quasar | 6afbecf27622e89b8a0d5e7107a951a996b22b1a4239f3e1d7876ef603e3e93d

Analysis

max time kernel
820s
max time network
743s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
22-11-2024 04:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nose.png
Size

1.2MB
MD5

ed9c825249a85040c2e6df6049ab6ba6
SHA1

af0a2b4738b933b1c6c23ac96c4b7675b2fc43b9
SHA256

6afbecf27622e89b8a0d5e7107a951a996b22b1a4239f3e1d7876ef603e3e93d
SHA512

018cd0ce54ae7160c2a43aae4c0f3cf2c51c9a449c031f6cf2a1da2f10c776a518037b07717a21d19927ab82cb97fcbe74864e192a0f593bb61da15707901592
SSDEEP

24576:6iUwcohkKHD0FKK9ETsfL7oTKl5iA7tDnqBWhKJeQG+CdZtwjueui7bN:CchkKHYFK848L7oTKl5vtDnjKJXG+Cih

Score

10^/10

quasar office04 google discovery phishing spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

10.127.0.38:4782

Mutex

QSR_MUTEX_n9vYnIRn2CZwb1anW7

Attributes

encryption_key
3TohNcpkHKrtFhyau0Fp
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Detected google phishing page
phishing google

Quasar RAT 3 IoCs

Quasar is an open source Remote Access Tool.

trojan spyware quasar

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedge.exe
86	ip-api.com
118	ip-api.com

Quasar family
quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\Client-built.exe	family_quasar
behavioral1/memory/3528-928-0x00000000006C0000-0x000000000071E000-memory.dmp	family_quasar

Executes dropped EXE 5 IoCs

Processes:

Client-built.exeClient-built.exeClient-built.exeClient-built.exeClient-built.exe

pid process

3528 Client-built.exe
4616 Client-built.exe
3404 Client-built.exe
564 Client-built.exe
1080 Client-built.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

8 raw.githubusercontent.com
9 camo.githubusercontent.com
40 camo.githubusercontent.com
41 camo.githubusercontent.com
42 camo.githubusercontent.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

86 ip-api.com
118 ip-api.com
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3528	Client-built.exe
4616	Client-built.exe
3404	Client-built.exe
564	Client-built.exe
1080	Client-built.exe

flow	ioc
8	raw.githubusercontent.com
9	camo.githubusercontent.com
40	camo.githubusercontent.com
41	camo.githubusercontent.com
42	camo.githubusercontent.com

flow	ioc
86	ip-api.com
118	ip-api.com

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Client-built.exeClient-built.exeClient-built.exeschtasks.exeDllHost.exeClient-built.exeschtasks.exeClient-built.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client-built.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client-built.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client-built.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client-built.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client-built.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exetaskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

4996 ipconfig.exe

pid	process
4996	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 64 IoCs

Processes:

Quasar.exeexplorer.exemsedge.execontrol.exeBackgroundTransferHost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "8"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "7"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000008b11c756af18db01fd8174d1993cdb015960b4299a3cdb0114000000	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	control.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 0c0001008421de39050000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe

NTFS ADS 3 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Quasar.v1.3.0.0.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\v1.4.1:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\releases.htm:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

3696 schtasks.exe
432 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

4360 explorer.exe

pid	process
3696	schtasks.exe
432	schtasks.exe

pid	process
4360	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exetaskmgr.exeClient-built.exe

pid	process
2916	msedge.exe
2916	msedge.exe
3168	msedge.exe
3168	msedge.exe
1292	identity_helper.exe
1292	identity_helper.exe
1080	msedge.exe
1080	msedge.exe
232	msedge.exe
232	msedge.exe
4692	msedge.exe
4692	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
4972	msedge.exe
4972	msedge.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe
3528	Client-built.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

Quasar.exeQuasar.exeexplorer.exeQuasar.exe

pid process

2052 Quasar.exe
5040 Quasar.exe
4360 explorer.exe
3984 Quasar.exe

pid	process
2052	Quasar.exe
5040	Quasar.exe
4360	explorer.exe
3984	Quasar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

Processes:

msedge.exemsedge.exe

pid	process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

7zG.execontrol.exeClient-built.exeQuasar.exetaskmgr.exeClient-built.exeQuasar.exetaskmgr.exe

description	pid	process
Token: SeRestorePrivilege	5028	7zG.exe
Token: 35	5028	7zG.exe
Token: SeSecurityPrivilege	5028	7zG.exe
Token: SeSecurityPrivilege	5028	7zG.exe
Token: SeShutdownPrivilege	648	control.exe
Token: SeCreatePagefilePrivilege	648	control.exe
Token: SeDebugPrivilege	3528	Client-built.exe
Token: SeDebugPrivilege	5040	Quasar.exe
Token: SeDebugPrivilege	2784	taskmgr.exe
Token: SeSystemProfilePrivilege	2784	taskmgr.exe
Token: SeCreateGlobalPrivilege	2784	taskmgr.exe
Token: 33	2784	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2784	taskmgr.exe
Token: SeDebugPrivilege	1080	Client-built.exe
Token: SeDebugPrivilege	3984	Quasar.exe
Token: SeDebugPrivilege	4320	taskmgr.exe
Token: SeSystemProfilePrivilege	4320	taskmgr.exe
Token: SeCreateGlobalPrivilege	4320	taskmgr.exe
Token: 33	4320	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4320	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe7zG.exeQuasar.exeQuasar.exeexplorer.exetaskmgr.exe

