quasar | hxxps://www[.]mediafire[.]com/file/1yjvrw0sgg313ct/Account+Gen[.]zip/file

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/1yjvrw0sgg313ct/Account+Gen.zip/file
Sample231115-s66bpsbh49

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

testrun.ddns.net:4782

Mutex

fd9b8a19-128c-46b0-894c-d756c440e4ce

Attributes

encryption_key
1B16CA1138657AE4B0F5533A4344EDE1274EF9A6
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral1/files/0x000400000002239f-433.dat	family_quasar
behavioral1/files/0x000400000002239f-434.dat	family_quasar
behavioral1/memory/6224-435-0x0000000000790000-0x0000000000AB4000-memory.dmp	family_quasar
behavioral1/files/0x00020000000223b3-443.dat	family_quasar
behavioral1/files/0x00020000000223b3-441.dat	family_quasar
behavioral1/files/0x00020000000223b3-440.dat	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
6224	AccountGenV2.exe
1620	Client.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\Client.exe	AccountGenV2.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	AccountGenV2.exe
File opened for modification	C:\Windows\system32\SubDir	AccountGenV2.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
440	schtasks.exe
1704	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
5064	msedge.exe
5064	msedge.exe
5588	msedge.exe
5588	msedge.exe
6080	identity_helper.exe
6080	identity_helper.exe
6324	msedge.exe
6324	msedge.exe
4944	msedge.exe
4944	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe
5168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	3440	7zG.exe
Token: 35	3440	7zG.exe
Token: SeSecurityPrivilege	3440	7zG.exe
Token: SeSecurityPrivilege	3440	7zG.exe
Token: SeDebugPrivilege	6224	AccountGenV2.exe
Token: SeDebugPrivilege	1620	Client.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
3440	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1620	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 964	5064	msedge.exe	29
PID 5064 wrote to memory of 964	5064	msedge.exe	29
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1920	5064	msedge.exe	90
PID 5064 wrote to memory of 1680	5064	msedge.exe	89
PID 5064 wrote to memory of 1680	5064	msedge.exe	89
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91
PID 5064 wrote to memory of 1844	5064	msedge.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/1yjvrw0sgg313ct/Account+Gen.zip/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8ded46f8,0x7ffa8ded4708,0x7ffa8ded4718
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7304 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8188 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8592 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7928 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8484 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8952 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,8532255656596954111,15548302005033007030,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultdd39df81hfd00h42dahb412h108da6e54b41
1⤵
PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa8ded46f8,0x7ffa8ded4708,0x7ffa8ded4718
  2⤵
  PID:7048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8733458893989073274,17697188671683029676,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:6264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,8733458893989073274,17697188671683029676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultde8e7c4bh4896h45d2hb97fhb706bb16337c
1⤵
PID:7156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa8ded46f8,0x7ffa8ded4708,0x7ffa8ded4718
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10109311582806527630,16553875304643936904,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:6956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10109311582806527630,16553875304643936904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  PID:6944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault10de9559hb5d8h4567hb4fchd700d1b6f553
1⤵
PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa8ded46f8,0x7ffa8ded4708,0x7ffa8ded4718
  2⤵
  PID:6316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5264972163093124824,6493672727401140160,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,5264972163093124824,6493672727401140160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Account Gen\" -spe -an -ai#7zMap13950:84:7zEvent29699
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3440

C:\Users\Admin\Downloads\Account Gen\AccountGenV2.exe
"C:\Users\Admin\Downloads\Account Gen\AccountGenV2.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:6224
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:440
- C:\Windows\system32\SubDir\Client.exe
  "C:\Windows\system32\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1620
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1704

