quasar | hxxps://github[.]com/NYAN-x-CAT/Lime-Crypter

Analysis

max time kernel
276s
max time network
277s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24-11-2024 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/NYAN-x-CAT/Lime-Crypter

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
5000

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

10.127.0.169:4782

Mutex

b89fc26b-bb27-4845-9096-0e57bf272621

Attributes

encryption_key
AE0C6ECDDB2259824D6C57339E9CDA6C4511BF98
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 8 IoCs

resource	yara_rule
behavioral1/files/0x0002000000040d1f-747.dat	family_quasar
behavioral1/memory/5040-750-0x000002095C340000-0x000002095C478000-memory.dmp	family_quasar
behavioral1/files/0x0002000000040d1e-753.dat	family_quasar
behavioral1/memory/5040-754-0x000002095E000000-0x000002095E016000-memory.dmp	family_quasar
behavioral1/files/0x0002000000040d15-855.dat	family_quasar
behavioral1/files/0x0028000000045280-1111.dat	family_quasar
behavioral1/memory/1876-1246-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/5268-1256-0x0000000000DA0000-0x00000000010C4000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	Quasar.exe

Executes dropped EXE 7 IoCs

pid	Process
5040	Quasar.exe
4632	Quasar.exe
5520	Quasar.exe
1848	Lime-Crypter.exe
5068	nose.exe
5268	Client-built.exe
5528	Client-built.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
38	camo.githubusercontent.com
80	raw.githubusercontent.com
35	camo.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5068 set thread context of 1876	5068	nose.exe	160

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5c50dd9c-9a5e-4cc8-a835-5b44693e812f.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241124230451.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nose.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lime-Crypter.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
964	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "7"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	Lime-Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Lime-Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\NodeSlot = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "5"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Lime-Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Lime-Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Lime-Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Lime-Crypter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Downloads"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Lime-Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Lime-Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 14002e8005398e082303024b98265d99428e115f0000	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Lime-Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 010000000200000000000000ffffffff	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	Lime-Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	Quasar.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
5524	NOTEPAD.EXE
4924	NOTEPAD.EXE
1132	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5756	explorer.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
2356	msedge.exe
2356	msedge.exe
1576	identity_helper.exe
1576	identity_helper.exe
4652	msedge.exe
4652	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4632	Quasar.exe
5756	explorer.exe
5520	Quasar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeRestorePrivilege	4492	7zG.exe
Token: 35	4492	7zG.exe
Token: SeSecurityPrivilege	4492	7zG.exe
Token: SeSecurityPrivilege	4492	7zG.exe
Token: SeDebugPrivilege	5040	Quasar.exe
Token: SeDebugPrivilege	4632	Quasar.exe
Token: SeDebugPrivilege	5520	Quasar.exe
Token: SeRestorePrivilege	4764	7zG.exe
Token: 35	4764	7zG.exe
Token: SeSecurityPrivilege	4764	7zG.exe
Token: SeSecurityPrivilege	4764	7zG.exe
Token: SeDebugPrivilege	1876	RegAsm.exe
Token: SeDebugPrivilege	5268	Client-built.exe
Token: SeDebugPrivilege	5528	Client-built.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
4492	7zG.exe
5040	Quasar.exe
4632	Quasar.exe
4632	Quasar.exe
5756	explorer.exe
5756	explorer.exe
5520	Quasar.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
4764	7zG.exe
1848	Lime-Crypter.exe
1876	RegAsm.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
5040	Quasar.exe
4632	Quasar.exe
4632	Quasar.exe
5756	explorer.exe
5756	explorer.exe
5520	Quasar.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
1876	RegAsm.exe
1876	RegAsm.exe
5520	Quasar.exe
1876	RegAsm.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
5756	explorer.exe
5756	explorer.exe
5520	Quasar.exe
1848	Lime-Crypter.exe
1848	Lime-Crypter.exe
1848	Lime-Crypter.exe
1848	Lime-Crypter.exe
5520	Quasar.exe
5520	Quasar.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2332	2356	msedge.exe	80
PID 2356 wrote to memory of 2332	2356	msedge.exe	80
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 2848	2356	msedge.exe	81
PID 2356 wrote to memory of 1452	2356	msedge.exe	82
PID 2356 wrote to memory of 1452	2356	msedge.exe	82
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83
PID 2356 wrote to memory of 1168	2356	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/NYAN-x-CAT/Lime-Crypter
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb5a3e46f8,0x7ffb5a3e4708,0x7ffb5a3e4718
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x150,0x168,0x164,0x244,0x15c,0x7ff657465460,0x7ff657465470,0x7ff657465480
    3⤵
    PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1224 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,14196524411596145262,10944877655348317955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3352

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2724
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5904

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap16020:84:7zEvent14330
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4492

C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe
"C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5040

C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe
"C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4632
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12"
  2⤵
  PID:5144

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5756
- C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe
  "C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5520

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap20013:120:7zEvent11032
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4764

C:\Users\Admin\Desktop\Lime-Crypter.exe
"C:\Users\Admin\Desktop\Lime-Crypter.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\Desktop\temp\khvrwvgn.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2528
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD354.tmp" "c:\Users\Admin\Desktop\temp\CSC608466525D942ADBFC510FEC0C1A6A.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\Desktop\temp\43yrdqqp.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5684
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD47D.tmp" "c:\Users\Admin\Desktop\CSC887416087C2E4F4ABD8C59103A83A97A.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3440

C:\Users\Admin\Desktop\nose.exe
"C:\Users\Admin\Desktop\nose.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1876

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nose.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5524

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5268

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5528

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Client-built.txt
1⤵
PID:4452

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Client-built.txt
1⤵
PID:2324

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nose.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4924

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Client-built.txt
1⤵
PID:5152

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nose.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client-built.exe.log

Filesize
1KB

MD5
b08c36ce99a5ed11891ef6fc6d8647e9

SHA1
db95af417857221948eb1882e60f98ab2914bf1d

SHA256
cc9248a177495f45ec70b86c34fc5746c56730af36ace98ac7eb365dbafda674

SHA512
07e62581eace395b0a9699d727761648103180c21155d84ea09140f9e1c9690705c419118545aa67a564334bbde32710225fe3aa92b0b4b4210cb91f0058b1ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Quasar.exe.log

Filesize
2KB

MD5
f6c287509481140fda8116c8e831b7d6

SHA1
781f9e972037007da6ebe92d0e9ba51f4fd5d714

SHA256
a23d0654fdd344a19d1c8e0feb6f4e1803292a4d033773e14dad26e17dbff661

SHA512
63ec7882fd46ecc88e50672478533be670a77dd4f8056418db59d3ce6e776e44f5a39a89ee99e092fcfb9be61079cb34f20fa8a3a5c59b342afe05e113fa8ab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2905b2a304443857a2afa4fc0b12fa24

SHA1
6266f131d70f5555e996420f20fa99c425074ec3

SHA256
5298bdb27d48c2c2b5e67bdd435445ef5b06d9b36c11394705b413ff3d0f51f3

SHA512
df85de0c817350d8ca3346def1db8653aaee51705822b4c4484c97e7d31282a2936fa516d68c298dcbbb293b044aa7101b3de0c7852c26e98ac6c91415162b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5391bd7b113cd90892553d8e903382f

SHA1
2a164e328c5ce2fc41f3225c65ec7e88c8be68a5

SHA256
fd9710650fc6774ce452b01fb37799cd64d3cdc282ac693e918e38322349fe79

SHA512
41957bea3e09c2f69487592df334edc6e3e6de3ab71beb64d9b6d9ce015e02a801b4215344d5d99765abe8ab2396394ac4664fced9f871204453a79463cc7825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
38KB

MD5
4a6a239f02877981ae8696fbebde3fc9

SHA1
5f87619e1207d7983c8dfceaac80352d25a336cf

SHA256
ac546e02b937ee9ac6f6dd99081db747db7af6a4febf09cbe49e91452d9257b8

SHA512
783cf2ae4ba57031c7f4c18bdac428a1074bb64f6eb8cef126ad33f46c08767deeac51917bef0f1595295b9f8a708cb297b7cf63fc3f7db0aa4ac217ce10f7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
37KB

MD5
d34875fe1c47517f4081a1e2c5bc91f9

SHA1
204fed3cda5eea26388e139dd1600682e7665cf6

SHA256
aff6fc26fb0c69a279bdf9b32b4d2560cd47039470cca8248534daf8d0876186

SHA512
aa164260951708910e1cc3d83c17f2d176427dcbe53e1e13cb539d65317a1750bd1e482850049e9c126aa5e70fbdd72db13d50367b90c8b8b37f01a264ecb148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
20KB

MD5
b701fd5ce841ce90ff569c641bf0cbfd

SHA1
923ef9dff528ad65b6f135828aa39340be591a9c

SHA256
26ac894bd46903e9b8d08bf85cf4c7795e88f7c9dd85717b7560e16acc007fe3

SHA512
67d8cbd5ca9334aa5c784bb73b2057d28e2a3687341cd62358b5c5211ba833e10909dada2069b49b0ef328c1a40d8e02b58d27385e3d944eacde240a4bcf2fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
24KB

MD5
4b3e8a18f156298bce6eda1280ff618d

SHA1
c929ff9c0cb0715dc5ab9fa66a469cb18106ed0e

SHA256
eb8429f5918f8dfb14c7f8b32620f3516303c812869e9e8d1059e759a1550b49

SHA512
e51a54976d11fe25486d35ba92f99b8de28222a7dca8c272dfc43d8f0bc1d34b6259797fd5a7aad9c1553c0881772875ba90e7d99f6175d16ffdd00586fe8ba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
17KB

MD5
1cfaad3a7f1973a02907d1b9ce15d01d

SHA1
1ab4a604be247934dbd931a13d4bc2a6903b1f5e

SHA256
16ec86e38e1e4415aa4474f449988de65007bdb7e1991a893318d3bff13b6590

SHA512
630d4bafc1e098e1e720815d8950ee5be7bf9a3ecc385e6b18dc327d46f79bf972cb27e716eea4d665e92f248e595f78ffb0facc4b6d19bea5e0df900f2c5717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
59KB

MD5
5bead0d2b2685032fc3f12b5a4f72a21

SHA1
118ba82f13acc96cc2b28a1192947b81fbe88c2a

SHA256
b74d05151579f9564a39b1287d81d6574c90ecebfdff9106480e29bf816fb610

SHA512
653583a04218e9cacfd813458e28bf8b784cde06a74672948a5b864216ead351a00f8d62ef6e06ea8e85e43048df27d8b6b0c8432d5842c8f3ee7bbbfae325fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
38KB

MD5
f6c1297fae3fc10f55d4959d9dc771ce

SHA1
2df076464b94b7b06d771f3ef68e7a1403ec3d82

SHA256
9aa5a405e664c215a315b794668de2faf252ee0bc0694596d82a1c0e91564ae3

SHA512
d0d3e4a6fda2f9abb60d05befceaec9f1dec9d5dd4a31df5eeb94f0c1c545cfdbf70b862d0340a460e6d0cc62b8df16d3ea839683fa534c67030e70a181659db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
16KB