pid	process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
5028	7zG.exe
2052	Quasar.exe
2052	Quasar.exe
5040	Quasar.exe
4360	explorer.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exeQuasar.exeQuasar.exetaskmgr.exeQuasar.exemsedge.exetaskmgr.exe

pid	process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
2052	Quasar.exe
2052	Quasar.exe
5040	Quasar.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
3984	Quasar.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe
4320	taskmgr.exe

Suspicious use of SetWindowsHookEx 15 IoCs

Processes:

Quasar.exeClient-built.exeClient-built.exeQuasar.exe

pid	process
5040	Quasar.exe
3528	Client-built.exe
5040	Quasar.exe
5040	Quasar.exe
5040	Quasar.exe
5040	Quasar.exe
1080	Client-built.exe
3984	Quasar.exe
3984	Quasar.exe
3984	Quasar.exe
3984	Quasar.exe
3984	Quasar.exe
3984	Quasar.exe
3984	Quasar.exe
3984	Quasar.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3168 wrote to memory of 2864	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2864	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 3192	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2536	3168	msedge.exe	msedge.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Nose.png
1⤵
PID:3492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Quasar RAT
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff980323cb8,0x7ff980323cc8,0x7ff980323cd8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,2363073231202518817,10685687617863629151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2072

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap2570:92:7zEvent31396
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5028

C:\Users\Admin\Downloads\Quasar.v1.3.0.0\Quasar v1.3.0.0\Quasar.exe
"C:\Users\Admin\Downloads\Quasar.v1.3.0.0\Quasar v1.3.0.0\Quasar.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2052

C:\Users\Admin\Downloads\Quasar.v1.3.0.0\Quasar v1.3.0.0\Quasar.exe
"C:\Users\Admin\Downloads\Quasar.v1.3.0.0\Quasar v1.3.0.0\Quasar.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5040

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:2296

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
1⤵
PID:3892

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:648

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:4484

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4360
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:1468
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4996

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3528
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\Desktop\Client-built.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youtube.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of SendNotifyMessage
  PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff980323cb8,0x7ff980323cc8,0x7ff980323cd8
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,2242889382066617933,16967661948859808111,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,2242889382066617933,16967661948859808111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,2242889382066617933,16967661948859808111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2242889382066617933,16967661948859808111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2242889382066617933,16967661948859808111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2242889382066617933,16967661948859808111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,2242889382066617933,16967661948859808111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1848,2242889382066617933,16967661948859808111,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4168 /prefetch:8
    3⤵
    PID:2428

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4616

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3404

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:564

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2784

C:\Users\Admin\Downloads\Quasar.v1.3.0.0\Quasar v1.3.0.0\Quasar.exe
"C:\Users\Admin\Downloads\Quasar.v1.3.0.0\Quasar v1.3.0.0\Quasar.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2804

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1080
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\Desktop\Client-built.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:432

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Quasar.exe.log

Filesize
1KB

MD5
b4e91d2e5f40d5e2586a86cf3bb4df24

SHA1
31920b3a41aa4400d4a0230a7622848789b38672

SHA256
5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

SHA512
968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Client-built.exe.log

Filesize
701B

MD5
a0c99cab2d0348a3d06a8ed2ac281be9

SHA1
abe85b62a3e758c71585a0be2ca133f4928d8242

SHA256
ed6940279bac21a6da297553ce2fc88d123c45428326418531c922d3c8bd4959

SHA512
19d2d3004fba1debe3ef7df8c7705fe50ef7174f64d1899464005b34840c95f1a9d02b8de3cf7f0a3ee8a303182a1b4a0186e69252c6a133ba7c355235ecd46b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4a5d9cadb1baf0fef92289489e71cfd4

SHA1
13ba55539c99b4ccfd40f16acced9a5ee77aa101

SHA256
1ab3c43befa8e22fc85b9acc52d7c8d008e438a256d29aef223048e8941e616d

SHA512
8fab6e74c967d3a00280c52d92853220d4ff8ce39486610cf03299286b9301d82709a0c3a5eb2cc7b920db2134f9ffdd96645a89e973c88f0c7c5e436e12a530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
55598db3dc40b52ef5937f295fe3372a

