b77706350a8424b7e50dd4b8f0c6a6e5c9733da16831
MD5 ee71bc01e6d9d904a99dd0abfdd5be98
SHA1 86fd6baf9671b64a8bf882ef48f276420eb76ed0
SHA512 edfc16a8a55beefadb4f598ead91a49f680574fe639e815ed2d3ae561d582b9e134e09235a25c22cc1c10e33601f5f89597d25036df48ea024b157aed2499ccc
SSDEEP 384:nXiFiZcIO8NLX8TUNTUlIRHPvuTH91EqfbYGTQR9XQjWELeEunTKwBODNZOCRW+t:SFQOQXwgxuhAGUIWELxunewBKZOYWa
TLSH
T1F6D26C36E868DDB3FCEA5FD8A7497247DEE411A3D58C8AD8D6D99E0C008329D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 114f04870229a61293b5900171ff70bec4cec643eef65714d6a7180e02321dcf
MD5 dc53a3980c9001b823c3a55f7a1d501f
SHA1 a70da020916577efab139c343a9c71067f5bf0d1
SHA512 e0661388bba3981e1b5804ee6c50168ac9e290c397855f77050dc4fa4b59dfe28c604687d40d2771ff203f5fff2c115a84e5dacd5929f362db6fd5c25e9dee54
SSDEEP 384:n9iF1tNn/s3n9Ss8NLX8TUNTUlIRHPvuT991EqfbYGTQR9XQjWELeEuXDb8LEEIC:0F1j+9lQXwgxurAGUIWELxuXE
TLSH
T11BB24B36E869CEB7FCEA4FD8A30A7646DEE411A384C88AD8D6D85D4C00C72DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 456b396a65dd70df35994d9dffab130f56ec9b4541af65a903c0cb9b1af78c2f
MD5 10f1ffa4c942a3282fad573a8146ea9d
SHA1 115d3995ec12fdd425ca13193272809c4d91d545
SHA512 b056606f55899aa52afafc36a8a58090a2cc361249c184c14185acd5479c0575ab0315fb1a4d8c2a1fa36636ef9c8dd6b7ca2382b42ae6812254312ac4a7730e
SSDEEP 384:n9iFiZcIO8NLX8TUNTUlIRHPvuTH91EqfbYGTQR9XQjWELeEunTKwBODNZOCRW+t:0FQOQXwgxuhAGUIWELxunewBKZOYWa
TLSH
T143D25C36E868DDB3FCEA5FD8A6497247DEE411A3D58C8AD8D6D99E0C008329D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1db7a08aa362bd46e7eed3155de5c90a823a91c5a9d5df9cc12ae140c5397e0b
MD5 dd644a372d2a1c969255e7757dea70b3
SHA1 95d0b8e8bae5f688316c2b8d6866107acd14febc
SHA512 3aba9ad4a3304e29b49b52713b7d87bdddeae5079b9b7bb0b56cb59de842a5eed11b0556438b6c3340065afbb33a5f823e4a218343ed6351d80a4af4f2175425
SSDEEP 384:nCiF1tNn/s3n9Sn8Ngs8TUNTUlIRiPvuTuhREqfbYGTQR9XQpL2OObjI9G6w7ia6:JF1j+9SXswgUuMUGUa229Mi
TLSH
T1D3C25B36EC59CEB7ECE64FD8B34A7A5ADEE0026785D85AC8DAD85D0C00C719D4307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 25afb2f2bbaa4983e1dd9fbc7dbd3db3c6f90ba68a4da5cfa259e6125d7af563
MD5 df226db3e0bb4123ee114425d619b135
SHA1 8982e45bd0925562b0eae483d5f2134f34d13e37
SHA512 4ed768186ed4a8d0c2e88df140b8060a245ffc7383420454a9370e53e35b18248d0ebe303f8e0b57396fccb6bee2cd4e2aaaa633a45e7d4cd783999bf62c713c
TLSH
T1E7513DE04C381AC1D4BD0E6FB45B79FC85ECC726F4A0347D6858EA985A7A65D318483F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