MD5
da4fb15960b623d2d1e45e712eab4e9e

SHA1
4daa448effcf03190d1a8b38b4cd377d8a1bf0b8

SHA256
04a50722e2d7f3138fb002ddfd8dab1b0bf44803960fae3dd1f336118d8940db

SHA512
05a0acdcee52bc0708da2ee4a1da468e07ae8ed525e0d4552f36fa9bd3f465d5f982e2d58f07cecfe78b0834003754f1d0adacdfac70b3b1bc2a85973e4f1ab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
53KB

MD5
cfff8fc00d16fc868cf319409948c243

SHA1
b7e2e2a6656c77a19d9819a7d782a981d9e16d44

SHA256
51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a

SHA512
9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
101KB

MD5
9a861a6a772b86aaa2cc92e55adf3912

SHA1
85156e7eaf0d3bff66bd6119093610e8d9e8e5d2

SHA256
6e7cc83f3b23d5f48bafdd934321de60485eb8d9ced04c6299e07dc6bcbc0d1b

SHA512
b0a051e2e703227a55674fe235a97643ab1478af2384a5a974605cdd0e4ed79916d65e2adf61d19f59779da920699e74ac72cce05ec078f22f9b6678c5022a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
88KB

MD5
76d82c7d8c864c474936304e74ce3f4c

SHA1
8447bf273d15b973b48937326a90c60baa2903bf

SHA256
3329378951655530764aaa1f820b0db86aa0f00834fd7f51a48ad752610d60c8

SHA512
a0fc55af7f35ad5f8ac24cea6b9688698909a2e1345460d35e7133142a918d9925fc260e08d0015ec6fa7721fbeae90a4457caa97d6ce01b4ff46109f4cd5a46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
19KB

MD5
1e53408e78feddaa3dea2f0014d5dead

SHA1
3dbd20f4511465b8b18e4681ea24f9e0140307cf

SHA256
deb39cbf92259253ae2c5627f31489104612379e8d781a7b2bce775682c2d833

SHA512
601a7dd43d4e43ad479b4241d02652c5523b2bd900118bb2cfd579bfa451e96a6328723c61146ebc113e79c03bf718464504d43502836250fd6b3752e13d6467

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
6354549988e9507eb5dba81930e2ae89

SHA1
7771b430372775ef967adeeb74992b47717f6a73

SHA256
79110aac93ef374f1996d419f3c48d673ee5de0e94805384d432bfdcacdb3a94

SHA512
8595cd1aacce8f033ef03bd73234226182b2d667525bf26897f13c2bcc41203dde0de0bbfe8862a9b36bf0442609f43e82dd4d1e6f0958338b9ccdbc69f3dae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
50522943bd9647191737728d6065a510

SHA1
7d6e3f9b9be1394b46e24a5f540b91aefe93479b

SHA256
552cd5283d960988c15641a9971e1d81832e80c85476317e18e16d6478ad558c

SHA512
4cfac5bb7d797d621a7df25fe9e4e9a99a33a14b53fe27d69a90d1edb1d78756b5d014023a712e6776b4571276d84278d562a7af1127320c7d220cd4c39b7af6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57f0b9.TMP

Filesize
48B

MD5
d6bc931ff3ae3219d888803c36556b91

SHA1
91289cd9fc4eabce8c24743a8939fb079012f46b

SHA256
dfbdbd9b51f759930c503954bd9ff0870ba02dfa510d4bbeea2a05c74f56f776

SHA512
3da946772db0cd514a504a25004d7f89fc7be30a91bab281f102021e491f24b861ab4196742183810e27b0bcdfaf87e4b61ada1a4fa715976d1edce05aeb1cfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
941B

MD5
f35834b96f5d1c9107f28908bbd881ac

SHA1
61618d4eff202649d4ad07e79148e6a5ba3e5e99

SHA256
81948f53c65ddad8cb203647a6eb86bba84a77b80a4d68cbe72a2996b459c2da

SHA512
4e9c98c73d9169f5250d1a078124ab8907047f2eea63b2468db976612d526c7555c11617386e0b2a6595636af436eedd8d661a26fa32f8a4b5cc6e2726b8970f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe587385.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39f739fa86b2962ba741e15f96fcad1f

SHA1
00de10f3aa77c1730740746f75c8c64d5a67f740

SHA256
22a18a4c5acfb29199f8060cc33fe84e8f3b835e6e625e2b64b9caa3aa6931b0

SHA512
e4440242286a7747d3928a67a30920d6dd829fae3f71de9cfbac2a40164c22e2d5e9c4efcf93a83f4d9c7768d1eb86f9567d133cefdbf68c49fc2515ae5b7924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
24ad043e577b008add68e0ebcc4e0b0b

SHA1
128d6906c6eb240c108f9422e7048cfa13d686ff

SHA256
2a20632cd2aac2e780897c4df40181eb115fb98a4f0acb1f432987f7ce0a8832

SHA512
cdc28644decdf6ba6965de02409823b9e3efc44ac49d984e5e1ae2d3ce9bfa75958f09d2597ac8e781925535ac900fbca4765a72a046394a4a71956d10ce7891

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae90bb794114297ddf87506d04c14944

SHA1
721c4cea5be8c099f673077dcf0bec9561dabaad

SHA256
3faa9e5cd5dc94f7e65747ff96c374219b322323a9fdcbf258cabc417c7ccde4

SHA512
65a6ce262acd8d94ed6f05d68f80303c1dcf78da3e479842895c2728f28d1457f9dd1485fc83942cbf0ead74c67a10e6b7725b09b0089c20961b5f3e52a90f2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
01e56efc6340f4e51391a3564880934d

