quasar | hxxps://github[.]com/NYAN-x-CAT/Lime-Crypter

Analysis

max time kernel
221s
max time network
223s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24-11-2024 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/NYAN-x-CAT/Lime-Crypter

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
5000

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

10.127.1.117:4782

Mutex

bd747b07-4881-4e19-b67c-7424db4c9c00

Attributes

encryption_key
713CA4B737BEC5D3B6F68A1D4AC64155946D4161
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 8 IoCs

resource	yara_rule
behavioral1/files/0x002800000004527a-678.dat	family_quasar
behavioral1/memory/4612-680-0x000002CA17610000-0x000002CA17748000-memory.dmp	family_quasar
behavioral1/memory/4612-682-0x000002CA17B10000-0x000002CA17B26000-memory.dmp	family_quasar
behavioral1/files/0x0028000000045279-681.dat	family_quasar
behavioral1/files/0x0028000000045270-806.dat	family_quasar
behavioral1/files/0x0002000000040cf8-882.dat	family_quasar
behavioral1/memory/5740-957-0x0000000000770000-0x0000000000A94000-memory.dmp	family_quasar
behavioral1/memory/5476-960-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation	Quasar.exe

Executes dropped EXE 4 IoCs

pid	Process
4612	Quasar.exe
4724	Lime-Crypter.exe
2088	YEAHH.exe
5740	Client-built.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
38	camo.githubusercontent.com
39	camo.githubusercontent.com
78	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2088 set thread context of 5476	2088	YEAHH.exe	159

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241124230052.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\729c4f06-5a08-41e5-9281-fc40e04e9cd4.tmp	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YEAHH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lime-Crypter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5680	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "57"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = 00000000ffffffff	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Lime-Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "7"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	Lime-Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Lime-Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).right = "1076"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Lime-Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Lime-Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 000000000200000001000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).left = "276"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings	Lime-Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).x = "4294935296"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Lime-Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\MRUListEx = ffffffff	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	Lime-Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Lime-Crypter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Lime-Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3088	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5468	explorer.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
3972	msedge.exe
3972	msedge.exe
2244	identity_helper.exe
2244	identity_helper.exe
3212	msedge.exe
3212	msedge.exe
4960	msedge.exe
4960	msedge.exe
5704	msedge.exe
5704	msedge.exe
5704	msedge.exe
5704	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4612	Quasar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeRestorePrivilege	3428	7zG.exe
Token: 35	3428	7zG.exe
Token: SeSecurityPrivilege	3428	7zG.exe
Token: SeSecurityPrivilege	3428	7zG.exe
Token: SeDebugPrivilege	4612	Quasar.exe
Token: SeRestorePrivilege	496	7zG.exe
Token: 35	496	7zG.exe
Token: SeSecurityPrivilege	496	7zG.exe
Token: SeSecurityPrivilege	496	7zG.exe
Token: SeDebugPrivilege	5740	Client-built.exe
Token: SeDebugPrivilege	5476	RegAsm.exe
Token: SeShutdownPrivilege	1316	shutdown.exe
Token: SeRemoteShutdownPrivilege	1316	shutdown.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3428	7zG.exe
4612	Quasar.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
496	7zG.exe
4724	Lime-Crypter.exe
4612	Quasar.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
4612	Quasar.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
4612	Quasar.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5468	explorer.exe
5468	explorer.exe
4612	Quasar.exe
4724	Lime-Crypter.exe
4724	Lime-Crypter.exe
5740	Client-built.exe
2648	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 4640	3972	msedge.exe	83
PID 3972 wrote to memory of 4640	3972	msedge.exe	83
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2076	3972	msedge.exe	84
PID 3972 wrote to memory of 2768	3972	msedge.exe	85
PID 3972 wrote to memory of 2768	3972	msedge.exe	85
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86
PID 3972 wrote to memory of 2932	3972	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/NYAN-x-CAT/Lime-Crypter
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x108,0x130,0x7ffde84d46f8,0x7ffde84d4708,0x7ffde84d4718
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x27c,0x280,0x284,0x104,0x288,0x7ff767175460,0x7ff767175470,0x7ff767175480
    3⤵
    PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2768 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,708863347759008887,6323961239765914129,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5312