SHA1
4ca25d612f4759ed48f166df42e42e0b9be44819

SHA256
780a259ce0e385d50d83d2335dae08af681fc49ef9b0f3f0727d5ca8ba992cc0

SHA512
8f6a05691a334351ea534671619606f244bdfa761b20f4c42f60fe8378b56d1155af0a612f3dfcfe9ebe96ee1edd97fcfb3062113eafa57e2d4349ea9a360c64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d68c7edc2a288ee58e6629398bb9f7c

SHA1
6c1909dea9321c55cae38b8f16bd9d67822e2e51

SHA256
dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

SHA512
0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c03d23a8155753f5a936bd7195e475bc

SHA1
cdf47f410a3ec000e84be83a3216b54331679d63

SHA256
6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

SHA512
6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
dedf0f3bb30cf2b17fc3a46bb8d2506a

SHA1
d98e4d7ff6b693b2ff40f3ce85d239dbd9706ea2

SHA256
157c74e2db2f92343b2dc4e8d743f85959df5fe52b1e45d3514bf1f0dce0e95a

SHA512
b0718092b00c345c31adff5bedfb8f9ce22bd4724e8198e66dac64b218973029f387d7688a7856e1c4c1f92138c53bcd729c921017c9e2725ec0f0c3c4151fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ae0f86074cc89df43dad19cd40f67c95

SHA1
cfd830ea8c2a43978de2e4a55fd4bb39bcc569de

SHA256
4371276eee57e27951e223152d793db286a0bfa9fc28d438330fd1d838b3d6d5

SHA512
ccb8dd678c679ef28e243187ea10eeea0fe9036bff7bb1fada26e5c8739131cf867d7ba6966c0af105bb75be6de9dd0914d75274ab61cb6b66016d78abb7acf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
28KB

MD5
b0bebc445d1de8d4917543a36f313d1d

SHA1
8f20102120f36d957121d95421cb08137389f5db

SHA256
8830e7f24bdf49f8cd1b7b28be662aead860ba2f4a69aceffac0825344d3c59f

SHA512
264fe928d935eb98e015e28bf3ab8a3973260a092a791c32f37e2e2eed572c828699a7942057c8cba7bbf101b08dc650e7d75f05acb41db8e019c2ca7d5ffad3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
0f9a4bda512ee233f2fad5fe0a402cd9

SHA1
2e07ff78ead5eed592e0bdff0b7233a274cf846a

SHA256
734a3600eb4bfd1768aa8187acd106162dfc39852c2be37bcd596c2ee8942fb5

SHA512
6ef58dd3a01bca239ab82c5dd77f21a3589979832d7e2cd7c8f1e7e8f1dfdc3c480e34c08c53551e2416c72c02aedf54571bbbb8ec83ebf28ae128a39a04afb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
cf4a9bc4aeb00993e3d82ea7af982e2c

SHA1
3f86909b08f224dbb3edf4d9c57c2ccd3caabfcb

SHA256
9bbb85e23958dc652629f4ba24c44bd36c7cffa38fc277d73c869c5a8200fdf8

SHA512
72d8f32f1c6a83ff43292396a853c09dcf124c1935066950a8106c2db89925c262c6f0f6b3882336addbcce256458ded6b25d61792c9233b539832e7c19ad62a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
3KB

MD5
a95001d957d6d688763bf606cab1d2a9

SHA1
928d8aabdbfcb3ab79e54506ee4ec8f5c5368e27

SHA256
90e06cd4e135258056d2681f570bd6140c25223e6d3a7a877d2c3b8bd3822657

SHA512
e4d5204e0bd41b3272d90bee6300e3d2ea56d27d5389a261fe4382520b26eeb19a42936f2a16f0867bae9dee39a3d988577fbeda9bfcc6b6d7779340920e8b4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
26KB

MD5
a8333faff80a12a72c9800b83afd2bff

SHA1
1e8088b1c8c50e514d09a51607dc9c79c1c756db

SHA256
a36b67d657be356ace412f2eb1b1471728f1679bbec7e0c05b3e02c3bad1582a

SHA512
3098206329c7670f539c46328cb94e0641f58964c2f3806e2c113283cf74e22ee44676845da22a5227ab256f612b780ec2377ae46a34a5820205762237b404dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
377fc92b0d922f4e15db8bdbb4e7e0de

SHA1
c40ca431466b22698ea5833e7eedcd84e7d57ebc

SHA256
5b8a2d16f3757c4491e8dd38071758a53d249b5beb102dc687616ec5554ec851

SHA512
ff102b8631fbec65e8e492d4f5a87c503d3a244e3d44cbd54cf7abccd328e340d54b766063ae29e7cf7aeab3b5202525521aeba903ce569529b5445c986c1c0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
872B

MD5
23b9c00bc9987761f0af4cc69864bcee

SHA1
2e8fbcf6eb08dd089b8997dca3e0cf542fbe3d0b

SHA256
a535ada8e74c9febed44278bf0ffa848e2e95ba6b91e5c577311411debd38ee7

SHA512
a65cc230a2ec0afb7f2fe6ec65ecec8c93988ec2b021a7b3951eec6b42fa173a7161f7bf6dafb7e25a1cca9528f73554811dc9611da31dace3bc1b42cadb6aa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
872B

MD5
056734d9639e9959d7b3249037a30178

SHA1
ba7a9a8d747ac362c165259f9d4b56ba30c82447

SHA256
930df937764b3069993f481003255ce6f8c8f86426b3f1d1532674cf03f421d2

SHA512
bb541a5bbf95fce81b80c29c8c46e0259b6a1050bc71ec9f46034f9c6881ebf8c542f4e57fa6cb47522e880b6e5e660bec0bceef3a6aa78e3897fec3a7ff9953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6c6ab93381e3c3b0160cfb0476004f85

SHA1
e7e85d0897e4294ac1fd451e8b2b9d07bed7a329

SHA256
e648de1882a11a7ddf5e73ba22802c40c5704f753c78b54acc4ff42644aad544

SHA512
147643c7d02d18236c607970f6ea663244ff628d27d0c6fe3c1d2c0c27f9c2e3f828efff24ed4675020f3ae3dee602bbd3934bd2c309c6748725767e67003715

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dbd1dce076b2efd1bac72a7314d2b834

SHA1
070ad33768d5e51d0a41d95a52474630997b5bbf

SHA256
5e4fce5fa210317c075a7236e7d7b0c184431ab423f2c81061f419697d8ce314

SHA512
30d7ca86f3c6e90257cb49e4f266372253853569b37763957de939c63eb3dd29744f30937b4e9a2f5af3e26197442e8ffac89c2a6c14a4ba184e0a022435d486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d68f04ae3f4f5d808c60b7b088bc0c7

SHA1
03335fc386c83a209801ddaa77f12ba2ff59fa9e

SHA256
42ce65bb534683e32253fbba0a5ac2b15ea777744f12ef8e1d8e41e326a8c494

SHA512
11fd8c109320ed0b292761e41be5e74f002e75e890d93fda6519a38ac702b7497f0322a661261bca117edcf9bdff114b88f1ded2e2843fc633ce1d54ab856fa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
56a15f2dcc2a41bf4c5082c30dc4de94

SHA1
2e298e285c7dc59acdcd7982705932b490a4055c

SHA256
f4ec10e830db012dc7e817678bfa3cfb184a95d6a34c8ae94cb4e96d3f10324f

SHA512
9b343a00954d8dff19d8e29ef8b3ea0175f6ae4612cf5d3e2be2e5740f7a9c512d9b0d133cae905a304bc7079eaa2eae81c6131e556c87c94c0b2755b1b9c68d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e6c68fc4c397a932f33eaaa587c2e113

SHA1
2b92e167fb440e9d856dbe32fce34107656e0ea2

SHA256
7459ce4f1c087fe15eec8c0e18b3c5445f5d1cd1fbadbb04fc3e5022261f55e1

SHA512
08755483556c3a8222c7f3ae27df08383aa4397f9af6c2fa27782a0f91ca96aff1330552318782da6bf3c07535d2a22c95836fd07740616405bebbd03d9ee652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0bcf348b8e9a9a2b10753fa44a81bc3

SHA1
a69eba6cbcbd8f27a6ccfdb4e9d2b4131b63afbe

SHA256
fd1accb60220159a951ecbe9179b72aa2c2a70c1a7bd9eae826ebd9c9e22f127

SHA512
1ebfac4489a4134139f9998a1d813e5458a77ed00551948ba1a77d4dd632cb62ba28ca07b3772211fef208f634e6c590b89a75bbaf510cb600929eff49cc4708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4b79068ef0214537f65f9a9df4cd74cc

SHA1
276c2556d36896362f6d707183547978d87e724a

SHA256
f8a53230bf9e35efa1c54e23a03513fb8bb643d004c9d4b6c24ca33682f9daa7

SHA512
0eac437c523269427023115228c3060d74e70c3cc07537de748a13498633eba6524fb73de077f6460989948c4a139b267b68c715c80a153419dd98085b547147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b6f00e6aefcab0830823a65962872bc0

SHA1
297a4e3182b14b2874ae252304cf0b23797bd049

SHA256
f160cd80b80cb81ebaf17479d3ac354bd126bdaeb9ab3a837e09709cb7758803

SHA512
3b692789a44bceb80f509944f34613a72f2648afaa27f116ec51fc5749fcd0c13388c8d18a7daefb85f392a6b951ecd2c8d5983e343fd5092134bdc3b4fbff19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
9649aecd9b614769f45d1b9ed4be2d00

SHA1
75e970800e23da394835a4276c2e9a5c8d1fbdac

SHA256
d6259c2e9abc8b879277e200b7e130668b89e9d04fc8e9454725f420b3abdea7

SHA512
0cb07521255ad4339a0a3f35a5e81cf19e41f662fbfbe67d979332fc3df7959fcb213a20a77b2413aaab8ca078f97ff67924495c04f2eae56a98b13b42d2870e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
c65cbba2aff9cb29dff80ce2439e1d90