SHA1
51f98c0c3ffda3a6347d40e04cf0a5be6da76521

SHA256
cdc4de89076b35b315c3d8a5d718858e40ca93faf7764251cc6a6dfddd501f76

SHA512
3e4e41ec298595055d414e7c95a66545fc953a67f607a82887c894a54ba3b145dd2d14771d7c2ff473c4330e82847285356660ccd42b6eb3c54823ed259f0814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bde1dd6dca93f7d9c5a4b4d81553cf72

SHA1
9f1e6e70b67db05cbdb2235a088c62cae142c3f7

SHA256
9e00b36dccdedaf3cecf8a294535a0934cbf056faf56abf230bdeddf94896fe5

SHA512
8479326055a0943712f93b6daf4ba67961cbab81c026f34dd6884f385fa52220ccd92dfa7f7e9a9d532a91121bd97b45deb3420c0ac5fdd2e2d2db582571bcc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f789b53ee900a3878ab1ac15b33cdbc1

SHA1
b53f2d36900631f1e70f9e83fa78c4fce2d37750

SHA256
a68b1574a36fed003a4497eb042d05f9420a79db6dcdd42236a56f61eb04c9d8

SHA512
2deb4d294f5d4eaddf6080a3eb6498c3a557b501376ce7628a015424182159c949b7a00c82d179e978286494bc8e938bc4c4fb061c7b226c1ecafaeb190b7811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e6be1b69dfa2b8cdb30e6b2456a46bb

SHA1
d2ed60b47748c87d8884d0ec5ed0e622b5ae62d1

SHA256
1b7f20f72d34ecd0a31216d8585cce5e2bf49a9ba1a068f50d948feb8ca3bf5d

SHA512
b721b7a1f14011b2f6c669f8fa13aebed3a8a09455fcca820b1d2a26b1890d4aa32e128e5248622376dbcac1ea7918e66eb62e06f660130520084494b64aa639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ad9709100fb43b77314ee7765b27828

SHA1
5cd0c406c08c9c1073b0c08169ccaffbd4ef6b98

SHA256
04b61824ffce6fdbae4e6a527ae58b85813226ee28fe4d631feb76b5f936a1a9

SHA512
fc55ee34b1107e298f2cfcb20dce42b5dbc98a7b68e72ed80a6ea594f66dff6f9e9cb70ad5ccbf5ad2171275f375abac1defd8dad4118afa280cd9c1d9f6a538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e122fc93c0ad25d45d09ba51a3e86421

SHA1
bb52a7be91075de9d85f4a4d7baeecc3167c871b

SHA256
a277c1c6fafd7a44b47d94e4bc3c0337a64a34d252e58722855aab09e6f52bee

SHA512
12787aebefd6a5e4584ec8747a78538f948a16b214bdf81302036ae89e2c4563027847236a4770c4f780a9ca0ed03f29b1577bfb6f11feffad85b7a625324bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e69f35e0f3213d76f0efd4cc3be818a1

SHA1
37c80db56c44811fd6ebce37e182cb4f2ab4e574

SHA256
d54fa73b9c74978551af9000b7d40e130f3bd5cc8d00941a8ef2c4f5f9521131

SHA512
c932feda02d796445fe792184895ada3797f3a96cce104f1fb201c9e9659d25ef92772506d7a7795d29b1aca08a1f7b482710dafca255e360b41181c453cc60d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bbac8cb79f0c65e7438121e24a1e6894

SHA1
8d658d0d23cdf7d3d3b452a02a273b1aa8727744

SHA256
3db5f6a25850fe3ebb3ddfd4e6031508d25f3168b3d242962549649d66377b8f

SHA512
c706d7ccae5943378dd36781e4b8506418e98fe7110055171b6b165b53019653ad45147eda30cae6464feb903a9ff0f47ae3892701d593922a1efad1377bcafc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
52b264f9e75373df7c6a7062cf603f2b

SHA1
17cbe3d45dce08eb5cf7b1d5bac02687f549e562

SHA256
3b78079bcd570f7424126e14808353ea527b47d580435388e2547b5bc1146c0e

SHA512
949ce2df17afd39baa3cdf9a9eb252cdfd5543bc23d08172bf58c4f63ab5a50bfbe14cad77588b61f510bb8a837f7485e36698c43bca38c274c968cb940653e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
290c1c6b8f6ea1341c53ee502a9e8f15

SHA1
2cd095d7d8d47bfb74e4f72cebd8cb1161efee26

SHA256
07070fd102e4445ec661cbac48b705fbdab0c31f3b7692319ee48920e0912be0

SHA512
c1c43c5061ae1e966e57fe2f05fc254b3ee898a3023f2653ae4b7ae6296cf5909634fa4aac79bc863470da6bf3d3c5bbe8086d58f3a822a9763c9df31ed654da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b287.TMP

Filesize
1KB

MD5
dd34aab473065d9132398fb326ca518b

SHA1
033249b2cd3441ce77bba96983beb3cb4a361510

SHA256
7bba5e04f54b31d9e15066b96414230660607b2677b3d802d1d36ce52cc7f029

SHA512
fce0b47dda3783eda6c02c53c5a89196d14d4b48779a197efc591da1d9d11d1bb5272ad6d3f6266a129a13fd51adbfe811c4b753249c27ef5efb0c08e39370f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dcdadd3918c45cdcf9591b851c8aec6f