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap24592:84:7zEvent15649
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3428

C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe
"C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4612
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12"
  2⤵
  PID:5288

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5468

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap28574:120:7zEvent16826
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:496

C:\Users\Admin\Desktop\Lime-Crypter.exe
"C:\Users\Admin\Desktop\Lime-Crypter.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\Desktop\temp\0zfnovd5.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5720
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3CBC.tmp" "c:\Users\Admin\Desktop\temp\CSC323BB52149244B1EB0B93ADA6A5B871.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\Desktop\temp\ubpikljz.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3EC0.tmp" "c:\Users\Admin\Desktop\CSC5A93CA9AF0544950B05D4F125768EF0.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1092

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5832
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:5680

C:\Users\Admin\Desktop\YEAHH.exe
"C:\Users\Admin\Desktop\YEAHH.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5476

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5740
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3088
- C:\Windows\System32\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /s /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1316

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d1055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
843402bd30bd238629acedf42a0dcb51

SHA1
050e6aa6f2c5b862c224e5852cdfb84db9a79bbc

SHA256
692f41363d887f712ab0862a8c317e4b62ba6a0294b238ea8c1ad4ac0fbcda7a

SHA512
977ec0f2943ad3adb9cff7e964d73f3dadc53283329248994f8c6246dfafbf2af3b25818c54f94cc73cd99f01888e84254d5435e28961db40bccbbf24e966167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
557df060b24d910f788843324c70707a

SHA1
e5d15be40f23484b3d9b77c19658adcb6e1da45c

SHA256
83cb7d7b4f4a9b084202fef8723df5c5b78f2af1a60e5a4c25a8ed407b5bf53b

SHA512
78df1a48eed7d2d297aa87b41540d64a94f5aa356b9fc5c97b32ab4d58a8bc3ba02ce829aed27d693f7ab01d31d5f2052c3ebf0129f27dd164416ea65edc911c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
f5b942d3593b9c81f2981fde7caf310e

SHA1
fe780b5cf39751390d6d820bd7aed0cf8a8b877f

SHA256
06fb3bbe5f53dbbf4d1c042082addc6bf8226829dd5430812b55a2cbcad66ea9

SHA512
b753783f300a1d207483a25d8fffc7dda8985e3e58de1a6ccbafa882b6531c887255839cbe1860e488b3f986990fd68a476e3c833029b38648c54f147ed7cfd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b68005280d7663b573c116c439ed1304

SHA1
539cb79b01f8a4b389687fbd8b123f74552986ed

SHA256
47c794bc3f081a2b213a8ff8936dff67e70d29c398edcef85b824121009b9a81

SHA512
b20425757b6272f819fdae3dd82d2128a00dad72c8f828ba05a968d388467fa33ced11622b6568830ec81d25504677eb0b096ce3dca29ad62f0ae875c256ca9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
870B

MD5
981aacc991f4740722af4c2cbd439d9e

SHA1
bd45221008f45964bb3eccec1fb525b933a2a7c3

SHA256
445115cc824801f21a8eb85f4c6552e9ccef0bb471d0ca9caa7d848ce3aaee7f

SHA512
88f4bda7acb5bb2fa747f86a4d0299bb6e3cfb3ab90ba147cfa257750f0bba8213182bcc70890f29df882cd8f5243004d3639e3c5f5adb296600149ba902353f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9fe0970e6952ca12d2a726208faafa0e

SHA1
6715e3bf61370888c266b9d641e7ae5644bb014e

SHA256
a72cc9615dd44389ab7d3ec91184920bb3655562a0f985b5d7cbbe4cf71c6a60

SHA512
efd69308fdfc194a5eaccfc2b35ef37aeee843e363835ff5e6a10edf72387b1e7d44c40900efcc5bd1c4d095493b3fde73584f3c4bc68a08a06e6e56d888ef5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
453e0f4e9521f113a6f7d77e0b940c22