entretien.pdf

Path C:\Users\Admin\AppData\Local\Temp\entretien.pdf
Size 256KB
SHA256 b2a03b40614ff0e01292cf30f8676efa51f40958be27ddb4e2ae85e82026c5d6
MD5 c1fb1546090f089d68893e62f156e70b
SHA1 d193d6d2597042f203a07a9720ab2b6444052a44
SHA512 88c65e354398ef94e47827ffa60643c189a121056df45cb09636087d491a14df1cc18c5655121cc885fa7d3dd3772c74494910f82e970d65091565f4fd808b45
SSDEEP 6144:TsH7rIVMBlsVfjOMElc2QuBO+af3EFbMMckc4VHtajs:0nls4MEe2QuBO+00Mkc4VNGs
TLSH
T181447D32F49EBC8CEC95C78D827A349A4B2D712B95DD3885016D0B10E186FD9BB967C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fbp_pl_4492.exe

Path C:\Users\Admin\AppData\Local\Temp\fbp_pl_4492.exe
Size 3.1MB
SHA256 e892ee234a1c234bcadf861595d612d0c79f674030af35f05daa590840bcbfa5
MD5 57ebf9476fb8cd5876a39e281cf08454
SHA1 750d56701994ca9ad9bd71cf73ef53d70eb72f08
SHA512 63cd0214488e758263bd1c678b94faa8daaf6a5c83a1718fd73d36f0487628c890e9643afddb4765b6d2346350dffe02cf5c03dd245a5f71797eff94d7d8e7e2
SSDEEP 49152:OvRt62XlaSFNWPjljiFa2RoUYIYaDPEQsFkC6nLoGWLbTHHB72eh2NT:Ovb62XlaSFNWPjljiFXRoUYIYaDLL
TLSH
T1AFE55B043BF85E23E1BBE27395B0041667F0FC2AB3A3EB1B6591677D1C53B4059426AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sd.bat

Path C:\Users\Admin\AppData\Local\Temp\sd.bat
Size 258B
SHA256 10ff2538c31ed3499f718ce0e4b424ebcb52c3cf9f033cca97cc61025eba89e5
MD5 9de19cf2d60fd3ddfc1d14776b10fa6c
SHA1 b313921e28debf03f8c5f55eaf3ec02d7c8a7079
SHA512 efdf7bb41fa0fe598bd6c7f87262b8a5d518fb3568525bc6f6b164a044b221b59877f2541cd9cf167c9f9da9431c03b54ff73e697e59c2f22a11224c27d9c468
TLSH
T143D05E0056D686ACC426702BAE76869E8968784B2B122B988250DADA70D058DA4FB685
MD5 SHA1 SHA512 TLSH

Submit Download

memory/620-151-0x000000001F0F0000-0x000000001F140000-memory.dmp

Download

memory/620-152-0x000000001F200000-0x000000001F2B2000-memory.dmp

Download

memory/3532-74-0x00007FFE35040000-0x00007FFE359E4000-memory.dmp

Download

memory/3532-138-0x00007FFE35040000-0x00007FFE359E4000-memory.dmp

Download

memory/3532-39-0x00007FFE35040000-0x00007FFE359E4000-memory.dmp

Download

memory/3532-38-0x0000000000240000-0x0000000000564000-memory.dmp

Download

memory/3532-76-0x00007FFE35040000-0x00007FFE359E4000-memory.dmp

Download

memory/3532-75-0x00007FFE35040000-0x00007FFE359E4000-memory.dmp

Download

memory/3532-43-0x00007FFE35040000-0x00007FFE359E4000-memory.dmp

Download

memory/3532-60-0x00007FFE35040000-0x00007FFE359E4000-memory.dmp

Download

memory/3532-73-0x00007FFE35040000-0x00007FFE359E4000-memory.dmp

Download

memory/3532-71-0x00007FFE35040000-0x00007FFE359E4000-memory.dmp

Download

memory/3532-70-0x00007FFE35040000-0x00007FFE359E4000-memory.dmp

Download

memory/3532-14-0x00007FFE351CF000-0x00007FFE351D0000-memory.dmp

Download

memory/3532-69-0x00007FFE35040000-0x00007FFE359E4000-memory.dmp

Download

memory/3532-68-0x00007FFE35040000-0x00007FFE359E4000-memory.dmp

Download

memory/3532-61-0x00007FFE35040000-0x00007FFE359E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads