quasar | 0565d80022e4035fe21f5fa489a866fe24b9bbcd58e68a82f61df89aec623ee8

Analysis

max time kernel
807s
max time network
769s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
22-11-2024 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Foto DC.png
Size

1.4MB
MD5

0ab308fbdda54c8fd7c04b7e0c0fffb4
SHA1

7a0bbe6f6f943e97fc47224505587549c7d6df1d
SHA256

0565d80022e4035fe21f5fa489a866fe24b9bbcd58e68a82f61df89aec623ee8
SHA512

5866b071e8838a5d4b6e31bf01d70acbefb70a2ee3d6f9ffd9b1e820f5d2e27f2c1fef33c0f517025df4b8bbad9d9928f913a4fbe0ed634a6d0f5c6d89030437
SSDEEP

24576:kvghhDIDQ57xL24Vr62E1KOvCG2USqro2F5HGa3chp0tRPb64GHwxnt:OwDI857xL24OKOv+Zqc2F5MhpQRPG4GS

Score

10^/10

quasar office04 discovery spyware stealer trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
5000

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

10.127.0.210:4782

Mutex

QSR_MUTEX_VxGlxWsqilIBkKwFHx

Attributes

encryption_key
9Dda4rNsdoW46bMmjQZV
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

10.127.0.210:4782

Mutex

6935cf5e-d059-43aa-9ca1-b346ab9507bb

Attributes

encryption_key
E9872268753A7D72DA867CBC7D6208F50BD3F8EE
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 12 IoCs

resource	yara_rule
behavioral1/files/0x0004000000040d12-975.dat	family_quasar
behavioral1/files/0x0005000000040d1a-1068.dat	family_quasar
behavioral1/memory/3736-1070-0x0000000000450000-0x00000000004AE000-memory.dmp	family_quasar
behavioral1/files/0x0009000000043c47-1191.dat	family_quasar
behavioral1/memory/5680-1194-0x000001A625060000-0x000001A625198000-memory.dmp	family_quasar
behavioral1/memory/5680-1196-0x000001A625690000-0x000001A6256A6000-memory.dmp	family_quasar
behavioral1/files/0x0002000000043c2a-1195.dat	family_quasar
behavioral1/files/0x0008000000043c21-1264.dat	family_quasar
behavioral1/files/0x000200000004440a-1369.dat	family_quasar
behavioral1/memory/5408-1370-0x0000000000090000-0x00000000003B4000-memory.dmp	family_quasar
behavioral1/files/0x002c0000000452db-1440.dat	family_quasar
behavioral1/memory/5052-1442-0x0000000000D90000-0x00000000010B4000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\Control Panel\International\Geo\Nation	Quasar.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\Control Panel\International\Geo\Nation	Client-built 3.exe

Executes dropped EXE 8 IoCs

pid	Process
3276	xRAT 2.exe
5052	xRAT 2.exe
4500	Client-built.exe
2792	Quasar.exe
3736	Client-built 2.exe
5680	Quasar.exe
5408	Client-built 3.exe
5052	Client-built 4.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
99	camo.githubusercontent.com
100	camo.githubusercontent.com
101	camo.githubusercontent.com
102	camo.githubusercontent.com
104	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
205	ip-api.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\01fe7bd4-0eba-4949-bc02-6260fc7c4325.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241122225728.pma	setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client-built 2.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1260	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4780	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	xRAT 2.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	xRAT 2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	xRAT 2.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	xRAT 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 0100000000000000ffffffff	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	xRAT 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000be2aeb145625db0137cc72ff313ddb0137cc72ff313ddb0114000000	xRAT 2.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\MRUListEx = ffffffff	xRAT 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	xRAT 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	xRAT 2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1	xRAT 2.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	xRAT 2.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	xRAT 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000030000000200000000000000ffffffff	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	cmd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	xRAT 2.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 6a0031000000000076598bb810005155415341527e312e300000500009000400efbe3c49b27576598bb82e0000000a0d0400000005000000000000000000000000000000a269c0005100750061007300610072002000760031002e0033002e0030002e00300000001a000000	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "5"	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\NodeSlot = "4"	xRAT 2.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1260	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3416	explorer.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1980	mspaint.exe
1980	mspaint.exe
4912	msedge.exe
4912	msedge.exe
3168	msedge.exe
3168	msedge.exe
2792	identity_helper.exe
2792	identity_helper.exe
5612	msedge.exe
5612	msedge.exe
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe
3016	msedge.exe
3016	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
3276	xRAT 2.exe
5052	xRAT 2.exe
2792	Quasar.exe
5680	Quasar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeRestorePrivilege	6140	7zG.exe
Token: 35	6140	7zG.exe
Token: SeSecurityPrivilege	6140	7zG.exe
Token: SeSecurityPrivilege	6140	7zG.exe
Token: SeDebugPrivilege	4500	Client-built.exe
Token: SeRestorePrivilege	4556	7zG.exe
Token: 35	4556	7zG.exe
Token: SeSecurityPrivilege	4556	7zG.exe
Token: SeSecurityPrivilege	4556	7zG.exe
Token: SeDebugPrivilege	3736	Client-built 2.exe
Token: SeDebugPrivilege	2792	Quasar.exe
Token: SeRestorePrivilege	3532	7zG.exe
Token: 35	3532	7zG.exe
Token: SeSecurityPrivilege	3532	7zG.exe
Token: SeSecurityPrivilege	3532	7zG.exe
Token: SeDebugPrivilege	5680	Quasar.exe
Token: SeDebugPrivilege	5408	Client-built 3.exe
Token: SeDebugPrivilege	5052	Client-built 4.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
6140	7zG.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3276	xRAT 2.exe
3276	xRAT 2.exe
5052	xRAT 2.exe
5052	xRAT 2.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
4556	7zG.exe
2792	Quasar.exe
5052	xRAT 2.exe
2792	Quasar.exe
2792	Quasar.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of SendNotifyMessage 53 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3276	xRAT 2.exe
3276	xRAT 2.exe
5052	xRAT 2.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
2792	Quasar.exe
5052	xRAT 2.exe
2792	Quasar.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
5680	Quasar.exe
5408	Client-built 3.exe
5408	Client-built 3.exe
5680	Quasar.exe
5408	Client-built 3.exe
5052	Client-built 4.exe
5052	Client-built 4.exe
5680	Quasar.exe
5052	Client-built 4.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
1980	mspaint.exe
1980	mspaint.exe
1980	mspaint.exe
1980	mspaint.exe
5052	xRAT 2.exe
2792	Quasar.exe
2792	Quasar.exe
2792	Quasar.exe
2792	Quasar.exe
2792	Quasar.exe
3416	explorer.exe
3416	explorer.exe
5680	Quasar.exe
5408	Client-built 3.exe
5680	Quasar.exe
5680	Quasar.exe
5680	Quasar.exe
5052	Client-built 4.exe
5680	Quasar.exe
5680	Quasar.exe
5680	Quasar.exe
5680	Quasar.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1980	984	cmd.exe	84
PID 984 wrote to memory of 1980	984	cmd.exe	84
PID 3168 wrote to memory of 1904	3168	msedge.exe	96
PID 3168 wrote to memory of 1904	3168	msedge.exe	96
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4008	3168	msedge.exe	97
PID 3168 wrote to memory of 4912	3168	msedge.exe	98
PID 3168 wrote to memory of 4912	3168	msedge.exe	98
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99
PID 3168 wrote to memory of 1524	3168	msedge.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Foto DC.png"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Foto DC.png"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ConvertToSuspend.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ffc693146f8,0x7ffc69314708,0x7ffc69314718
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7b3365460,0x7ff7b3365470,0x7ff7b3365480
    3⤵
    PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2000 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1940 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1776 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,14247335118491826490,17392007855522049017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5868