SHA1
88146f35236bb6356c07eeeb3d9390281acca36c

SHA256
71205f76eec4396b93b97db61e54895073b06865bef45fab57cdf372594d1928

SHA512
07ab7eb2c86131eecfd1f14fc6d7c1f9629621cea525584d53805430bb8080ea33aac5df935668fe68321da4c61b626774b5966c00d31ddeeb7530982fd1b3c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
ef151157c475422ef9460cf6372b802d

SHA1
1e7d7dbb68e36ab17240115b82134f985261386d

SHA256
53110990998b273855762714c4ab2859f9a2850c45df04e1726a2da88367ae22

SHA512
9b5a19d1c56fa3a5d79f05af3c1ba8cd8e46820fb60637d91e0870b5a66ceda61f5b2b973c76201d3e2523c7fe8add0c77e863556c7baad6fd9d827ca8083ec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
db74e8f100b2579526fa34286383656a

SHA1
95564ee86b5d1e5423dbdbc767680eb28b6cdf0f

SHA256
31500df7e2fe013180b75b1ab62796292be94e1e5af8b22b2235b4731f8f3e38

SHA512
587c9cfa4fb387782aa0a4708dea1eae4c03acc1814551916b6ce712aa29b92d575d0a54c33a7fb924f88797154cbb74573ad3f1153bff8c211947e668e8f152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe60d6cc.TMP

Filesize
48B

MD5
4ea6a18eecd96f91d6838fc9c572af06

SHA1
a47f15f7dd839e596e749dfde4ff9052f8bb585f

SHA256
0e6364e60161e0205ff0e10f92fa9cf3a2636bac8d439d66bfc0975f3966a2ec

SHA512
8f45c606bf95078b0694684df83b22b3c4006c955e26e3ee9d85d2f2339ac2a4ba3c841433cdf5629bc61c895c420c8443759e1286bbb9689ebeeebe5f4d42f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13376724373800098

Filesize
13KB

MD5
471ad95899add757256a72801e77f108

SHA1
993e7fdbacb282080a2cf143c5ce64be64e81ce3

SHA256
df3b4f8d8b71c7b9dd5482e7c0d3b4b1d4ad01967543051f899a6d39ead4751c

SHA512
2c966d71e5ea87d1ba1f831abb59452c8be5164d274ba178f79c00fe62bac4b6dd1b477b03dad59e52d90f771ae302fa19c1c1f1aae9c04a1a1ef6d73bcfcf15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
184B

MD5
7877d6643861613ecebda957ee88f0f5

SHA1
bb47a87141acabd8615624195f510be51cbbdeb0

SHA256
21d54897afccced626d25bcde8de488b75a35dc286404041b95557d4e606fdfe

SHA512
fe76cd209f3126b838ceaede75345322e9983992099156eaca32499fb13fd4459a6b97f1a96a5c493634215d17f897c87357f461793b44caff101c39e323cde2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
f69b5aa3bc8f7da6bf5b1202c8a04971

SHA1
054f5b1c33b86cded2e5ba5788eeeb74b0bbe0bb

SHA256
a70f2be377484aee266fa785cf1619b84420345cf93c21659ed1d7d933682d88

SHA512
35f4b4fc08a2b9a13e0c84e6d738df1e20ef99432f370538e91430e32bac9ea2775529498bfc2ab0ed102ef0ac3d796e5b4da45249d220c20a990dada5ed2de1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
8a4bbdf0f54e41cd62a119373b1545a1

SHA1
89400c86fdf246371f5d5a13d805d3811870caf0

SHA256
d2d7822fed55e71eb26634be181b1a105adfac7ddbfe7493dacd6d6f9fc17692

SHA512
6ed7fdc1a3eb97f76cfad3c3abd3327d86afa172b57cc1c71cc79def1dc2d51af31ec03a11edc4084db86fe187f3f29ab93b10f5c4c9ec25969ff50d32a6334f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f5d38c00a437ca181eb39ee96069cd0b

SHA1
37b70e1d71bbc8ac7d61545c7da7dc30d35819de

SHA256
e50b10fc16c85401dea9268a60712ef0f06100f9c86a1b656225cd47fb649989

SHA512
b158c919a9f87e724ebfc4535889895e86b8cc94f6f6c787732047f8cf205ce01ecb25e1f852c1216db59646d9afb89b656405c972feb4d4d01d71142d520d2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4df4a56b063e4a54ead70d65f6141763

SHA1
3d450549cf5d24bbdc998119853919171341cb21

SHA256
37982ad8b1a1eec780d1c3525b0703774a7545dcd01876925745adab92b3bb1e

SHA512
4713f0bfe6380aa08a3bb56f3f2d1f462486ca3168643ab403902af37dc99af4882e63a93a6149a87b741fe3ea966fe3046060a158fc5f67f37bb5fe3f57c5c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7f02110a017a5f5c39ff2ac5a540bcdc