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Account Gen\How to use.txt
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b9a905fccd30fd58ec5838ea2dd8291b42b57b8205b41946275d20b0ec70e3ec
MD5 6708a30a7707944e617a857cbe566733
SHA1 536de540f8be7169f3cd6a7b6f2cb01af5688519
SHA512 1fc0ce44a32f7e7e22bd504d22594f25dd2d23d6ef8fdc0ac3c49c36f2ba9b393a6e0923c43d10a809dda881327d67a1c3e332035dd7a2152a52ad2d442127b4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b9a905fccd30fd58ec5838ea2dd8291b42b57b8205b41946275d20b0ec70e3ec
MD5 6708a30a7707944e617a857cbe566733
SHA1 536de540f8be7169f3cd6a7b6f2cb01af5688519
SHA512 1fc0ce44a32f7e7e22bd504d22594f25dd2d23d6ef8fdc0ac3c49c36f2ba9b393a6e0923c43d10a809dda881327d67a1c3e332035dd7a2152a52ad2d442127b4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b9a905fccd30fd58ec5838ea2dd8291b42b57b8205b41946275d20b0ec70e3ec
MD5 6708a30a7707944e617a857cbe566733
SHA1 536de540f8be7169f3cd6a7b6f2cb01af5688519
SHA512 1fc0ce44a32f7e7e22bd504d22594f25dd2d23d6ef8fdc0ac3c49c36f2ba9b393a6e0923c43d10a809dda881327d67a1c3e332035dd7a2152a52ad2d442127b4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 553abcdcbf24e69b64f1c6fbdf477362ad6a76e4d9e3855390349e9350a66b39
MD5 744dbe68d46ea9c7ccc78750ace0fd94
SHA1 c787c8e5c80f4776eee6623776f5e29e45654641
SHA512 631591a002706cd0e82aea35cfd962a7c8aa464bff568b213a8a3396638f831d6ced625a5ab05577c8effb77bc1d3d0a3f8410a2abede4eb5861e3ec4e99d06f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 8KB
SHA256 79a58b80c4cb17d6278b07ae0e64e144361af3a0379f467f5c91e71e88372eb3
MD5 768fd3af03af409f0c7f9aae7ec2a583
SHA1 31df52242bb28472e1ea5c8a11a1af2ac55960b1
SHA512 8b50853fdf1c49b35e2612ddf30eae5874b871673d3092e63a64615cb801335af460e05bc38e069ae1adc2158f5dec1e251eee0f98f6c20d9c9c2a4bf3bce40c
SSDEEP 192:Jcs6iTm6wwfFR1iX66VEH4orcs8ns65mk6jJu16a67XrB/W1uBTDT9lDHZovNfDb:Jcs6iTm6wwfFR1iX66VEH4orcs8ns65B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 d140017cb1335a3af49212f90381a8e275da793040b6c11c614563c17cea9825
MD5 6b3f74fa88b003b83716e09480decb28
SHA1 908bdcd5a2b183fb05c24ec7d0218963e98a12a5
SHA512 96d55ebbd2cef5f0ae9c4d1e50827929c39a58d5dbe9b744df13b62c64f66fe3c916fa35458ca33d758190359252f8c866ea8fc23bf618f046a219cf7ec9e26f
SSDEEP 192:nskN1COGWMxuKYPAziiVC0ZohXkKyxNmqEVI63V6ZqL2ZprV:nsU10W8YioVEP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 00c7d90218241519ebfd1fb1ac1fc036a5f8eee0c6061e21a3f4d519565f6f26
MD5 389069d29ecbe00cbf3389fc1dc39800
SHA1 f027ed680c6ed37e90b3a05086a9551bc04c6b82
SHA512 e869f0bf8d06c3297e5eae3f642b5fd54a7ce4adb743c5a353dee892b2be1aab1e55df8952d594a591133cb4e438414f003d87cbfa866c3a633975cba0a99975
SSDEEP 96:nakXe1TS2xwpvWMoiVmdeH5340UWQyV+VDCzia:naku1SOGWMXZJrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 09c16e6543a3626d04febb54ad1be2bd3252dcb9685593718a8d558d000a0f33
MD5 49b20c0aec50399ec55099c3c30e98b2
SHA1 c558d41cc495ca9f1d2b4935bd213d4d8b25b220
SHA512 88e4218a3e1ccad13d23580925cc94c8b952f337dadecfa15cb0aa8e65af5dddbf4dd591e315f6c427a3084711fb64ed853e9ce6921f09a85b8e6f1e0194c0a4