SHA1
aaabb5ced48f51de1e6cf6460003c42dc51f5f12

SHA256
7e5a8ee962928a4bedba0bb01e2f103e34867e9db62888ee3694aa2fa0383727

SHA512
385e600c8408728ab91e2affadd1d0491cff709628a7621f48c2766c3c916a9dd87754458eb60383fa8c93c67afce347a4268c90aca96fefe65c8d8d365191b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0b22ac5e488389d1def8131a19ae9344

SHA1
03c9352b94e1b4aa9004108568bece466ed10c63

SHA256
b3b23a0ef34a1147af68e466c523027f41c586d8d756493972fd613c2f38e24b

SHA512
3f6c537755cb1d77d3c1cb7482cb137f5cbd6f932fecf097b55cc374a8544625b898abe2d1aa1a70bfd13e5a63c47373c4b539acb0afb8d033bcaafcc164c119

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2bbdb3aa09054255f2a369807bade5ea

SHA1
600afeb62a5bdfe3986c4071d7852a1a438e457e

SHA256
cfa844119ebe47275fd5515375152d9575d8d18a106015fcd599a4d6779724f8

SHA512
f6e586fcbcc271b7f3b313f98b3ecc8034be18082079aa4a161fda9af96098feefeaed632a80faefda222eeb065cfafbf48074d9ff73fccecc644b01b0587106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
2c543cbbb9d8b8689ff24ac7c5426f7c

SHA1
20577d7a2200df5ecc723b352a3cb42b63adc90a

SHA256
ba6c4ee19a17429bcc9865f1343e021f2d5ba9261cca8d38d3ecb7be8a5ced6a

SHA512
afabca896abb5f429695f913407aae770466e4086f73df66005ad1153d139112e2aaf35639505960ec847e100839d9f0ec10c32b5b7a314967588de6e0181153

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD354.tmp

Filesize
1KB

MD5
400a16801ea2412bcba35c4f23b7509a

SHA1
febaf40a9a5a0736647de893864bc55518ca67de

SHA256
56156f838100784ffc312353f994f12b74aa2d80bf2a2c79869c8529431e0179

SHA512
e853a44916a9f0f40b9893ca933db41ee952e986abd8a5662a59498864aa228b383efec99f38498514235ae78d9f392ca1141aeaa46e3cfccfa4fd6f54f17330

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD47D.tmp

Filesize
1KB

MD5
915de80c3728445f4eb1af60f79781d4

SHA1
9a12772199a97040be2836e18ed77101b3c83b57

SHA256
b2e51448e8759083038bf65b1a178a61fb7d8b190efa8857f1fc44b65365899f

SHA512
e2ea0db64782a5814eaee066c5077168106500d9e13519823d9048d71e9238374a26b3335b1ff036aa6007c1cc126194353a4553cc74714137a1ad674ca14e1c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-641261377-2215826147-608237349-1000\926a0ef5f5b82902bf8a09b57459c8bd_f3840e4a-de2c-4602-8803-a39d71cd611b

Filesize
3KB

MD5
fdf68726b4d40dd8c6d0fa07d2846527

SHA1
60b040c25b0cb05e2dac842df597d936f7a04a46

SHA256
b91751de260ed7c9ba44bf8df8b0ddae0fca5becfd36698653db5d1033c98854

SHA512
a9a487d52b7e02d03a2e5739b1cfd89f8dd43a5544504dc1ff06e4ce53e3ec41decbc20159178e8463990b7e2bc9b3d27d2bc19ef9a96ebc26a20980a7772b97

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
82ea65e9c388153ac40cbcdb9327ba77

SHA1
9e955227bee78a43e50542ef94c005596c07e6b0

SHA256
c8c60ce1c9730672d0bbe8ac2401c7be9eaec951f7d84e5faffe39deb0b2c5e4

SHA512
560a5afcfa71f0c2fed1269e667ab603ab805a9c441dd0d27bdc68be67c0b07e15fb63b0803d255bf139d803b896b411ed195b221a36b5c6c1b54cb11abcd05f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e893a230e8f69daffa726655d0b90ddc

SHA1
c850975c31c17cca95406d6ed02f9ac312af23f5

SHA256
4efecd21cfedfd6deffef50834f01b1a9ec4be347aae43fc6150b530652a2e1c

SHA512
2a35e5e83608033d189287150ff2ec66a9dc7100c38d9fbb4f5dc37efe33f84450d9115c34ccb0a43df2939d1b774d9d800a8f3dc0cc902dc60d9d951862c895

Download Submit
C:\Users\Admin\Desktop\Client-built.exe

Filesize
3.1MB

MD5
7ee6b8319ebaf082481f976909582a65

SHA1
238ecd72b2a83e468e17d27308b9b3e6f9b4ea36

SHA256
11d660b7407a6fb7937a6556aec84c0170b4fc76cfcb07be0ca978e40229706b

SHA512
0808732c202eeab6229d296a3516fbc2b12b093d2619d4093a490bccc5550dcb2031989d08acca72a0bc584d3b9197b32836f5cfec4e33b785f94615e7c1f7b8

Download Submit
C:\Users\Admin\Desktop\Lime-Crypter.exe

Filesize
167KB

MD5
58ab7b9531186d0a8b5863410ac04fd5

SHA1
7a73cfba5e4a4f997f8627a937e4e72543fc47c9

SHA256
aaed720186b8f320d1c1f95637157c99c714ae21e496112e282eb110cb53acf8

SHA512
25b94924fa64b1333591e1581cdde4ed5ac59e1155b1a7a2741a87528e312238c5f8de6482b53ae7d3481e6a30e660fc2c5416bbbf6731c350e74f48b903ab70