SHA1
5c262e7f83475c82e40d83867071d7df7c62c24e

SHA256
973353b60c64a61a6967da3646ca6c7abe79e7e7b132480faff4686778bd6c4c

SHA512
9bd6f4c83e5444d2606c71d9fde031b1e25bc2f9ae488359123fa9170e8f9c3fd94e8d89f17a2df61b0d3ac51f698fad077386e3dee59fdc36e7e4bce686cd90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a3cf60098d1019ae43d39780508e4554

SHA1
dad4e53d9a9c7d59e04d00a10885249d20ce6755

SHA256
5facdf21af20452dab019f39e2c0a7ea3b4458c51be657fa88697e656b032ea2

SHA512
f5da80e3a0036919010b9a13725567d1388babc988ef5bae4d5404fa676a1f79508131d2625100e582c424c387c36c0ac62b6b6b73239105348ca1e5ae143c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4a89568a4b1ea5acce8a52b03152f551

SHA1
65bca980d5f8a433315b82cad2c51debd8c1a25c

SHA256
6ac89de2bd0772e66094b23820c6eddab5eee19cc339cd735ceb2d843be7c3e5

SHA512
8e7fdec7ef9e65e4ebc00c17a0709760bca76809b1038933927672d9e4cc263ba8a0a2a9db4309af12924b059ffedbdb0da17a1032396f34211c5dc5808ec05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e86c.TMP

Filesize
536B

MD5
e6257b8be53e5403f609d591fc3e6631

SHA1
51450dfef6582c642addc52c2eb9f24dc5f77e65

SHA256
9ef5fca18dce1fccb0cd7b3f46da5d1d2da2fdf279100201fbf299795e199c50

SHA512
3b5bae35911600ad5e54302516151b57a16cf7a4fe414f90b89ae1c0ed83aa215bff2d48e68a39fca9eaf2533df95456fe58ef1b15ae82c7310cfc9840b27eb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
1fa3c882c867d133e00a3a035509a776

SHA1
44221276cb7067ffed012cd1f81afa3d5969e3e4

SHA256
02b2df0c1b4e1fca091cff59a8b54405d432243134f0634fc9bba91d1d02adee

SHA512
d44d2545dddd92cd038a1f64ede49b12acbe6ef172dc5a6358508bef253a189b65f0b25e38f4dd69a1fc60067d73415bc5feb44a9223197376450fffc0bf7cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
112KB

MD5
0a070030e328a1c78acbc6e93f3e13c7

SHA1
7fbd3d8e4ca28c9982ee843953c169fe0d4c7444

SHA256
b1db0dfc1ef5217329ee327947cabdd5d25bf14371fc71abd14d926c366be802

SHA512
e5dd7300af98818f6d2c32a9598f76abd31b15b388fe4937d2545e3cec965c7af8c2b9836ade0074e5da7e17c6c8fe82c6173155521b53f456f3673dddc52275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
76KB

MD5
d5ddf79a055601d96324806633bd9828

SHA1
4f32781263a443456f63f19a1470506c95a3db1a

SHA256
89105530603fdbd95243c0b5e9398fad31b2daedaed51efc2341ea83032d35c7

SHA512
6597708aea34dd9171556a2b7415f27bba7d09c7aaab9ddecf8b06a8619004fff4339223ae8d990b0319ee4f901f447b4ccaf4b3325f7267503613b998cf546f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bb6b4d9b45c858d73fd5998305ed5cf1

SHA1
2cc643f53bbc65b79f1a1234d883d7a9f1d56b9b

SHA256
8b93862a3152cb25b4597fb985e4e02a7d109e35a53056c053cb98c8459e0a61

SHA512
62915a7181c1d4209d1cf5150423579d66f559cfe3bcd64ad63ece63324e3e89fc449470399ff87ee34563891478a47aa5a51e2d91aba7f60c36e9d052ffa72a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7bb4b03086f7de175f7d38c9f7e892e9

SHA1
f9c76b022bcc4afbe61731eb462f1a4094864869

SHA256
786e135250737353d1e9d684dceb82d84823accec8246ad33f7930c955eac2ff

SHA512
7a43c68d4132d0e61e739d73483b89592df12d243496e3ab9cae1b2db0e6a619f9e257bade4c23f78fd7fdc039bb83a1b8cce5d6255ab58326ed89e727a84c59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8fcabe90ef38d817f030ef5415b6d487

SHA1
4efad33b979a04ee2f8fce29b41fb88ea8365d59

SHA256
669700080ef4cfc0e4806fc6ee3ac554779f1fd5fbcbbf24aba408b555f22c3a

SHA512
1e314cbc7d896e46c3c0e949e1182eb3b032d03efc1a2ba4c0cdba886892459f23a3832f366545060d2acc0f49239e95b40b3dc7c722413ab17a32652a000545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f390c7cea7b314efb10d919c4417a3bf