SSDEEP 192:nskN1COGWMFwS3NZdPAzpVekGiVC0ZYV/noh1XpkKyxNmqE1EVImO3VuV6ZqcL26:nsU10WexiN4boeVrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8f064fb763fe87d28361a0573c7c01f3bdcc269721d9f46e3a6b1a1c82d29d28
MD5 db019ecde1fc81d694f6423dfacb8ed9
SHA1 a04496acfa0614042648f3f0a42ed787cc691f82
SHA512 47d29fe348cfe16d06867416684a8d3ab28377ed7ef557aeaec4042c7540819bae3b1e127f5af9d8b7c91cdb0d6f373948f7e9b9974e17401fc5f9a62861ceec
SSDEEP 192:nsk+1COGWMFwS3NZdPAzpVekGiVC0ZsYVIW/noh1XpkKyXxNmqE1EVImO3VuV6Zx:nsd10WexiNHKeoeVr+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 23f8e9726f517bc7ed944cc1e2c33dff55cd8cb2c054b8a0245ace68e8ad52aa
MD5 e73fd904aabd59734b9a717991224b48
SHA1 5dce4bd24d63bbf2497fe1eadf5303465db86523
SHA512 94decb8023a3c57dee83d8e11005e174d272ea1887c99cc68829d2fa15e9981a5f8dd750de587c1e9007099a79f999ea77e6e713e010e51a1fe70a405fde765e
SSDEEP 192:nskddCOGWMFwS3NZdP4jAzpVekGiVC0ZsYVIW/noh1XpkKyXxNmqE1EVImO3VuVJ:nsed0Wex9NHKeoeVrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f
MD5 e05436aebb117e9919978ca32bbcefd9
SHA1 97b2af055317952ce42308ea69b82301320eb962
SHA512 11328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9
SSDEEP 768:necW3O8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwLlTTrUeUVD:necW3Ou1jadLueUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 a816d1e1f8c24545fc948d78c273f977bf8effab8625af011359f48cce6410ae
MD5 df5891d170ef9c409f1b6a96faeba674
SHA1 adfbfd413b8329d2bf58ff1c739feb5515461bca
SHA512 0a53084a914f00ec54d03e243f3c2d7936119be01e248b17dfa7ec843bf805425184109a899870b1280a2aeaab0a231ed5b6ef9e50993dbe467133fa313abf83
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 25538917492ea3a50bea33e077af14e1e6ebfd339c747219bae2e2e8f091255a
MD5 f380e8ed5c70e63a0c652db6c0755cd5
SHA1 8ca7a7cc08b7d92fbbc21d6282a0841afdb9a702
SHA512 49643c1cfed1a575177e669d822c8898054dd1534301baf41728203ef2b06b91f62b04d61b3fcba72512e0ecf9ebac49860a64caee3fee409e6405e42764339d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 6d0405dbc25ad7d3f13b8b5882e3bce55a75e1a048cdc5b61f705ddaee3d8732
MD5 4fa36d3f4f516e6210b807dd1ad912ae
SHA1 b7b799cc7a629d482705a726a59d805d0fe196c4
SHA512 fa4ee7f7e9593098027c6f26417219547c3544394f82e1a83e081edd3db08073c03f977d997f7049a1b4add81d3b50e76d65d100b588d40e75e74d5f745af0d8
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe582342.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582342.TMP
Size 1KB
SHA256 802d5964c93be912c2bd18ac53ccb1aa7fa520a39716166b6ecbf6ae6b16b1d4
MD5 fab01551178d68677a801d9bedf090c3
SHA1 86bc5ab0328d37c4c33161a577a92e1dbb7ee2ea
SHA512 d0bed7a129893911fbe702625c783b618530f4b1d59f076c5fe3ce2ffd9bb360c271caeda549db6fcb80062e5488ef63d66a88781237c4e1894123c4b8e2581f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7dda103c77fc5729425474199dfcf5c969736207da80771b7f973dade72269eb
MD5 cbf2b698a2af36d823c4dba60b0136f5
SHA1 c4f368042bd855935c218f1e6a02f002d98dc9b4
SHA512 2c2beefe22db9eab5da8f573159860071be50625ee602b2f797839fc7fa3e013ddf1a7bd9fb71a3f2c6da7d9878eb7c235bc5733cd6387eef21063f0b82fb4dc
SSDEEP 192:6oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSdZe2RUvWkbgf7leIma/d/:+9iIxuERzA83h09RZxYSfljUal
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7dda103c77fc5729425474199dfcf5c969736207da80771b7f973dade72269eb