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\BouncyCastle.Crypto.dll

Filesize
3.2MB

MD5
0cf454b6ed4d9e46bc40306421e4b800

SHA1
9611aa929d35cbd86b87e40b628f60d5177d2411

SHA256
e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42

SHA512
85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Gma.System.MouseKeyHook.dll

Filesize
56KB

MD5
bfb3bd1cb571360435100bfa6ed2b997

SHA1
1325e8dd76180a165117e04da4ee4a020e996880

SHA256
a67a424013544c8270c12633e2e1e287cd5cf0b3f2e81e8d8204b37a03da59ef

SHA512
ae5a88a9e86b9e64b8c289213f814586dfa5fe5e0cc21bdbc3e48c36d81fa9e763c6e78f24e40df07696228270ad72f408846125e61e33cae867ef8ff88a3c15

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Mono.Cecil.dll

Filesize
350KB

MD5
de69bb29d6a9dfb615a90df3580d63b1

SHA1
74446b4dcc146ce61e5216bf7efac186adf7849b

SHA256
f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc

SHA512
6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Open.Nat.dll

Filesize
68KB

MD5
cc6f6503d29a99f37b73bfd881de8ae0

SHA1
92d3334898dbb718408f1f134fe2914ef666ce46

SHA256
0b1e0d8f87f557b52315d98c1f4727e539f5120d20b4ca9edba548983213fbb5

SHA512
7f4c0a35b612b864ad9bc6a46370801ed7433424791622bf77bf47d6a776cb6a49e4977b34725ead5d0feaa1c9516db2ca75cb8872c77a8f2fab6c37740b681f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Profiles\Default.xml

Filesize
1KB

MD5
4e88e81446d99480976e71cf7a73f725

SHA1
435bfead9f640252ae2502aaa8068872097ec14d

SHA256
9972f7122acdf7f2ee713ce00bb4ec2cd1eed79096ec484dff68aaa788da56ed

SHA512
1d33903b98d0831c20646a3fd88f00f6b1c7578122fc7abd056976ddfb64acd3b34c58e482dc7d31b97eb5d383382dd63969c736ccdc63e7223e89a9bebbbcd6

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.Common.dll

Filesize
62KB

MD5
2185564051ea2e046d9f711ed3cd93ff

SHA1
2f2d7fd470da6d126582ad80df2802aabd6c9cea

SHA256
de930a748e4dc08c851ba0a22afce8dcfd0f15f23b291f9306c8ef6ccd7460a2

SHA512
00af241c1f89b478e66d758db26ed0a413b690d695abf91211b5cbc3985133632327ea0fc41140bd61d02271b6aa278a8e8f539d8ca6ce94972aef50c1a9c868

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe

Filesize
1.2MB

MD5
12ebf922aa80d13f8887e4c8c5e7be83

SHA1
7f87a80513e13efd45175e8f2511c2cd17ff51e8

SHA256
43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e

SHA512
fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe.config

Filesize
176B

MD5
c8cd50e8472b71736e6543f5176a0c12

SHA1
0bd6549820de5a07ac034777b3de60021121405e

SHA256
b44739eeff82db2b575a45b668893e2fe8fdd24a709cbf0554732fd3520b2190

SHA512
6e8f77fcca5968788cc9f73c9543ce9ab7b416372bc681093aa8a3aad43af1f06c56fcbc296c7897a3654b86a6f9d0e8b0fe036677cf290957924377bc177d9f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Vestris.ResourceLib.dll

Filesize
76KB

MD5
944ce5123c94c66a50376e7b37e3a6a6

SHA1
a1936ac79c987a5ba47ca3d023f740401f73529b

SHA256
7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a

SHA512
4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\client.bin

Filesize
3.1MB

MD5
f4d16cfe4cad388255e43f258329f805

SHA1
fe7cc6c9eb76b5ad97867b46d053fae601fd4a2d

SHA256
8fb6ae3496d4ac025eab443d3e322b0faa3461d25b54093c9205d35746e3250e

SHA512
867045eac0f7765e6bea51e62bc4ed68b1e81ce6c2843d2e08714eb391a8ac94c2571c09828286252248400ea5c12bffa50a25c8ec5ad9e6d0bb836320ec188f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\protobuf-net.dll

Filesize
282KB

MD5
abc82ae4f579a0bbfa2a93db1486eb38

SHA1
faa645b92e3de7037c23e99dd2101ef3da5756e5

SHA256
ca6608346291ec82ee4acf8017c90e72db2ee7598015f695120c328d25319ec6

SHA512
e06ee564fdd3fe2e26b0dec744a969a94e4b63a2e37692a7dcc244cb7949b584d895e9d3766ea52c9fe72b7a31dacf4551f86ea0d7c987b80903ff43be9faed3

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12

Filesize
4KB

MD5
0983a6a4d0c6eb9a7a4769270f042e8c

SHA1
592ed81cad5be1a4b1432762fab07702409e16d6

SHA256
6eb87d5ce8b15140f76f39a26241e21a5907dd3a6401ea4a99e411a9e2780ed0

SHA512
6ea0615faad890a72292f48548492960a35bad90c6c9b2cb247546bc3e3243a31eb7bb5a5a32821a92837be0adc6e536ef46eafff316271c95f74e011c4d77b6