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap22888:92:7zEvent6333
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6140

C:\Users\Admin\Desktop\xRAT 2.0 RELEASE1\xRAT 2.exe
"C:\Users\Admin\Desktop\xRAT 2.0 RELEASE1\xRAT 2.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3276

C:\Users\Admin\Desktop\xRAT 2.0 RELEASE1\xRAT 2.exe
"C:\Users\Admin\Desktop\xRAT 2.0 RELEASE1\xRAT 2.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5052

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5700
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:4780

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.porn.com/
  2⤵
  PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ffc693146f8,0x7ffc69314708,0x7ffc69314718
    3⤵
    PID:4216

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap32514:88:7zEvent18921
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4556

C:\Users\Admin\Desktop\Quasar v1.3.0.0\Quasar.exe
"C:\Users\Admin\Desktop\Quasar v1.3.0.0\Quasar.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2792

C:\Users\Admin\Desktop\Client-built 2.exe
"C:\Users\Admin\Desktop\Client-built 2.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap30258:84:7zEvent31639
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3532

C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe
"C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5680
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12"
  2⤵
  PID:5376

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3416

C:\Users\Admin\Desktop\Client-built 3.exe
"C:\Users\Admin\Desktop\Client-built 3.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\x9s6t92EbQlI.bat" "
  2⤵
  PID:3656
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4984
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1260

C:\Users\Admin\Desktop\Client-built 4.exe
"C:\Users\Admin\Desktop\Client-built 4.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\xRAT 2.exe.log

Filesize
580B

MD5
83393c2da93cee4fa46221b486aa5ec0

SHA1
c9c980e5a5d8bb91eb89f18293fe4b4716430d42

SHA256
e167dd5d5ee239573981b7917fbaa402ff593a392bc5e953ee1b8081d6e6a6b2

SHA512
8ca57830556a3ee801bf8386f34c6d485ca2f8120e0a6e586054cc8543873514d0aef110f49c5f1f5bba446b37228aa6ab9d90d74e79c1ca01ef9fabe8956fc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Quasar.exe.log

Filesize
1KB

MD5
b08c36ce99a5ed11891ef6fc6d8647e9

SHA1
db95af417857221948eb1882e60f98ab2914bf1d

SHA256
cc9248a177495f45ec70b86c34fc5746c56730af36ace98ac7eb365dbafda674

SHA512
07e62581eace395b0a9699d727761648103180c21155d84ea09140f9e1c9690705c419118545aa67a564334bbde32710225fe3aa92b0b4b4210cb91f0058b1ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
467bc167b06cdf2998f79460b98fa8f6

SHA1
a66fc2b411b31cb853195013d4677f4a2e5b6d11

SHA256
3b19522cb9ce73332fa1c357c6138b97b928545d38d162733eba68c8c5e604bd

SHA512
0eb63e6cacbec78b434d976fa2fb6fb44b1f9bc31001857c9bcb68c041bb52df30fbc7e1353f81d336b8a716821876fcacf3b32a107b16cec217c3d5d9621286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cc10dc6ba36bad31b4268762731a6c81

SHA1
9694d2aa8b119d674c27a1cfcaaf14ade8704e63

SHA256
d0d1f405097849f8203095f0d591e113145b1ce99df0545770138d772df4997f

SHA512
0ed193fdcc3f625221293bfd6af3132a5ce7d87138cd7df5e4b89353c89e237c1ff81920a2b17b7e0047f2cc8b2a976f667c7f12b0dcc273ddc3b4c8323b1b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39e172e21217c0371738d7559f70a391

SHA1
404e8c79fa39d993a8002dfafdd8fec7abf8f38a

SHA256
83599797c28630630d73ff04bcba53fca86475204af5dc4074f8336713452dd0

SHA512
16fe59d18d3c200dad9224d6701abcc8a5e53089be7301d18d9adc0763518194e0aff038f1f2d294d9ca32e51b0d949cebdc5c9fd0d0a5b943d1c98c4fabe5a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c9813afd3feacfafe406e3f883258fc6

SHA1
e05973111972d0ed9e532631d0c02bc275d0e457

SHA256
3dfbbb8885b5e48868eb7ae37c0be37ed491baf04c17b6a572d439b95c0f88dd

SHA512
e30863a8a2d35f568fdd692ff7e902c8cc4c6ecb0e9b3470b6ae59de84596f35f5e9f137ac29f1fe9506162a6604ee5112a4ba9d328dbb341ec02fe7bd96513c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
bd72fa57f19caeb4a56ea03bd8296e4f

SHA1
f524c8ea0934a92c3dab8ed2aa15435e554398ca

SHA256
2861bcbea2c15577447df67bde23c3d17392353b1f8038b03692cf344cf9791d

SHA512
99cf18e2be3e5730ed2c46fca1d5e43e09ace85c62528231083ee96decc03f25eccef5838660c76a902d8ed3a4e3c3483c759346b487e76265b3b00fa861bcc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582769.TMP