MD5 cbf2b698a2af36d823c4dba60b0136f5
SHA1 c4f368042bd855935c218f1e6a02f002d98dc9b4
SHA512 2c2beefe22db9eab5da8f573159860071be50625ee602b2f797839fc7fa3e013ddf1a7bd9fb71a3f2c6da7d9878eb7c235bc5733cd6387eef21063f0b82fb4dc
SSDEEP 192:6oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSdZe2RUvWkbgf7leIma/d/:+9iIxuERzA83h09RZxYSfljUal
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 29e1c99ed4ab29bf4a71be85bc5472b2442ede61c5c199ac2434cdc80614e1ee
MD5 61f34184236ba4a7811dfffb8fbce54e
SHA1 01b9cab4ab1ab2256d9d510b9a9c8158e5890a3a
SHA512 245b35ad659bc57c6e3b6ae4df50124616dc4765e8205164fec188e4a7bbdcbbdad8bb7aed4c1b5716d968a9d699678b3ec559dbaa47fa6ba6d1b869a03d807a
SSDEEP 192:6oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSdZe2RUvWlBoxubgf7leIV:+9iIxuERzA83h09RZxYSfsx7jUal
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 095239af48e0002a5689e4f80743ef4c399bc89642eee31967cd52a2902b2bfc
MD5 7fa05bfcaf957057a14c3697cde4bcb3
SHA1 dfa5f14f70714fa9bb93fa73de709e017b84462b
SHA512 6600ee862e63112564db91c6b769224e0e3ad01e2ac2c4633356b62b2c01f33bc09cd40488644b37b3cbe9b6f34e2a59d5ae267ab11da165c6cbba7ad23183c9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupLdme2RUvWNgy7leIma/d/:A9iIxuERzA83h09RZxYLOm8Ual
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a99110f5ad91b351b5ee1c0c7e0118d326f915ac883ef0b543cfd8da0b7ac4bc
MD5 50b879d920b384cd5efbaccc7e594e5c
SHA1 2a6e3134447607eefaf40772fac4f5e79eeac3ff
SHA512 94bf77a850e7051d7cf716dddeab5ac428c300e2d6346b5d1fea18c25eae1c5aa3dd708a2568514fc8b918b528dfb8b596a8169a372ed58c8da29a1dc71b0149
SSDEEP 192:6oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSdZe2RUvukbfx7leIma/df:+9iIxuERzA83h09RZxYSfiVUal3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2b0859cc1ccb48da47c9272eaf6a866295e2551c45c57f100c1d727a5c6e68e1
MD5 06b5d437d2197d34c0a9c04881f9b268
SHA1 d3d09ea2321fa6662fae383c3671e9aba0b298a0
SHA512 c4b4ef3fa06eb1d877f6b32713497433e98b760f91e3117344f19e0f799ccd96fb87118e962e5b4c27a73ea74d1368c5df0f3edc26ae7caea3f411edc11132b1
SSDEEP 192:6oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSdZe2RUvulBoxubfD7leId:+9iIxuERzA83h09RZxYSfsxs/Ual3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 382011daa9a2ff6f45bedd0cc220de17ff9f8698c0553f4be41717efd10b17d5
MD5 30ae29c3bf0cb0247e8df8c4b05d0359
SHA1 57edb53a0104d255a97cd8a83503c2dc599116c0
SHA512 b113dda64fffc025aae5cdf73d9aaf214dd55bcdacadd7af595c52fdc605cffdfd7e296f56fa7267cb798441f458d8b0d405a101aa2708890a11863d258df3ad
SSDEEP 192:6oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSdZe2RUvulBoxub+K7leId:+9iIxuERzA83h09RZxYSfsxtkUal3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 db497f543fd78c3eccdcaa3224dd71c1b813f5e6005122e365ac2850f0a4a8bd
MD5 240222a7bb7d9a3901e485abcd15af40
SHA1 385c23918f2f163b5ef59ecb807988e48350136b
SHA512 0b99485017726d5a781712651eda6dc8a3d9205dfabc561d1174be79c06bc745f73751cb59d5a26767ba4fee9f3c8187cd5413036d156a4d993850b9ae331b45
SSDEEP 192:yoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupLdme2RUvWNgg7leIma/d/:G9iIxuERzA83h09RZxYLOmKUal
MD5 SHA1 SHA512 SSDEEP