SHA1
07b30e49aeac57b3b49d42cd69300491e042af01

SHA256
d929526e06368b0440dbbbc523b3d9841cc7b3c3b0433c4c384f53522fac912d

SHA512
c3e6874efce5e08ae11e44e917ba1599bc54938c47548661ba2e9c2ebfe384a980888a2690b1e44c03793dc775d69f804413dbaf2ddc4a630faa15b3005b818e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73ecb89211228cd27b3721e5d87c045f

SHA1
8bf848b6492c682c7355eeb882b003bce1e6b4df

SHA256
8c311d7134c79fb141c07f58bb0b97deef97933188d0e05357e313749894e464

SHA512
4649d98a32ef10b7d8477944d1b4690d1d5d79914e3ca5d1bd49a217ef71206998c94ef8bbf353001998c183edc82faaa32068d536f49a47a5228ac1ec37e249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e2bbb2833f5f121ba5cd3656919f8dc9

SHA1
0a8d924578203d09e5b8cd977e0c2ef98387eb0f

SHA256
5778f4dd2b5da143f3e795aecbc743da75a083bedf529a2cef626fe5600a5df0

SHA512
434170ae7bfcebb263706fcae5fd6b6e2b42b71327ca1744e1dbd471e431d1a215c5838496e53669ed58f5d39b19be8e229954abe16c6fd020ea6fabdb6a9089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
952a6e3cbc50f011cf2f04c9470080ff

SHA1
a0d6a2509af73e523c970f6e4351861bde63d6db

SHA256
faa79ba7dfd140106187ab50f14aa7cca13650f94f796419bc0a44d7a2b79d5f

SHA512
7955092a6086f05268e4b0f88648d9275020b6cad83f81c90eac5a7cd994cc243b8dfab579d4335db62f3577fd2d8a7fbefcad6cc615e2bcf1d014115056cde4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
74d9eb5260fef5b115bec73a0af9ac54

SHA1
18862574f0044f4591a2c3cf156db8f237787acf

SHA256
7d7e7b38664d625a0bbffbcb7882b175709e92987bf9da113c4745fafbbc361d

SHA512
b85917201b1d4b4542a4424ce40ddd083ddbd0e230e1931fe6f7cdd2aa3d8a0eec8daa743ddc5467f0a92da5594144c602081d941b216ca9cafdfd3c150d32d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1fc731f91458d70ea802ccb21207e4c0

SHA1
87683ee49979d1459c1a16d1e7dbbc538f22ee86

SHA256
5d5348a9e29fbe7a8b3fa07bbfbbfe72a1c019f5b4c87ee3983745b844a5fd70

SHA512
560308d10759fddbc72b499299cf44026eb6f7287465568ba93e95dae4a2d9dfd088b26514439d585374bd993bafb0082001d0144e80f1b1dee50ae46fb4fafc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
27f13b0997760738224e1ed5d90bcc63

SHA1
bde192a65469433ed3936c666ba7e812b8bf819f

SHA256
cbac2a96ea66e51589a968101e48271c027411ab4e63f956ec15bb2743ab41de

SHA512
34e254ae2cbb537bd37d9588db3aa3853c9dee0bde2742921c54999fc1264123dc262ca33c6121c2d40431b251acd1a7ab9c6d3f3e810479aac1afacfcba75b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6559fead9f58c7210a7cd90bc5d569fc

SHA1
71d9ee192c7eea51f5b92d503df778a0f20cd32d

SHA256
0cd7d06eefedec00e9c71859fca3301f7b4ee16694fa079ea2601b042301fb4d

SHA512
92b76e352792abe961f855fbfe5f751016208db1d965b548586cfc91b1e33e0eda443a2756a48becd98865328c66818d66a343cfff46392e4e26e8c7668da061