Filesize
48B

MD5
c930b455e5ca1abf204bc09ff28622b2

SHA1
68647a59206b3ee96c5011edec2b9d96a5de68fd

SHA256
2b5b4bfc107a6a6b6f98876f9f93a607575c2304b19e3f7734c466abf8c8998e

SHA512
0d195531f202a7dc9caa2ac66159cdaa6ad02aa52bbc43960f0dc8e134b70744dd64fd30074398d4a63dc9f702cf1038779f5f904fe3a9b18ab75b6f20dcdfaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d695e54171047e68135c232c2d37c41c

SHA1
9b7e894a0a6d99ee5ea38f11b08a656d6044c72a

SHA256
8dcbe3a813c1280a2e4cc6502f0b203571d41fb6502ec6935546a177ee90f092

SHA512
9fa627ba3b6e2475c9678781b5c0fa1283ad57fb1b135659869e9d8861f409ab0232c7fabdd75a47515994bc0f50a862309f9646bb9ea18c7fd102ac337d8349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1384e2a0bac4e1c9e072bfdec9947421

SHA1
814ed5258a56ae101d0e2edf00314bba9a690e9a

SHA256
b7cb10edd56e40e2d7067a12c71d32d52686cd6d36a646e0ee76353b3472f978

SHA512
6a689aeb05ac61f90c0c364c61c6d134c82a98ade215b467c92eb428a22b025de43afb6f06625cac5142557ac2a3ff93ff333c86f01cd0173312b95e141b5f2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
16cedb26c1edf9052a593d9285dfa4aa

SHA1
65f6977039b6f67367d708b0655903939e94647e

SHA256
1fa39e118a7947f3b56b628436abf69627e8ef0cc682ef580d05c0baaae0a6c4

SHA512
2ff4fce0c39038028e0592c984d9ef5f4bc0cff82707539cd8e62fa934ae20a9a41aa8256424ce51ae3b7cc0e1152733742453714c52b302ff1ac2a0eaeafaf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
24a81d282c540f4ef8fed904e6a20b69

SHA1
d230e3b801d624a68773281c9ffbb21fe2c512c5

SHA256
448efffd6524e4cbd4ef3034e68482fe85759d3e110db255c3cafda639924e4d

SHA512
e20838cbad07b927aa6aee24d32a349d3a729ba5d9ccc468077caeaae11c45f9090a97b24e02c79f0d4f17a7ba3039afdd56715b61b28b2fcd8204ffcb7cd152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
944B

MD5
2a52902b3668544a7e7b18c7419ecc90

SHA1
75805e19bfe8502227860cba4df29a12dd204ec5

SHA256
48fd31d283153ffa94ae1f666038cb8136f3f8524e397e24b7ef156b335c9964

SHA512
94e0bd3604d7b1f35b1c0db4ecd217804047a370979437de6892e6234a19f383a698d5bd9466f6466d7a308dd9b2ad47b0095543831b2c88c269cbf2ac6cbba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58ac77.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ddc9e5ba5fbe3887821d4f91b4aad1d6

SHA1
e52700579eeb089318db4f2727429d63f304c0e1

SHA256
6597bca1e9e67be64bc28924fab8f7826309584298565de45ef4460645c825e1

SHA512
e5835afbc18d19f37c32ddf73dbe9a8c0112523375d8a73a01b3e4870b9f5a5fd59e37ef4b5d73f5b8ba8f8af946e3bad62f54d7dde744ef54772f0c54eb0390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cb18bbdfa8a762fd33ee617d2ecbc82c

SHA1
e3b16a02f5a6475900ad1959de418b836c35926b

SHA256
cc5f0c14e0e037919875e64f9fd275cf93c5f10dc9a5c06e355b49d6d5f5a78b

SHA512
e2153ed5a2fc27cbfd853444452a102a233170ac94f18bd07c4eb2203db18b12ade4da2396666f65f9118091de78fa22fbcdb462b1e19af45eb04be7fc8b6cd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c2800a0b5d2c8f40c523df8f756a990d

SHA1
8d3ad12ae7412cbdf1ffe9946145e39b403a50f4

SHA256
53e40a026286e2ab0c23123daf3830eb040028f88279663bf822e9226c30f156

SHA512
71addfabf71728327a53d328e0079303b52e08cddab1f5265b7be8fdd6b359aa429dbd9ab91b523f3b62ed19654e3da4a4f45acc12ba68044622ba71509516a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19f74cf10df3002abf0fbce146c821dc

SHA1
9a566357127130eb23d2a67f8d764092ed16e3a2

SHA256
b5e629cba207a879e759567583498c5f473cd1fc5e5b8c15057325ea93f84acb

SHA512
c52aad8ceda28a0e6714ebf29592cca0572fd49109cbd541f8520d19b439e12c4bb00a25b6ac1b11c2abbe26c940b10ebd97c0edba3181fa178ed739d1ad026a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
6db8acbf8ea7c92fe64aea0c03290351

SHA1
f389caaae167b9421fd277d389c445607c903177

SHA256
a8f26f9814ec790af667ba9310d807dd3219e3e3253c1e621aa18b406651a273

SHA512
ba12ffba8baf5177a00a6c0d97ef52befccb8cc975d84e5a267ceaae40092771c2955e0cb43f3d76f662bf675d3f82776b0f071715f7e738c2f1142671652bf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5fa126921284fab91d7a414f228a5d62

SHA1
e131ee7b1cf112951d02005e97e4cc41ce614df1

SHA256
fa31ce6423c8b18f69e0b71a7c80dfdfdd32c38b78279ea94d723231e1675e38

SHA512
0ca305f713da33a97ddc67559d430db59d351eb92cbccb688c0a458d7f726514df9af2adc4a9f0ff2651af6492df2a63b6de225b07ef2e4b92780d8cfde60ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35988007b5506811104856c39606e9eb

SHA1
6bd7b5becff5414838682140f5be4eff0b71e472

SHA256
ea51d7898a274ccb63e208e890dd298ab7b60d7b6a6f79ad80bdee88922a17f1

SHA512
e15e8f417c3c25aa522a757cb659b648425346e3ac53448ae7681c069f3f1a4b40e13d2b3e181b0bfe114eceb81e7a677bcf2aa996b3bc2fd6636ec9ac7729c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3b964859deef3a6f470b8021df49b34d