Submit Download

Account Gen.zip

Path C:\Users\Admin\Downloads\Account Gen.zip
Size 1.2MB
SHA256 2662a59faf074abd357ae710b362fc15ac13afa8b028f82852c7ddbe634366cc
MD5 384b49426968c43151f6721e55f72cb3
SHA1 6b40377a02117f66138cfdb6252e63507c639184
SHA512 1fc03eae22f67ee2c3628e492d81a35c5a53b29c250b1ec14520ceaae1651e2df85302abb114148bfac286c9852e45bed7e66184fbe3e479b88f2cb8b1286456
SSDEEP 24576:94+5wmhcnpEpAidGFuy9idk3EIg/oSw+mJFgtZMqg+HeRbYZy3PUQynL:94N8cnpEqidGFX986/gc+oevfg+HeR0p
MD5 SHA1 SHA512 SSDEEP

Submit Download

AccountGenV2.exe

Path C:\Users\Admin\Downloads\Account Gen\AccountGenV2.exe
Size 3.1MB
SHA256 bfe73168debb53dae9f90c4b5dfbcf0508c83716a15cad7b634f868bbd0f6438
MD5 b3d01e7505bc74ff5fe3407638da4242
SHA1 6cc7bb4fc57fa861aaec61d472d3affa85293b26
SHA512 7c676bcfdb61e89a1cbd53bfd1fa3e1b208d272a67b2017c03f5c7e805cc030ddf6d18d75b701161eaacb565d51fd01b5722d9e90856ba88812a6bf83f247ec6
SSDEEP 49152:CvXI22SsaNYfdPBldt698dBcjHHmDJERH+k/OgVoGd1NTHHB72eh2NT:CvY22SsaNYfdPBldt6+dBcjHHmDlOF
MD5 SHA1 SHA512 SSDEEP

Submit Download

AccountGenV2.exe

Path C:\Users\Admin\Downloads\Account Gen\AccountGenV2.exe
Size 3.1MB
SHA256 bfe73168debb53dae9f90c4b5dfbcf0508c83716a15cad7b634f868bbd0f6438
MD5 b3d01e7505bc74ff5fe3407638da4242
SHA1 6cc7bb4fc57fa861aaec61d472d3affa85293b26
SHA512 7c676bcfdb61e89a1cbd53bfd1fa3e1b208d272a67b2017c03f5c7e805cc030ddf6d18d75b701161eaacb565d51fd01b5722d9e90856ba88812a6bf83f247ec6
SSDEEP 49152:CvXI22SsaNYfdPBldt698dBcjHHmDJERH+k/OgVoGd1NTHHB72eh2NT:CvY22SsaNYfdPBldt6+dBcjHHmDlOF
MD5 SHA1 SHA512 SSDEEP