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f8f6.TMP

Filesize
1KB

MD5
713dcf4f75e098416b20fefa86a15e4f

SHA1
a798c485f880da7d848a9c5673e00799757cdef6

SHA256
a499c6f155abd7e7256c9d3b64b84737ee761b9041233716d91ba50158359ebb

SHA512
1d8568d4ee3057ca0710c1ed1ecf82192f63b856bd0f89ba28aebc66c29a420ea0b90ffd1937f59b8e70e6f3f619942a76630f9e07f9a9ff23d78b276e51d11e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
e40fd95cb8cdd70cebb11e2bd8e8c924

SHA1
5d180b45712f7d35a0ee5e7829d4845ccb4d9a49

SHA256
4b9e5a55bd47cbb8d200ef9dd4f46d888f945819339dfa1773d6b0fb692eff3d

SHA512
611a9480e05701372bdc464b993905ae5ff09999d573ce3cd8d18e2642f24e59e3255e7a63e1d86263112e203a6a7f5231cb3a6350b484f9ebd263e768feaf31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
99876913b4f399e8dff04997fc37161d

SHA1
d1266fa9d8bd48c6528f6fc99e69f2d31ac40332

SHA256
8e54006376ba23cedbd19e7a927cef192b4190eb6e05942160b2ab0d761bb23a

SHA512
9a68a8175c84853db970946c4706a8772073ec7bbb8997cc6c270477f6de4210650c80f36bf5ad00774832c05da318a6f835dfadb807a4e42507679b4bf1f85b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3CBC.tmp

Filesize
1KB

MD5
9b299aef4f59253e1ca74156cb386cac

SHA1
7226e24e65cac6f77ff64bf6c946d7df334194be

SHA256
d36f8a67a463ccafe88f74e6199fc8cc584d9f78b122bf504232c46b5b54ccac

SHA512
3c1241c983a1f5b405d5252227fb7c815c63bd53ec956ac8a86a2cf66571dc1cb05fb6408f290bde79ecb24e5bcadcad0b60e7eb1f3baf4af5433955d5a4174b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3EC0.tmp

Filesize
1KB

MD5
85a2b071add7e3eefdb904d49fc9984c

SHA1
f3b73e08579c91f4e548edcd7977df5db7797149

SHA256
e38e06e17433269a40d86cda2fee90ee068c69a8850d68558abf50cf9ec352e8

SHA512
60fe6456c0f3424349578d9675b399ff8ae41ea302cc43cb3ebc6039a6d2ed47b344221efe09090288c7496dfc71222b27c8b6621acd77b2679e1dd65dde7235

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
4a20338a93b45d571c6d0eb9e582c9a1

SHA1
57ff17b36a86ec06c7b59d26ee303927f4478dbb

SHA256
dec799ce82bde566500602a2522f0583d9f15bf20892b0f046121bd8eef5e800

SHA512
8284bf36028e4765793d726df0b66aaadbd8507334961c7c73451afef00163e2ab387cb295714eb7a6a09e29bb0395306ba8be97a23596cce204b4afa7a4af43

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
754d2d02671ea89fb0aafd3ca8d82b31

SHA1
3f188ef515c066e4d56781861d867158e2319804

SHA256
55cedd3a1cc630f2b5a71b28530bb0c8b8556869e4c49ac2e554281d98a04310

SHA512
483932146ed1d6566ffd23b6689ef7a5a3edfa19676646dc2c628c3589be6185a2e9a9e11c56754d1270d28f2f377dc53076114a0d7f0487fcbfa897b42914b7

Download Submit
C:\Users\Admin\Desktop\Client-built.exe

Filesize
3.1MB

MD5
36d5745029bff824db89a56300d3c0b5

SHA1
13174ad2c244d680b7ea01b62546995c9009a63d

SHA256
e955452aed9725a08314e3da2d0746f08ce2fd0d908bd65b34eeace61e1cdac0

SHA512
baa137bbce85a03224b1fab4daf3c749e34e0749450884f2ca29d986ddad011475c43e466c6b618682e89673aaff503d5b47ced710ba4814018dd5ced0d338a8