SHA1
62023dacf1e4019c9f204297c6be7e760f71a65d

SHA256
087debdcfba4666c03a5ea699e9bb31cf22ef4e0fad7c961cb0b500e5d262fb5

SHA512
c30b7e1b28820a5815b52634b46cb210c241704e33e41304400cb3ed29e82ec547a1068fc819350b368456bcabd27034afade5add3251dc74e4174f51b6c7adf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5c2d5c900312f44e72209416d45723cb

SHA1
68fb8909308589149399c3fb74605600833fbbc1

SHA256
56f7a77549e5fc45bd4b1f7c2db3e8b4bd1dd9234545207613a80342cee8e7d8

SHA512
07c2920cff7c1125e3a2fe66bf21d8606a1f2a3d36be2d8e136da0d2a21130242ac8324f18cedfb0040304cf804815861767c969a6923d8db851312bf9b4348b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aa2e3f1ea2945dbb2117f4326f173d56

SHA1
0fc18f0d6e2ff832b3a92ff096e401a93d4f8104

SHA256
6ef732b8c9ac81b9d8580ec45de7b34dce21bd03d25f1e24f30556b8a598c437

SHA512
86f1ec384b73441bf31fd757d99e1f8fc71631d00bfd0275c60707b4b70f2fd703fa42dc91e4abc2c39815e04ecf8a77f8591e31b9b5f4dc3f2e0902c16319fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3bd5f2d3decb20a3413ecc644f6927c3

SHA1
971a2f763897721e41ffd48a2492fdd57ca8bb95

SHA256
4b509cd996ac0fc8db4b4ac5fdf2625376ae57896850b6f9db649e34cb2fd46d

SHA512
f93e5ffaebe2b012755a6244762df51fa2953cabeb74a9241da5bb8a70409ff1d181284369b97055626dc6b4c3df72357f81ec2c5d3a59b51009c0c97d9ce5b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2d58768656832b5ffb9b0ca3f42004b4

SHA1
a43e8ac603ffa8d573f9b3c0caf6e415022d3e11

SHA256
2878089b76141dd8620cec52be4b3b8ccd44f8aded9beef274fdd422d35249e6

SHA512
3bdd70dcee5f8efef894bd09ef8d4fa504f4cd3662ae1a60a1ef39863ab36f067c2db113887504ca480108d656f6d6de15a5e0936b87128e49afc08682eb7d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
70dcc58468798cf6f30027920ce5725d

SHA1
1c6f2f38ed324660b4ab4934c0c00671872aa3f9

SHA256
88e9009698efe70a9c84cd3c1e46d865a0083ea545939d41bd16fca9214cedd4

SHA512
ddf81984d85487296c99a703a07dcc9c75ddc5abb5aaf287f0e317ffa497970f374305fbc839a94f05a3fdb6a9e71080f8072f3a1500220c16adc6b46cf3dde9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d2e4447319e9419cd6aadc8279d4704b

SHA1
b3a46577ecd6c3ddda644730760bdf099cbc5046

SHA256
8d887cfdb67c893297ee870ac1b066a0df00f38e26df43fd6690d94fcbd3afb1

SHA512
6774614a2daafcc0f6d8cff53ab949a166ac485f1eaa1b194e1f45176e947204d0b42d339c0a1e84e44606e60dc44857138501f0e18f94b787aa381384273a0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
57a179dd35fb4e9b40f271bd1c52c615

SHA1
f31ef47f023b6d0055db7f940d21ee676d16bed5

SHA256
8de597a3ec4a44c750483e0ad4ae8baa28aabe09ac3d1dec9debd2cc9d70f152

SHA512
2e7c2431965c294c73b8dd01e5fe02dbd12126b7b8cb9e05a7838d771a6e5553d814af0a63aff14c7fdde51e9450640ed6fc738d405be0c985d59c0326f59da3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
713449e7f13f297b45437401e344959b

SHA1
e16a510f8bb6d7a4a600999118cd279817bdc4a7

SHA256
06925cb5143d39f19c9e095da08eb9d20ff6223cdd80434988ee4381eb502572

SHA512
7ee1f16c5d87f4e205cbbc796ff4743d6bbba829d3e210fff8b5f8230e6b802d723a59200a5b8a65ea2066596db2db4fbb6c2491cafb457c1a690d5d05d289d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8f478ab45660071770c101c75b870f4b

SHA1
50665be52d6fc5d71a996fca37f849d4eee2fc21

SHA256
ccc605852057bf5fa782a2603f98fbdfd9260ebf83858b397ce1ad0c039a0703

SHA512
415eac0b43702d47df5a9522fceabe08f4fb5c16c8624a85150c56449b877289e2236e29f3052b25e4767c97b9f977e559bd638e30a741d8a2818480744d916e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ece0.TMP

Filesize
1KB

MD5
526ade218ec9b2f01fafcec7899abdfc

SHA1
6772def4cf3c4e4b50c24a6738e1ad65f013b435

SHA256
85e225854d9e8eafe82a5317d14fa7e832662b8a0bccd72433cae52a82b4cab9

SHA512
21c42f9463b7aef12fe62a6414ad912a9a2bf8e0a480c280b52df8d8376053be9c7db2e9e3ef5ff108d2a10732aa14b9a48fff8f8ff8739437434371beae4148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4e898940a9d025bd090a6f7ad6334621

SHA1
69d7fad1f7850d1c604f990f0e9b09338d6014b9

SHA256
13fc391a4929bd94b82969b8abceae34f2f8b3815597b206976f6eb1d4607a84

SHA512
74a965d31651b4528d91e625504faef86932e6731057fcca352b7d13db3cd84b6639c5941570bf964f01236cf7ab4a5bef6b374782244bc4a6c28b08d45459d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
404f45484e343086f4b89d8b796f114f

SHA1
ef6d8ffd930325dbe74ee315b0465641c6571653

SHA256
61a4fb7fedb10954435c5b824538efa89a527723dee0137526b0d9a242d0d860

SHA512
8e14877acf81e4577b05b8ef17c1b3af42b9861488cbae95084265dee3a4f1c149ec0f63ed3bfc1a3e0bdce6f409a7c84ca5111ba98b56d7399e307e6d268df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
93cd7f4b331a02117a985483351c56c6