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\settings.xml

Filesize
334B

MD5
2fde25c82ff5d5c6f790fd4af6e3c2e4

SHA1
b1abf367c19154dbc73bf212b060ba8d5a217b4d

SHA256
c5434f7001ecd201213cbed742801b75673c0f4ee9f5b8aad701c1fd2b511efe

SHA512
f79e7abf0a2d72a8a34bc9972a690c7678bed3dbda586abad3a1c0790d8d019ded464d5b95c86e465cef6aac8b5e5228ec93ce7b22445549659a16c6163d80a8

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\settings.xml

Filesize
371B

MD5
482b40c0d7aa8a3d1bbf44e34b4d2ca5

SHA1
d6d24c92b01a2d8a1e9cd5a15669443091f1c7a7

SHA256
40adac53b3488585f0bd0dfc919d7d145184d4b78ee7641d721bfdf141571c31

SHA512
64774f6c520ba1b99c353d79747e78d07dce9220ba9d4a0d81d8abd6d593ef32941b73d7795e1666b0777571bca194d9ac7b6b4394c1b2bde32387ea4ee2f813

Download Submit
C:\Users\Admin\Desktop\nose.exe

Filesize
3.1MB

MD5
c4ad559846bb47fa7a68ced1cad8a7ad

SHA1
98082fcdfa59de4654eb07e26cb6b746680958a0

SHA256
7c56231a50e3e6754143c53ed9d7df70dac03a9c73d68c2516dea920c01ab95b

SHA512
b96f50edc5a56a3ef79299072fc5b8553dab6685a7236d3b451714c305cfeb11f863de4ce2e43bfac25027d3c1e27c364bd71167e275a447a185ac84b8aa4098

Download Submit
C:\Users\Admin\Desktop\temp\34gkdkewa40.dll

Filesize
3.1MB

MD5
1b723d3de78d3449211ff7c963a9c715

SHA1
571a9799ee0e45ee129c5157d7887d2cf2d8b69e

SHA256
bd3a80c5b97aef3e6c724b306370476bf534839776de4a65b0e9d8895492074a

SHA512
0e1abf341e295b14781adfd51336d6451fbf0f8d75434faeff138192d7235f624bbaccffc3f4aaecf55f5510796f8317d4463c091983362d21e7426fa36da354

Download Submit
C:\Users\Admin\Downloads\Release.Lime-Crypter.v0.5.1.exe.zip

Filesize
47KB

MD5
fbd01d273852e31f955890c6832272f3

SHA1
b49388b5e74b331009421073d631af59703ad81e

SHA256
9470e439c81b36707cb0ada8e5701551f93d6d2608f677b24051c1773b64822e

SHA512
d7de5c1e58f71f150eb1764aaa3c7fac4856b964e7a4136e9c06e9cb99ccd05d67c646004e4f01d4c13927fe5c1a11c46dd3a4af0be886e737240ac3eaaa43d2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 825178.crdownload

Filesize
3.3MB

MD5
13aa4bf4f5ed1ac503c69470b1ede5c1

SHA1
c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00

SHA256
4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

SHA512
767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d

Download Submit
\??\c:\Users\Admin\Desktop\CSC887416087C2E4F4ABD8C59103A83A97A.TMP

Filesize
1KB

MD5
18de496cba6330f087a3a84019b22655

SHA1
4e6c2d2011941e4edaa539e629c9aa63065aa5cf

SHA256
825e7bd202bf7967db75b867cca8c35331e79569c70c5b1bf94ca55bfe42f54a

SHA512
9ff9c7d5f75930e4f192dccaf7e6578d05790ba6c90b0362d9ae1ab3201fc40d796a786ebcfbe10a3f8632e85268f325c75cf0d8d6934e15efe4e215e5e9f520

Download Submit
\??\c:\Users\Admin\Desktop\temp\43yrdqqp.0.cs

Filesize
2KB

MD5
0c999d6599006185de5de0fe196ecd2e

SHA1
8c643f2b7984a54cda7a19d340b36e9164b850d7

SHA256
b7d6b207742ee556872e426e8b02449642954d9a49b163d7adfc2b4f855b2cdc

SHA512
b39d6742f31828acf5565bb26c39f82cb40b6f6d51d17c452f1c29d316cccb340528b827e8fd424ddb36342148716d26fd000c2894e8af63eded6a61f4356f72

Download Submit
\??\c:\Users\Admin\Desktop\temp\43yrdqqp.cmdline

Filesize
346B

MD5
7b915428dab7a8b0e901563e9a549c57

SHA1
df798587747c775a83ca75ccb6a318076c0620fe

SHA256
84f8c4c3c8ccbfca6fa0ad47860ae9d8a27af06d1d0f24a2dfa1539a50208dfe

SHA512
db9399a11633690e96a655b19cf16e48573f7eb5cb110882bf933f27a660d3389b5d89b85fa9e3f09350e60d994a6ad0e66f1f6f603f966c7c1242f6d9f807df

Download Submit
\??\c:\Users\Admin\Desktop\temp\CSC608466525D942ADBFC510FEC0C1A6A.TMP

Filesize
660B

MD5
778f852a2ed13ceddcf5ba607383e107

SHA1
6c91bcf03916cae5a10a71bb670a9e4063a67c96

SHA256
67e4fb172cc7f93ae38463abb7c90950a4e5b4abbfe719e1bb7d9342e34bc95b

SHA512
b55f4b78967796b6b159158071d654526d75a454461459af21524a0bfc0c5cc8beca1df029ee21109cfd80d341c82f52272493d21c8a7254267f50c6cb7cc366