Download Submit
C:\Users\Admin\Desktop\Lime-Crypter.exe

Filesize
167KB

MD5
58ab7b9531186d0a8b5863410ac04fd5

SHA1
7a73cfba5e4a4f997f8627a937e4e72543fc47c9

SHA256
aaed720186b8f320d1c1f95637157c99c714ae21e496112e282eb110cb53acf8

SHA512
25b94924fa64b1333591e1581cdde4ed5ac59e1155b1a7a2741a87528e312238c5f8de6482b53ae7d3481e6a30e660fc2c5416bbbf6731c350e74f48b903ab70

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\BouncyCastle.Crypto.dll

Filesize
3.2MB

MD5
0cf454b6ed4d9e46bc40306421e4b800

SHA1
9611aa929d35cbd86b87e40b628f60d5177d2411

SHA256
e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42

SHA512
85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Mono.Cecil.dll

Filesize
350KB

MD5
de69bb29d6a9dfb615a90df3580d63b1

SHA1
74446b4dcc146ce61e5216bf7efac186adf7849b

SHA256
f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc

SHA512
6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Open.Nat.dll

Filesize
68KB

MD5
cc6f6503d29a99f37b73bfd881de8ae0

SHA1
92d3334898dbb718408f1f134fe2914ef666ce46

SHA256
0b1e0d8f87f557b52315d98c1f4727e539f5120d20b4ca9edba548983213fbb5

SHA512
7f4c0a35b612b864ad9bc6a46370801ed7433424791622bf77bf47d6a776cb6a49e4977b34725ead5d0feaa1c9516db2ca75cb8872c77a8f2fab6c37740b681f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Profiles\Default.xml

Filesize
1024B

MD5
c532b007c1bc67859914ac1d3b946927

SHA1
b33d7b80e5e94cfd4d5a127b8bfdca4a752394b2

SHA256
68e7b8c11027a8bd35848f67bc7cac12df858751a75dc43a45d869695b847a9e

SHA512
43d49fcafe8baed663f4949b688ccc0916d06614e91513c5a8c9b2a0570ba03a1913dde38fb5e027e488b15da2796283771b6bae5d75cf69aa8681bdef04506a

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.Common.dll

Filesize
62KB

MD5
2185564051ea2e046d9f711ed3cd93ff

SHA1
2f2d7fd470da6d126582ad80df2802aabd6c9cea

SHA256
de930a748e4dc08c851ba0a22afce8dcfd0f15f23b291f9306c8ef6ccd7460a2

SHA512
00af241c1f89b478e66d758db26ed0a413b690d695abf91211b5cbc3985133632327ea0fc41140bd61d02271b6aa278a8e8f539d8ca6ce94972aef50c1a9c868

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe

Filesize
1.2MB

MD5
12ebf922aa80d13f8887e4c8c5e7be83

SHA1
7f87a80513e13efd45175e8f2511c2cd17ff51e8

SHA256
43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e

SHA512
fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe.config

Filesize
176B

MD5
c8cd50e8472b71736e6543f5176a0c12

SHA1
0bd6549820de5a07ac034777b3de60021121405e

SHA256
b44739eeff82db2b575a45b668893e2fe8fdd24a709cbf0554732fd3520b2190

SHA512
6e8f77fcca5968788cc9f73c9543ce9ab7b416372bc681093aa8a3aad43af1f06c56fcbc296c7897a3654b86a6f9d0e8b0fe036677cf290957924377bc177d9f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Vestris.ResourceLib.dll