SHA1
15ab9e27c6e80658f2391f89a93e3e027a539fcf

SHA256
89793be929a45f61b05cbbbcffc374feb9c9402a4ab097c6a91714dafe69df3c

SHA512
43bc8f5c64fc595a2895e9531e3d65ea80c78e39427e8e675961da26aef16ca130fe7077a56a196a0334892f0dc3e09bd1e90c179b5325c3d1ff79b8538958e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
239ce3356ab81e617cc1bf6f3e0aab09

SHA1
2340e67b9c17d0159e7e724e7d73f3607d5334ea

SHA256
c790e917ffc1d78bdc5d9ef9ec60ad15afbfd707c1c0d8f4eaa192cc1f9ba470

SHA512
db8cf9f8a91f3d90b31df23ef62b2232808b48672929750c55153557c7954c62889f7331d68efa1f07aabb2c89730f2f24775d660dc3ebb40144ad1b1e97f839

Download Submit
C:\Users\Admin\AppData\Local\Temp\x9s6t92EbQlI.bat

Filesize
204B

MD5
b501d48f544a825016c9cc4e584476d6

SHA1
cc283a939ee5165f921a8ffa0405977760a0e36b

SHA256
5d8a1e83f6c70a754c43914ccce329fd881eab9f00a2b67a1d81b7cb6664074f

SHA512
083f82153214e56639586c8387b6544a65da1a0f2d3b24a467bc658d684632e922481b07503311f3e84a4bf04cea1463a221242af9e01953251e79845dbb3e02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4152190078-1497776152-96910572-1000\051cd745edcaf47c27271fbd7cdc0b56_2c66422d-2e9a-43a2-ba7a-ba47156abb73

Filesize
3KB

MD5
520ea4b381adad089c6e3b6440fa57e0

SHA1
5c20d49cf1e827bd08f2e1ae6ba4d2fd3f18cf27

SHA256
9be8ef499a1615e6030fc3bc686a72c2fc17c39ef2096cee4d00b0bfac519035

SHA512
c8048fb5069ad22460531df03c877f97734cd704ba57bcc3fe081df340c406b08d52a82a5fa6775a546f67a621e82503938dbaabbed784cd191228229af3ca05

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
52c467ded3c5231049e7abd15d7dd5ed

SHA1
841c993d1a758c357826cd1f45b60ec9d4cb1c79

SHA256
2ddb6818ed67c1640714fddd6b5c5cc3d1e32cf999a08b9ed4ddc7e5028388c7

SHA512
f90e3d1bd8d18553a4a650fec3f5e38c7b383972ee5d46ed80e1fad6754847d2fbba1a57f97a0477caef8cd4db74d8a2a1bf1192c72fad24c66045c0ad8bbf72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e93b6fc6551483764801a6d8f944cfb3

SHA1
6980d9f0d06f005e1df499640047d9fa69c3399c

SHA256
2eb60a252c0fbe1be04341e9806e3aa6b8fd526e73495f367ebce7c92428cf9b

SHA512
b12a5bd95fba23ed9d656010e379a9626684a245a6d9dba5039bf1214091c2911663a4878bea3fb6d3524ba39801440a40d34cd4826f3ae68c52770f9820e782

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
71b9c902afb59951c3ce4605695a3f12

SHA1
61f0f4d07609bd1ec2bb6598619c95840980e089

SHA256
4a7c88934e8d32ef4a0564559d48d6d0bf3d88bb1276db913a36b121258bd481

SHA512
1b7656a1b93812d7f672b2e29f4d95fff566b46a64a32d8a50f743f1936277275c89fab87bab14e68518372ae96744e61c7055f781720937edaa206a937327d5

Download Submit
C:\Users\Admin\Desktop\Client-built 2.exe

Filesize
348KB

MD5
5ac1bc0d44ec69e0df9e6eae094608ba

SHA1
638585afa06159df55dada0d6ee6da29a9912043

SHA256
e2a161b3e97d0b3f52246bb7917431456d47df682cae418137fd1348a552dfe2

SHA512
e81d25d1dd5663703da0ff47e36d72285f2721ca58591fc3845772600c773e7285534d677704fce4d3f08772212a7674176dffbf342792fb10d6277060b6cbc2

Download Submit
C:\Users\Admin\Desktop\Client-built 3.exe

Filesize
3.1MB

MD5
f48767e0c5502f3e83cae80cad33cfe2

SHA1
7bbbfb1da398398f9af93417692b3554fb903b29

SHA256
24996140de5678faec61654c53914d4ed4ed06f50aeef7d96df9b1ab2fca98ad

SHA512
795ff2e9098facd45e134a279f04d9606b72fce90d0c123448a03d6e17849e389b8d8601cd17f2767dd355fca4f015fad2b6c24c7b9ff5da170304d61610d3fd

Download Submit
C:\Users\Admin\Desktop\Client-built 4.exe

Filesize
3.1MB

MD5
d6739ed4190615b9ab80765703d481a0

SHA1
04348c615e018621dfda6f99f2b42f67018c76a9

SHA256
16158f9c206587a5baa23eb043d7e1c6fc5afdefcb7e920f6332fde9bd0a81ec

SHA512
60387b302f991ec3f07fb96741f5f8777f3c1e197fc7feb7e508ef0bb1fcd36be436976ea6fab72504184060b0b586131d74b4459a61e2c27f46084feac42c65

Download Submit
C:\Users\Admin\Desktop\Client-built.exe

Filesize
220KB

MD5
d7ed867adf4e3f4d8c8e82063d1e64ea

SHA1
42f719c5b4846667f5b5b73839e595e0223114f7

SHA256
f49c20df59d5dede4eb00c847842a634f40d6fec0c903c67bb9b57aefc618fae

SHA512
c8930ca4681e5759335aacd27f0713d63b43eb686f9cf1513f7d36de9f9741cda19a7d65e4dc123541cda7d31b2eab22bca3ac2b012caf674feefecf735e04ed

Download Submit
C:\Users\Admin\Desktop\Quasar v1.3.0.0\Mono.Cecil.dll

Filesize
277KB

MD5
8df4d6b5dc1629fcefcdc20210a88eac

SHA1
16c661757ad90eb84228aa3487db11a2eac6fe64

SHA256
3e4288b32006fe8499b43a7f605bb7337931847a0aa79a33217a1d6d1a6c397e

SHA512
874b4987865588efb806a283b0e785fd24e8b1562026edd43050e150bce6c883134f3c8ad0f8c107b0fb1b26fce6ddcc7e344a5f55c3788dac35035b13d15174