SHA1
62d5ca985c9be836992eea9c83f176a4f3632926

SHA256
88939bd1bb12a405d92e622bfb92a1490921a87a52e2d9cd72ddd446a6dc6b25

SHA512
f7149b3532bef9ca886eedae80b390b4e923e4d0dbc7b3e5881efe3a6acecdb413904275d50de9ae1c613df2a1b783d6d38e235e029b24866f04544f127b6594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
8b7da7281c54780a363f249c863e0c0e

SHA1
31287f18b314f5ef5d6c02234f883bb833f46359

SHA256
e076f047b102f9efef27d6a0f97b806630b599fd7aa57700f9e181ebcd0984e4

SHA512
c88e4fdc563083e437a8e46b98d0becb21288934267c4f01bfd8610865607aced1f942a59f2271ce986bb28d93332540311174f504c46e51a16c0b762b8154c1

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\1bf02068-30fc-4f65-90f7-26fcfdb9d911.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\Desktop\Client-built.exe

Filesize
348KB

MD5
bcf2c658c7f440a1831ce1422d2a03c6

SHA1
9789073d43f73e8012c8d8ae92962be951d2c71c

SHA256
b8550492c518913e5658b464fdf73edd2861ba8dcd9d8a8ebd2326fae349dcef

SHA512
1ff5abfd20989b36b3748df314d429815c07f41854d65a9a5ce48b4e64d7b16137c0b3700f532be87edd4a15d469035093be70f20998009a92c76f00a095168f

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.3.0.0.zip

Filesize
611KB

MD5
ac17f5bfbdc14e9d9e8100d64cd9094d

SHA1
dd5b3afeb326fc02a59e3eb667abd68e2088212c

SHA256
30a4ec904324aab10b9f77127944ec98e8e1f222c893c1862f3bed4970ead8fb

SHA512
733a79e5326f6a09b5c4b4fa648bb967cbdf5ec00b389df8a12ddc0c46bd326e4ca7ad98e61b009a373ac404828444094498408b5683fec4e63251900ba3621f

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.3.0.0.zip:Zone.Identifier

Filesize
606B

MD5
ddbaf51fd724084650379feef8097dad

SHA1
fc6693616cb9ef37e2be3dfa99fd285ce7afa570

SHA256
8a4f443b75a15772308e64021582ee4e6d1f025ff3af15f51d21ab0433942264

SHA512
7228f200cb54ee75f19dce893f1b7318e3cfdf07f09e5227907e18b7fe440580cab417fe7b0a3f76266b089bbc5211d025677f7306e6e253f091935c837da168

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.3.0.0\Quasar v1.3.0.0\Clients\Admin@AOYVSZIO_872C1E3\Logs\11-22-2024.html

Filesize
161B

MD5
785a01e7b5c17d8443338555d0349349

SHA1
bd0cc80dbbd1304536fc6cc894a82abc0a8da470

SHA256
c8f93547f6ee920faa0199b3d05ed3408283177c3221c55e2deb04ca10f1160b

SHA512
9b6f2059253923fc71006567febd7a57a63ea030459f86698be161a66fdc262b894e657a7a6f0573a6e156f6575ff73cb15a8b09c810f608e13ca05541b46dbe

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.3.0.0\Quasar v1.3.0.0\Profiles\Default.xml

Filesize
783B

MD5
76d3ed0a5f704d64b3829961c30ea67b

SHA1
d225f86aade23f1c75cf6404b29059885e500314

SHA256
ba09513e9f63d8c8879e386c5fb181d848a3b7e1798caa068ac04ee691869fb0

SHA512
99c94bde812cec2b3615de46628e2f4c2dbfcb2ea375658bdb5d479cbd9e8dd2d159497beb1f2e1d82a1364da5fb0fe4bc05fd1865dc51b023308e53ee6a2e56

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.3.0.0\Quasar v1.3.0.0\Profiles\Default.xml

Filesize
1003B

MD5
96d28b6310a6897bc2017744fac3a6b3

SHA1
75d2ced47b754ddc22ce8645756dafe39c920b6a

SHA256
21cb724124c69c8f54bc180db83d0a9df25b5675841fd01bbc770da84907fece

SHA512
9fcfd39ac236db963313b9f3c6b726f3aa8209c4b37081c95e3e4e361669eb433aca9e449b9570a0835e34a3ce957580558741d910ee12db90de4f4f97466c73

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.3.0.0\Quasar v1.3.0.0\settings.xml

Filesize
475B

MD5
4372ee4d123ca18d933c173df0712388

SHA1
8f4f50684c6ca0fc86e9e65aff49f3201fe257d6

SHA256
8dd4129c7d5d9ff37311026661277b4388c13299f76c5a92c28a394516d9d03c

SHA512
9bf97d44205df2c90a0c3041a28ab96a9b3f09ab076021bee6aace57787651d170a78866e2ba9f875accf5bf2ff7d9adfb3816278a177a29ab1b8666e0b4f5e6

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.3.0.0\Quasar v1.3.0.0\settings.xml