Filesize
76KB

MD5
944ce5123c94c66a50376e7b37e3a6a6

SHA1
a1936ac79c987a5ba47ca3d023f740401f73529b

SHA256
7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a

SHA512
4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\client.bin

Filesize
3.1MB

MD5
f4d16cfe4cad388255e43f258329f805

SHA1
fe7cc6c9eb76b5ad97867b46d053fae601fd4a2d

SHA256
8fb6ae3496d4ac025eab443d3e322b0faa3461d25b54093c9205d35746e3250e

SHA512
867045eac0f7765e6bea51e62bc4ed68b1e81ce6c2843d2e08714eb391a8ac94c2571c09828286252248400ea5c12bffa50a25c8ec5ad9e6d0bb836320ec188f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\protobuf-net.dll

Filesize
282KB

MD5
abc82ae4f579a0bbfa2a93db1486eb38

SHA1
faa645b92e3de7037c23e99dd2101ef3da5756e5

SHA256
ca6608346291ec82ee4acf8017c90e72db2ee7598015f695120c328d25319ec6

SHA512
e06ee564fdd3fe2e26b0dec744a969a94e4b63a2e37692a7dcc244cb7949b584d895e9d3766ea52c9fe72b7a31dacf4551f86ea0d7c987b80903ff43be9faed3

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12

Filesize
4KB

MD5
a941b4711d5e5c66f1b5c14a3be74817

SHA1
fd81b46e8c26f79a5090c45bfdf541aba31d8f4f

SHA256
ece3d2f2425da9b579b1ac4cf273e3f918b53e982da44bed434f87adbe988b45

SHA512
cc38c7ad260d67ba29cef8b87b15c83301f42754b49e376504d475e715c0cac80073340a47c5f8fffb76507b6a789c04c585abcaeef5449768972887430a3539

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\settings.xml

Filesize
373B

MD5
b6af1da05c1a00991f04f8b898cea532

SHA1
24c48b062d8d864eefd32f2d84a36e1a7282e911

SHA256
f2ef0d8f29904a65ce6dbe29baf9379fb4659afb6930a5af5d9fb88f73b73f41

SHA512
2ab2de469911c3fee5b9bbfdbb373e5eb15023bf25b9e1835ebbf5890c66cfd7a06d7d5911e2fb630afadf9b30489e589634cefe52ca4c4156ae24b24c00c8aa

Download Submit
C:\Users\Admin\Desktop\YEAHH.exe

Filesize
3.1MB

MD5
49415b340d57c099e5b5461fd1b9ccb0

SHA1
a97680f4000eaacd4c170b7a19e61fce8b913df3

SHA256
3d2ec4a6f47572a8e574decfb2176c8a2e54dd341ebc99c92c40ad3b5ce30eeb

SHA512
0f411cc97c375e91340da64fb55feddeae6946401079be21e04cc265b004aee5ff75ae4ac0d2717058afc39737a3f7a2f3b72fba44ebc59bc7032b54b920bc6b

Download Submit
C:\Users\Admin\Desktop\temp\h44bmnzudpr.dll

Filesize
3.1MB

MD5
22d3c92e437b6ed3fe5c6caae1129956

SHA1
669d35c09b89efd1db4df733985131eca0fa4dbf

SHA256
b9757e220a3e5983cf98c6bbe2fa82462b052a35caf5c3fddf0b1df9adabffc1

SHA512
7b2a9bb53b02dcbdd4a2dde6bd545151ff6569ed3b4d8db1f5f6c10cd4b7609cbf25cd02744e0eb21212c927cd568c94431c158323dfe5bfbcf436c32f5d3add

Download Submit
C:\Users\Admin\Downloads\Release.Lime-Crypter.v0.5.1.exe.zip

Filesize
47KB

MD5
fbd01d273852e31f955890c6832272f3

SHA1
b49388b5e74b331009421073d631af59703ad81e

SHA256
9470e439c81b36707cb0ada8e5701551f93d6d2608f677b24051c1773b64822e

SHA512
d7de5c1e58f71f150eb1764aaa3c7fac4856b964e7a4136e9c06e9cb99ccd05d67c646004e4f01d4c13927fe5c1a11c46dd3a4af0be886e737240ac3eaaa43d2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 545054.crdownload