Submit Download

How to use.txt

Path C:\Users\Admin\Downloads\Account Gen\How to use.txt
Size 240B
SHA256 af6d58938ade305da27ec0396b5b88e98a8d29d22f56ea2d3dbc09bf49ecb5c6
MD5 0483a15dc5bcd9efe0ec04d28ac5c909
SHA1 8a1fc3fcd4020f43fc7dd928cb4b5a70b3b9d95a
SHA512 bd50e2261c97d6979be28a3903806aa397855cc1fbfe733adf323a4eab6f43404ddbbb270a7554d2779080727ad1d23fc2ad2db9c496069ab5746ad4bc53f659
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 3.1MB
SHA256 bfe73168debb53dae9f90c4b5dfbcf0508c83716a15cad7b634f868bbd0f6438
MD5 b3d01e7505bc74ff5fe3407638da4242
SHA1 6cc7bb4fc57fa861aaec61d472d3affa85293b26
SHA512 7c676bcfdb61e89a1cbd53bfd1fa3e1b208d272a67b2017c03f5c7e805cc030ddf6d18d75b701161eaacb565d51fd01b5722d9e90856ba88812a6bf83f247ec6
SSDEEP 49152:CvXI22SsaNYfdPBldt698dBcjHHmDJERH+k/OgVoGd1NTHHB72eh2NT:CvY22SsaNYfdPBldt6+dBcjHHmDlOF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 3.1MB
SHA256 bfe73168debb53dae9f90c4b5dfbcf0508c83716a15cad7b634f868bbd0f6438
MD5 b3d01e7505bc74ff5fe3407638da4242
SHA1 6cc7bb4fc57fa861aaec61d472d3affa85293b26
SHA512 7c676bcfdb61e89a1cbd53bfd1fa3e1b208d272a67b2017c03f5c7e805cc030ddf6d18d75b701161eaacb565d51fd01b5722d9e90856ba88812a6bf83f247ec6
SSDEEP 49152:CvXI22SsaNYfdPBldt698dBcjHHmDJERH+k/OgVoGd1NTHHB72eh2NT:CvY22SsaNYfdPBldt6+dBcjHHmDlOF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\system32\SubDir\Client.exe
Size 3.1MB
SHA256 bfe73168debb53dae9f90c4b5dfbcf0508c83716a15cad7b634f868bbd0f6438
MD5 b3d01e7505bc74ff5fe3407638da4242
SHA1 6cc7bb4fc57fa861aaec61d472d3affa85293b26
SHA512 7c676bcfdb61e89a1cbd53bfd1fa3e1b208d272a67b2017c03f5c7e805cc030ddf6d18d75b701161eaacb565d51fd01b5722d9e90856ba88812a6bf83f247ec6
SSDEEP 49152:CvXI22SsaNYfdPBldt698dBcjHHmDJERH+k/OgVoGd1NTHHB72eh2NT:CvY22SsaNYfdPBldt6+dBcjHHmDlOF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1620-445-0x00007FFA783A0000-0x00007FFA78E61000-memory.dmp

Download

memory/1620-446-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

Download

memory/1620-448-0x000000001B860000-0x000000001B8B0000-memory.dmp

Download

memory/1620-449-0x000000001B970000-0x000000001BA22000-memory.dmp

Download

memory/1620-450-0x000000001B8B0000-0x000000001B8C2000-memory.dmp

Download

memory/1620-451-0x000000001B910000-0x000000001B94C000-memory.dmp

Download

memory/6224-437-0x000000001B8A0000-0x000000001B8B0000-memory.dmp

Download

memory/6224-436-0x00007FFA783A0000-0x00007FFA78E61000-memory.dmp

Download

memory/6224-435-0x0000000000790000-0x0000000000AB4000-memory.dmp

Download

memory/6224-444-0x00007FFA783A0000-0x00007FFA78E61000-memory.dmp

Download