Filesize
51B

MD5
8af01757cc429d1347430084913566d1

SHA1
e4ec570a0b1a5c99e0613da232eeff4b42ffaa75

SHA256
f1a33cd5b1c9368f73b8ff144bed026664577317df27baff774b2bd2acbd52ef

SHA512
3edbca5a661d0fbdd0f8aac994b50e3f844e1d6ee6bfeadf0d8aa89fab1b7cec69b9f687a704c7a989726bb676604e2cdb75ca30441e94a05fdd4027ec9a494a

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.3.0.0\Quasar v1.3.0.0\settings.xml

Filesize
430B

MD5
c66f9c71b325c88e4a0a37ec2f4477ff

SHA1
ee2d0c5e2ecdf53c3673f167d2c5fd9f3498de8a

SHA256
ebceb1e061f55fdfb57fa685bf011cf310a06f63d14b34a52031a16380a0d236

SHA512
bf53d0f2de9c11c8c2c44cfb180c236d9d56bdc49bfab74757d00216be5b5619f7687799013e871c1668ca9312da5a323a7071dd70e6d7a77e8670130b9b88da

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 385418.crdownload

Filesize
300KB

MD5
dade707a36f933ac197525c87bac2904

SHA1
a6da8583c26e9ae7051dab6ff94bf3929dc8e5fc

SHA256
dd44de32aee2bab10daaf681dcab1d5d795adcc63444972d86ea7651ad663f6f

SHA512
4b5e3bb9d591821d4ef8b0e82633f94fc5f28827efdae0ecabb93dc91bd08f5b730da4616030e142cbc092d2a4a35809e80f60b88dcbd059ae74af3d2037e0ed

Download Submit
C:\Users\Admin\Downloads\releases.htm:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\v1.4.1:Zone.Identifier

Filesize
134B

MD5
1f0d456d1e1e1f1745c28533833fa3b8

SHA1
6d0f393870fd4e9366dfb40008843542cc4102e7

SHA256
5c9346b30dbbfbc95784f893f696e716dee41733ebdedd5b64b1815fae736854

SHA512
3cdb047a541d91135273e629307a57267e58bbb12aa8bde4ff5247b1731b07a9024b64af6509a5a4fea7ada0d020c4d438005740823d75051d9de2ae1304ffe2

Download Submit
\??\pipe\LOCAL\crashpad_3168_WDVTMQMCJIGXHZGD

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2052-846-0x0000000000520000-0x000000000068C000-memory.dmp

Filesize
1.4MB

Download
memory/2052-850-0x000000001DA80000-0x000000001DA90000-memory.dmp

Filesize
64KB

Download
memory/2784-1015-0x0000018CB0B20000-0x0000018CB0B21000-memory.dmp

Filesize
4KB

Download
memory/2784-1010-0x0000018CB0B20000-0x0000018CB0B21000-memory.dmp

Filesize
4KB

Download
memory/2784-1012-0x0000018CB0B20000-0x0000018CB0B21000-memory.dmp

Filesize
4KB

Download
memory/2784-1013-0x0000018CB0B20000-0x0000018CB0B21000-memory.dmp

Filesize
4KB

Download
memory/2784-1014-0x0000018CB0B20000-0x0000018CB0B21000-memory.dmp

Filesize
4KB

Download
memory/2784-1003-0x0000018CB0B20000-0x0000018CB0B21000-memory.dmp

Filesize
4KB

Download
memory/2784-1011-0x0000018CB0B20000-0x0000018CB0B21000-memory.dmp

Filesize
4KB

Download
memory/2784-1005-0x0000018CB0B20000-0x0000018CB0B21000-memory.dmp

Filesize
4KB

Download
memory/2784-1009-0x0000018CB0B20000-0x0000018CB0B21000-memory.dmp

Filesize
4KB

Download
memory/2784-1004-0x0000018CB0B20000-0x0000018CB0B21000-memory.dmp

Filesize
4KB

Download
memory/3528-932-0x0000000005F00000-0x0000000005F12000-memory.dmp

Filesize
72KB

Download
memory/3528-931-0x00000000052E0000-0x0000000005346000-memory.dmp

Filesize
408KB

Download
memory/3528-933-0x0000000006430000-0x000000000646C000-memory.dmp

Filesize
240KB

Download
memory/3528-930-0x0000000005240000-0x00000000052D2000-memory.dmp

Filesize
584KB

Download
memory/3528-929-0x00000000057F0000-0x0000000005D96000-memory.dmp

Filesize
5.6MB

Download
memory/3528-928-0x00000000006C0000-0x000000000071E000-memory.dmp

Filesize
376KB

Download
memory/3528-935-0x00000000067B0000-0x00000000067BA000-memory.dmp

Filesize
40KB

Download
memory/5040-870-0x0000000020DB0000-0x0000000020DFC000-memory.dmp

Filesize
304KB

Download
memory/5040-871-0x00000000201A0000-0x00000000201BA000-memory.dmp

Filesize
104KB

Download