Filesize
3.3MB

MD5
13aa4bf4f5ed1ac503c69470b1ede5c1

SHA1
c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00

SHA256
4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

SHA512
767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d

Download Submit
\??\c:\Users\Admin\Desktop\CSC5A93CA9AF0544950B05D4F125768EF0.TMP

Filesize
1KB

MD5
4d9dd98a30561be97ad1b662df82ce48

SHA1
e5aa570228aa9ec7442e3c076e4cc8237b1d0589

SHA256
96b29e8d1034782dd65104ca07c7066525b485bc4e3af50453c09c8eb29b3f1d

SHA512
9be64ced3bf5fa1eb9d46bfb409fa0a7f4d9d137b5d18c45740dd514414a53f2397c105ee681a5d35a1e17affb8a732a0fec9adae79fb123179f58d934f3a216

Download Submit
\??\c:\Users\Admin\Desktop\temp\0zfnovd5.0.cs

Filesize
16KB

MD5
0c90857d1aa64ee35b162fdc16f258a3

SHA1
ac7a00f69464e60cf3263f1b50e5a90f7db56ba2

SHA256
d2c2b091f5d53127ab8f28b0c7d3743fce88c0e47a2bc0407c5a4550f6ad0abe

SHA512
d3b2aa4c175842b6cac8fb7f3c2db813c0db9e3191d49e40984925af25fc7fc79485b6c916a0e7b586470a757dd43df1fe257d1d409112ab3f7fa6c9e4c9e7c0

Download Submit
\??\c:\Users\Admin\Desktop\temp\0zfnovd5.cmdline

Filesize
363B

MD5
2e65bb4c3aacce93a9c709189eb0fb63

SHA1
d01bbac37e102e872b39e463ca7c6a8b5f4d541f

SHA256
0bb428914db8f5f1a4191da71288649aed423ab84b013948612d5b5afcf20e74

SHA512
68a88de36353f78ae07168a35768e243ad8c5fb95bf5aed4a6746d14d0081fc4e7b76ba1a839038382f4b2592d78e0ea136c9494cd903342321c8eb8039f0d96

Download Submit
\??\c:\Users\Admin\Desktop\temp\CSC323BB52149244B1EB0B93ADA6A5B871.TMP

Filesize
660B

MD5
b645101a6392c3288242d88310a896d8

SHA1
3442c9640b53f9f7c64c2b09a75824e561025c8c

SHA256
beda347e57a385412f7358c30604ad2feb6d51cd3cc507d1b43c88687df42ed8

SHA512
74b9c3fc999876735d2a7c506323f3a2280363588bb162e49f91615b9a61139828b91e33bb6b86daeaa59af6df6ac7a9ca0bfa19706efdf52a7030f4eb28d74e

Download Submit
\??\c:\Users\Admin\Desktop\temp\ge4jjlpsiqv.resources

Filesize
3.1MB

MD5
1fadc28e8427d1e342a985148ee8cab9

SHA1
aafcfaff31d14ffdb6179dbc9e9b1b072c8adff5

SHA256
d9fa1b993eeeb8ec5eb3b6a621bba57fc5b6efe3ed096a6f538df34e1ea397fb

SHA512
c084c9f3b2f8a9ce659dbdaed75973910971eed2b447d6de1821e71faa6406f68fd921d75d5999092f0d69aee0d7ba55b9f1e005431da92c89c408e99df5f6bd

Download Submit
\??\c:\Users\Admin\Desktop\temp\hzc3fmd1isg.resources

Filesize
3.1MB

MD5
e31ce14bc7840aa1727fe6dfd9151762

SHA1
a922954d3c43aaf92b8f7215fdfbcae160fbed08

SHA256
92e6531e914e7ad906b01c93a9950d845ffc01c065e266f3f6883fa9677ab701

SHA512
7ab2c66c638cd44682a1ab886346dc8c51961da688de8426d029f9148c1f55c105572dd719110a8d48581c5b49d5163a7418e836cceed163ae6498619d413281