Download Submit
C:\Users\Admin\Desktop\Quasar v1.3.0.0\Mono.Nat.dll

Filesize
40KB

MD5
bf929442b12d4b5f9906b29834bf7db1

SHA1
810a2b3c8e548d1df931538bc304cc1405f7a32b

SHA256
b33435ac7cdefcf7c2adf96738c762a95414eb7a4967ef6b88dcda14d58bfee0

SHA512
9fcfaf48bfe5455a466e666bafa59a7348a736368daa892333cefa0cac22bcef3255f9cee24a70ed96011b73abea8e5d3dbf24876cffa81e0b532df41dd81828

Download Submit
C:\Users\Admin\Desktop\Quasar v1.3.0.0\Profiles\Default.xml

Filesize
1006B

MD5
c30e719e8af1ce2778a57868920d62bf

SHA1
fb8c142d9075cbf1d0a462360c617b52cfeee2a3

SHA256
9b5c8ae2d46395144af0663fd7965004fa13a5d2d751ddddecacf737b4d1c485

SHA512
5b1527b8595c333698e433a4676eff9a9433012e52a453fc7b62f6ec7638db5fe6fec18af2ccefcc0c601a170086d45968e31ab85a2863c25a056ea95397f36f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.3.0.0\Quasar.exe

Filesize
1.4MB

MD5
5d56758eb0cf106dba55475e9bf9b479

SHA1
088e81d1f82b3e063198872f8802bfe080dc7105

SHA256
ef012e22ef53045f48b574b395788c8639f853484bd78f4c9ad63532d916c1f9

SHA512
defd29f745d90b945117c88e7ddcbb8ff5eeca38e60bea9fa2be643818c15f99b83045ff464e08cfeb210474d0897ffeb847f7b4a3ae842bc90c942ce035c793

Download Submit
C:\Users\Admin\Desktop\Quasar v1.3.0.0\Vestris.ResourceLib.dll

Filesize
76KB

MD5
64e9cb25aeefeeba3bb579fb1a5559bc

SHA1
e719f80fcbd952609475f3d4a42aa578b2034624

SHA256
34cab594ce9c9af8e12a6923fc16468f5b87e168777db4be2f04db883c1db993

SHA512
b21cd93f010b345b09b771d24b2e5eeed3b73a82fc16badafea7f0324e39477b0d7033623923313d2de5513cb778428ae10161ae7fc0d6b00e446f8d89cf0f8c

Download Submit
C:\Users\Admin\Desktop\Quasar v1.3.0.0\client.bin

Filesize
261KB

MD5
3e1e36fb99f3c37e11d4edc9009b36df

SHA1
50b7cbb60530980870baef13e4f04ae2e7e4e1e6

SHA256
42b02f1c1118c037f18aa331b8b21a159ba4faf412b3bf319cec6cd4eaaafb9a

SHA512
32491ca1299d6608c4b3cd3af5646c76a6669101d6cb7ab1157b7b1d912190726c1dc2698ddd872b900214046d7c521a93542dc65f4394384c4b39cba394ec06

Download Submit
C:\Users\Admin\Desktop\Quasar v1.3.0.0\settings.xml

Filesize
51B

MD5
8af01757cc429d1347430084913566d1

SHA1
e4ec570a0b1a5c99e0613da232eeff4b42ffaa75

SHA256
f1a33cd5b1c9368f73b8ff144bed026664577317df27baff774b2bd2acbd52ef

SHA512
3edbca5a661d0fbdd0f8aac994b50e3f844e1d6ee6bfeadf0d8aa89fab1b7cec69b9f687a704c7a989726bb676604e2cdb75ca30441e94a05fdd4027ec9a494a

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\BouncyCastle.Crypto.dll

Filesize
3.2MB

MD5
0cf454b6ed4d9e46bc40306421e4b800

SHA1
9611aa929d35cbd86b87e40b628f60d5177d2411

SHA256
e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42

SHA512
85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Mono.Cecil.dll

Filesize
350KB

MD5
de69bb29d6a9dfb615a90df3580d63b1

SHA1
74446b4dcc146ce61e5216bf7efac186adf7849b

SHA256
f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc

SHA512
6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Open.Nat.dll

Filesize
68KB

MD5
cc6f6503d29a99f37b73bfd881de8ae0

SHA1
92d3334898dbb718408f1f134fe2914ef666ce46

SHA256
0b1e0d8f87f557b52315d98c1f4727e539f5120d20b4ca9edba548983213fbb5

SHA512
7f4c0a35b612b864ad9bc6a46370801ed7433424791622bf77bf47d6a776cb6a49e4977b34725ead5d0feaa1c9516db2ca75cb8872c77a8f2fab6c37740b681f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Profiles\Default.xml

Filesize
1KB

MD5
5ccc4126108c66138bc4c8e63750588b

SHA1
4f7e4b31b2787b7e7732956c3b42b505025a23f0

SHA256
418c948198ad9749cc679eb385b357cb44d0a8ddde47f60f472fb096aeaf3297

SHA512
742937c5142d2c761171f909a62056b5e1060e7accc891911291e8aa0d19282d2d7efc33926369acde02533c56f5dfcb248254073cf6af9984720c460a81fa87

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.Common.dll

Filesize
62KB

MD5
2185564051ea2e046d9f711ed3cd93ff

SHA1
2f2d7fd470da6d126582ad80df2802aabd6c9cea

SHA256
de930a748e4dc08c851ba0a22afce8dcfd0f15f23b291f9306c8ef6ccd7460a2

SHA512
00af241c1f89b478e66d758db26ed0a413b690d695abf91211b5cbc3985133632327ea0fc41140bd61d02271b6aa278a8e8f539d8ca6ce94972aef50c1a9c868

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe

Filesize
1.2MB

MD5
12ebf922aa80d13f8887e4c8c5e7be83

SHA1
7f87a80513e13efd45175e8f2511c2cd17ff51e8

SHA256
43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e

SHA512
fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe.config

Filesize
176B

MD5
c8cd50e8472b71736e6543f5176a0c12

SHA1
0bd6549820de5a07ac034777b3de60021121405e

SHA256
b44739eeff82db2b575a45b668893e2fe8fdd24a709cbf0554732fd3520b2190

SHA512
6e8f77fcca5968788cc9f73c9543ce9ab7b416372bc681093aa8a3aad43af1f06c56fcbc296c7897a3654b86a6f9d0e8b0fe036677cf290957924377bc177d9f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Vestris.ResourceLib.dll