Download Submit
\??\c:\Users\Admin\Desktop\temp\jjumjcj24pj.resources

Filesize
3.1MB

MD5
57fe971ee8c6f0cc4c6875476c006b4d

SHA1
e23370e333109b7f9280c2e3890b55c78f1682d5

SHA256
c630d3b1dd46146d6276d027f604b11182ea2c9c7c0a0069a713855720d49029

SHA512
f3485ca735c3a95176254b64375c4b2746f3bde20c9d800ab634ee57034c3d3a33e2b90fcace2428020c5a2f243d3fd737a69c1692619165586fb3237f229ef0

Download Submit
\??\c:\Users\Admin\Desktop\temp\khvrwvgn.0.cs

Filesize
16KB

MD5
9f0b3cd8b53d5001683e04d5138f2c1d

SHA1
f24f6f738c64c604012bdd83efcfc717e800d754

SHA256
1bf85644acf69db0006fbc70494f03405a107b068f9b1e2feb47bd49063d8643

SHA512
8c0b2e8348c23a69090fea8d01b9a88eaa7d10b2664a5c2d363b8875896c787a9daf2eb5fec9907b17daa2f7f7289600dbc0bc280ab979924baef687daa19edc

Download Submit
\??\c:\Users\Admin\Desktop\temp\khvrwvgn.cmdline

Filesize
363B

MD5
7e33007125cff0385bd03077eb664728

SHA1
ec18856e3d07f4cb0d506f018c0a1d1ceb35ef9d

SHA256
abb2ab297d95be4ae93e369d62b38fa57c385d9ce7f73f37879d2881447e1b0d

SHA512
297ecc9e75b57b6de76be8786065acb976af00092d55a817ad2b0fffc49b1862dd99a3bcc9bd0aea52386b4772ee6a1d2f9c926387e6195bff9d403b4a980c36

Download Submit
\??\c:\Users\Admin\Desktop\temp\pqafrqza2wz.resources

Filesize
3.1MB

MD5
e8fddbf2ebd22be5aa3e951154e3314d

SHA1
43f862b7bd1ad1ef94ef183437594dc82588482c

SHA256
2b4a9baf61e36625f8e7e3d08da4c559823cb39383f969346def23d2bd7e2e42

SHA512
42bac46a93d02c7fd700d8bc603814806a51fb65420de895d59da7f8b4a95452eedfa2c58469302c81d96c15a3591a1274259900ef737993dd53a532af1c8cb1

Download Submit
memory/1848-1091-0x0000000004CD0000-0x0000000004CDA000-memory.dmp

Filesize
40KB

Download
memory/1848-1090-0x0000000004C20000-0x0000000004CB2000-memory.dmp

Filesize
584KB

Download
memory/1848-1089-0x00000000052F0000-0x0000000005896000-memory.dmp

Filesize
5.6MB

Download
memory/1848-1088-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/1876-1252-0x0000000007FD0000-0x000000000800C000-memory.dmp

Filesize
240KB

Download
memory/1876-1251-0x0000000007F70000-0x0000000007F82000-memory.dmp

Filesize
72KB

Download
memory/1876-1250-0x0000000006F00000-0x0000000006FB2000-memory.dmp

Filesize
712KB

Download
memory/1876-1249-0x0000000006CA0000-0x0000000006CF0000-memory.dmp

Filesize
320KB

Download
memory/1876-1248-0x0000000007110000-0x0000000007728000-memory.dmp

Filesize
6.1MB

Download
memory/1876-1246-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1876-1253-0x0000000008080000-0x00000000080E6000-memory.dmp

Filesize
408KB

Download
memory/4632-810-0x0000023BE07E0000-0x0000023BE0830000-memory.dmp

Filesize
320KB

Download
memory/4632-809-0x0000023BDE460000-0x0000023BDE478000-memory.dmp

Filesize
96KB

Download
memory/4632-813-0x0000023BE0830000-0x0000023BE087C000-memory.dmp

Filesize
304KB

Download
memory/4632-766-0x0000023BDF040000-0x0000023BDF36E000-memory.dmp

Filesize
3.2MB

Download
memory/4632-811-0x0000023BE08F0000-0x0000023BE09A2000-memory.dmp

Filesize
712KB

Download
memory/5040-754-0x000002095E000000-0x000002095E016000-memory.dmp

Filesize
88KB

Download
memory/5040-750-0x000002095C340000-0x000002095C478000-memory.dmp

Filesize
1.2MB

Download
memory/5068-1244-0x0000000006EF0000-0x0000000007216000-memory.dmp

Filesize
3.1MB

Download
memory/5068-1245-0x0000000005BB0000-0x0000000005BCE000-memory.dmp

Filesize
120KB

Download
memory/5068-1157-0x0000000005B10000-0x0000000005B86000-memory.dmp

Filesize
472KB

Download
memory/5068-1156-0x0000000000DD0000-0x00000000010F8000-memory.dmp

Filesize
3.2MB

Download
memory/5268-1256-0x0000000000DA0000-0x00000000010C4000-memory.dmp

Filesize
3.1MB

Download
memory/5520-852-0x00000156BCE30000-0x00000156BCE8E000-memory.dmp

Filesize
376KB

Download
memory/5520-854-0x00000156BB9C0000-0x00000156BB9DA000-memory.dmp

Filesize
104KB

Download
memory/5520-1261-0x00000156B8F00000-0x00000156B8F12000-memory.dmp

Filesize
72KB

Download
memory/5756-1046-0x0000000006650000-0x0000000006A3C000-memory.dmp

Filesize
3.9MB

Download
memory/5756-829-0x0000000006650000-0x0000000006A3C000-memory.dmp

Filesize
3.9MB

Download
memory/5756-814-0x0000000006650000-0x0000000006A3C000-memory.dmp

Filesize
3.9MB

Download