Download Submit
\??\c:\Users\Admin\Desktop\temp\ubpikljz.0.cs

Filesize
2KB

MD5
71d3d4a977270305f18341e0a762b52a

SHA1
b5726f969102b894984bccb7bb6b1aab11bcca3a

SHA256
61aaaccfd59f5ef32a4027324e1608aac2ac8d66cf39a5e08e17ef2db518f767

SHA512
3e7e755981f67c8276ed049add9ab8919b753293ee048ee0cf544a2b3c4d480bf86ea19e24c8293e63e863f8d02019264c03ec3829dd0e0e8076107e3685acde

Download Submit
\??\c:\Users\Admin\Desktop\temp\ubpikljz.cmdline

Filesize
347B

MD5
51add2db3da4f6aaff5a9d5997073955

SHA1
80a630d6c30bd72ad03b9f9a33050d4d9f64b700

SHA256
7a7f75010f0f3d8d01c91a74641e30f7bbfb2cf0ece0311e6c658579acf71cb9

SHA512
983c05613517ef4acb0784ccbaf5bb5d3742dbd9b8a2d81b7dc0c184d47a6cc9d4e79d62298a96e57516c351a2a92f555ab98b604116bcd563cf856f7183c71d

Download Submit
memory/2088-926-0x0000000000910000-0x0000000000C38000-memory.dmp

Filesize
3.2MB

Download
memory/2088-927-0x0000000005660000-0x00000000056D6000-memory.dmp

Filesize
472KB

Download
memory/2088-959-0x0000000005720000-0x000000000573E000-memory.dmp

Filesize
120KB

Download
memory/2088-958-0x0000000006930000-0x0000000006C56000-memory.dmp

Filesize
3.1MB

Download
memory/4612-680-0x000002CA17610000-0x000002CA17748000-memory.dmp

Filesize
1.2MB

Download
memory/4612-711-0x000002CA34BC0000-0x000002CA34BD8000-memory.dmp

Filesize
96KB

Download
memory/4612-805-0x000002CA37510000-0x000002CA3752A000-memory.dmp

Filesize
104KB

Download
memory/4612-803-0x000002CA38CF0000-0x000002CA38D4E000-memory.dmp

Filesize
376KB

Download
memory/4612-715-0x000002CA36F00000-0x000002CA36F4C000-memory.dmp

Filesize
304KB

Download
memory/4612-686-0x000002CA357B0000-0x000002CA35ADE000-memory.dmp

Filesize
3.2MB

Download
memory/4612-682-0x000002CA17B10000-0x000002CA17B26000-memory.dmp

Filesize
88KB

Download
memory/4612-713-0x000002CA36FC0000-0x000002CA37072000-memory.dmp

Filesize
712KB

Download
memory/4612-712-0x000002CA36EB0000-0x000002CA36F00000-memory.dmp

Filesize
320KB

Download
memory/4724-788-0x0000000004C60000-0x0000000004C6A000-memory.dmp

Filesize
40KB

Download
memory/4724-785-0x0000000000250000-0x0000000000280000-memory.dmp

Filesize
192KB

Download
memory/4724-787-0x0000000004CA0000-0x0000000004D32000-memory.dmp

Filesize
584KB

Download
memory/4724-786-0x00000000051B0000-0x0000000005756000-memory.dmp

Filesize
5.6MB

Download
memory/5476-960-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/5740-957-0x0000000000770000-0x0000000000A94000-memory.dmp

Filesize
3.1MB

Download
memory/5740-982-0x0000000002D60000-0x0000000002D72000-memory.dmp

Filesize
72KB

Download
memory/5740-983-0x000000001C830000-0x000000001C86C000-memory.dmp

Filesize
240KB

Download