Filesize
76KB

MD5
944ce5123c94c66a50376e7b37e3a6a6

SHA1
a1936ac79c987a5ba47ca3d023f740401f73529b

SHA256
7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a

SHA512
4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\client.bin

Filesize
3.1MB

MD5
f4d16cfe4cad388255e43f258329f805

SHA1
fe7cc6c9eb76b5ad97867b46d053fae601fd4a2d

SHA256
8fb6ae3496d4ac025eab443d3e322b0faa3461d25b54093c9205d35746e3250e

SHA512
867045eac0f7765e6bea51e62bc4ed68b1e81ce6c2843d2e08714eb391a8ac94c2571c09828286252248400ea5c12bffa50a25c8ec5ad9e6d0bb836320ec188f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\protobuf-net.dll

Filesize
282KB

MD5
abc82ae4f579a0bbfa2a93db1486eb38

SHA1
faa645b92e3de7037c23e99dd2101ef3da5756e5

SHA256
ca6608346291ec82ee4acf8017c90e72db2ee7598015f695120c328d25319ec6

SHA512
e06ee564fdd3fe2e26b0dec744a969a94e4b63a2e37692a7dcc244cb7949b584d895e9d3766ea52c9fe72b7a31dacf4551f86ea0d7c987b80903ff43be9faed3

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12

Filesize
4KB

MD5
0281459eba2371c89beb61732a1968ff

SHA1
7dffb4ce430718c6d16fcb92442d240782ed0440

SHA256
e0c5fcefd21cbae8017f69e2223aafb59f68155b101d4c6b352c42012c0087fc

SHA512
d54bbf93a8fa51f0ebf15f99d23ac93e162b00c08187e0b190147c8625ca6a9130712e1d51b946d783beb48b64ba377b13e7d598bbb7d627a0a5cbcf879cc3af

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\settings.xml

Filesize
371B

MD5
482b40c0d7aa8a3d1bbf44e34b4d2ca5

SHA1
d6d24c92b01a2d8a1e9cd5a15669443091f1c7a7

SHA256
40adac53b3488585f0bd0dfc919d7d145184d4b78ee7641d721bfdf141571c31

SHA512
64774f6c520ba1b99c353d79747e78d07dce9220ba9d4a0d81d8abd6d593ef32941b73d7795e1666b0777571bca194d9ac7b6b4394c1b2bde32387ea4ee2f813

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE1\Mono.Cecil.dll

Filesize
273KB

MD5
2c5dbd6db1b8decf336433c70b02f0f4

SHA1
aba260436f798b3e6020cb0111857b8196cb3f0b

SHA256
ef92130cde35d1b2167db6c4c035cba671d589b4f82822e6b9dd3af9136df62e

SHA512
8d7790eb08e93e74db1786386335ca1a4ea2c4b215324f9ce0664d2299ce5ba37faf985d8d255f81d8ebb926d7121d5e3e663645a33aa0c0f1d230382823758f

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE1\Profiles\Default.xml

Filesize
406B

MD5
ae5d2b5fe7cbc3c0e0466cb3b73dfa39

SHA1
49e06767b05e6888a045eef529e0bad8ae628451

SHA256
c76376e02bf7fff60ea785a562a604c48ab80e3dbaafd806384cdd1465ebe058

SHA512
0135cdae1d7fb7abfdfc831c3ffa693e88dadf66b6154152203e9e6813d7881d9e113cbe95f2b3230ae4e23ced8a2d30abfd3b262ba0535bf11154879e7fb5e0

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE1\Profiles\Default.xml

Filesize
513B

MD5
52ab88563a540c79e866f5e18a4fc686

SHA1
e821714c71fa17e71b71f8d82fcfbb2fe9ffab92

SHA256
748254ecb07b7fc0304e3421c2be03c873cfa54d5d8341de960109a568799437

SHA512
b6b59a11921c00820d22d33fe6686dbfdfee884841dda68501a904ee2edefb630fcdb30c4010691d576eff72917552124bc249d28e43c1a95c4d2c5f4ce8b9a6

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE1\client.bin

Filesize
214KB

MD5
c910ad3b8aa33f3e9e40c6998047e1d4

SHA1
898f9d9480dc6e421494f443c37810eb991c12d7

SHA256
4ba917056a3282c40c3d8ffd9722c791daefc956ba558fcf9719e94b449b6377

SHA512
cda20bde69339c96cad610b490f5bf1b882f9255f9885a93f2b395bc27cd82c5597e7e3e95173af1ea6e0dffb55b61566fb0bbab0ed0e837beb6f272222907df

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE1\settings.xml

Filesize
178B

MD5
b17f6004385ddf8969c9ac7573783fb1

SHA1
ccfe11f5073bc71d0ac95cda044692f07a574f6c

SHA256
f222a0fe65ae36fd84fb39f90692fc550cea18add7f8325a0a00201fb54783a6

SHA512
978e5c9678fefefdd424f16d7bbed23d25cf305246189380b694512b378339b45e8b38bb9200ca41bb9a49e5afd86653809429f8b3060b6467372912b85e2f97

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE1\settings.xml

Filesize
179B

MD5
e9ec981a776fa85b9c97f505cb5bf30b

SHA1
fed15cde42a83c123a95bc2e5520bb2adb160c3c

SHA256
a8924ca7e45a3eeeb63149a6d4473506abdad433089384c05e9c57e6f66de66e

SHA512
59e815741ad9461ae33169c1053f0f99f4f7a140fbfa3556d168740f19fe38d9ba5473826b0cb684824a67844620b21883d79ddeb528a1c8802dff24378dfdd7

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE1\xRAT 2.exe

Filesize
917KB

MD5
1dbe82ea1133ffe1327e631767bed40d

SHA1
79b77ed127ded2b173a9ca1afbc5e3889d8d3db0

SHA256
6c7334b11e7e4f7779df13544916178cd6d85d2dd12d8cc1691232165e63c2db

SHA512
be3f4874052f90c68c9e840fb6b465024f0249835ba6cd727c0f49d172cbeacd529f9eefc4a0ace1a39f655996ac3a05b115b245ca321482d3065dce0fdfb23f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 258389.crdownload

Filesize
611KB

MD5
ac17f5bfbdc14e9d9e8100d64cd9094d

SHA1
dd5b3afeb326fc02a59e3eb667abd68e2088212c

SHA256
30a4ec904324aab10b9f77127944ec98e8e1f222c893c1862f3bed4970ead8fb

SHA512
733a79e5326f6a09b5c4b4fa648bb967cbdf5ec00b389df8a12ddc0c46bd326e4ca7ad98e61b009a373ac404828444094498408b5683fec4e63251900ba3621f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 557316.crdownload

Filesize
3.3MB

MD5
13aa4bf4f5ed1ac503c69470b1ede5c1

SHA1
c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00

SHA256
4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

SHA512
767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d

Download Submit
C:\Users\Admin\Downloads\xRAT.2.0.RELEASE1.zip

Filesize
462KB

MD5
407e28fbe8d0668dfc0732c16af92fbf

SHA1
5f2001f2053428e7aa8b82a74fa1c8058958a3a9

SHA256
f80c5793fb52da87ea947f820383f95ad3a79f66605fd6bba703922b4fab80eb

SHA512
1449639f9f862c25edd791bfa01dd3b115873ef25df564027be8c0fe160454361d7442775bf81c91fa2600b17a452a75d97e9101d0420696c8bac1d92c8ca1c2

Download Submit
memory/2792-974-0x000000001F850000-0x000000001F9FE000-memory.dmp

Filesize
1.7MB

Download
memory/2792-1088-0x000000001F850000-0x000000001F9FE000-memory.dmp

Filesize
1.7MB

Download
memory/2792-973-0x000000001FC30000-0x000000001FC4A000-memory.dmp

Filesize
104KB

Download
memory/2792-964-0x000000001B680000-0x000000001B690000-memory.dmp

Filesize
64KB

Download
memory/2792-947-0x0000000000790000-0x00000000008FC000-memory.dmp

Filesize
1.4MB

Download
memory/2792-971-0x0000000021B00000-0x0000000021B4C000-memory.dmp

Filesize
304KB

Download
memory/3276-622-0x000000001C130000-0x000000001C5FE000-memory.dmp

Filesize
4.8MB

Download
memory/3276-623-0x000000001C6A0000-0x000000001C73C000-memory.dmp

Filesize
624KB

Download
memory/3276-624-0x00000000016C0000-0x00000000016C8000-memory.dmp

Filesize
32KB

Download
memory/3416-1377-0x00000000031D0000-0x000000000337E000-memory.dmp

Filesize
1.7MB

Download
memory/3416-1235-0x00000000031D0000-0x000000000337E000-memory.dmp

Filesize
1.7MB

Download
memory/3736-1074-0x0000000005510000-0x0000000005522000-memory.dmp

Filesize
72KB

Download
memory/3736-1070-0x0000000000450000-0x00000000004AE000-memory.dmp

Filesize
376KB

Download
memory/3736-1076-0x0000000006830000-0x000000000683A000-memory.dmp

Filesize
40KB

Download
memory/3736-1071-0x00000000055B0000-0x0000000005B56000-memory.dmp

Filesize
5.6MB

Download
memory/3736-1075-0x0000000006100000-0x000000000613C000-memory.dmp

Filesize
240KB

Download
memory/3736-1072-0x0000000004EE0000-0x0000000004F72000-memory.dmp

Filesize
584KB

Download
memory/3736-1073-0x0000000004F80000-0x0000000004FE6000-memory.dmp

Filesize
408KB

Download
memory/5052-1043-0x0000000020A40000-0x0000000020BEE000-memory.dmp

Filesize
1.7MB

Download
memory/5052-764-0x0000000020A40000-0x0000000020BEE000-memory.dmp

Filesize
1.7MB

Download
memory/5052-733-0x0000000020C40000-0x0000000020C8A000-memory.dmp

Filesize
296KB

Download
memory/5052-1442-0x0000000000D90000-0x00000000010B4000-memory.dmp

Filesize
3.1MB

Download
memory/5052-1458-0x000000001F110000-0x000000001F638000-memory.dmp

Filesize
5.2MB

Download
memory/5408-1372-0x000000001C520000-0x000000001C532000-memory.dmp

Filesize
72KB

Download
memory/5408-1370-0x0000000000090000-0x00000000003B4000-memory.dmp

Filesize
3.1MB

Download
memory/5408-1373-0x000000001C580000-0x000000001C5BC000-memory.dmp

Filesize
240KB

Download
memory/5680-1234-0x000001A642EE0000-0x000001A642F2C000-memory.dmp

Filesize
304KB

Download
memory/5680-1232-0x000001A642FA0000-0x000001A643052000-memory.dmp

Filesize
712KB

Download
memory/5680-1230-0x000001A642420000-0x000001A642438000-memory.dmp

Filesize
96KB

Download
memory/5680-1285-0x000001A645190000-0x000001A64533E000-memory.dmp

Filesize
1.7MB

Download
memory/5680-1261-0x000001A646B30000-0x000001A646B8E000-memory.dmp

Filesize
376KB

Download
memory/5680-1196-0x000001A625690000-0x000001A6256A6000-memory.dmp

Filesize
88KB

Download
memory/5680-1263-0x000001A6431E0000-0x000001A6431FA000-memory.dmp

Filesize
104KB

Download
memory/5680-1258-0x000001A645190000-0x000001A64533E000-memory.dmp

Filesize
1.7MB

Download
memory/5680-1418-0x000001A645190000-0x000001A64533E000-memory.dmp

Filesize
1.7MB

Download
memory/5680-1439-0x000001A645190000-0x000001A64533E000-memory.dmp

Filesize
1.7MB

Download
memory/5680-1231-0x000001A642640000-0x000001A642690000-memory.dmp

Filesize
320KB

Download
memory/5680-1198-0x000001A643200000-0x000001A64352E000-memory.dmp

Filesize
3.2MB

Download
memory/5680-1445-0x000001A643080000-0x000001A643092000-memory.dmp

Filesize
72KB

Download
memory/5680-1194-0x000001A625060000-0x000001A625198000-memory.dmp

Filesize
1.2MB

Download