quasar | hxxps://github[.]com/quasar/Quasar

Analysis

max time kernel
225s
max time network
227s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
01-12-2024 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/quasar/Quasar

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
5000

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

181.215.176.83:80

147.185.221.24:14161

Mutex

73775941-2459-4c6a-b185-5dc6fe1a3e8e

Attributes

encryption_key
1A8D531A5540CEA64D9618BAB5E2E052629E4C10
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 9 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0028000000045226-440.dat	family_quasar
behavioral1/memory/4444-443-0x0000025C96700000-0x0000025C96838000-memory.dmp	family_quasar
behavioral1/files/0x0028000000045225-444.dat	family_quasar
behavioral1/memory/4444-445-0x0000025C96C10000-0x0000025C96C26000-memory.dmp	family_quasar
behavioral1/files/0x002800000004521c-768.dat	family_quasar
behavioral1/files/0x0029000000045285-842.dat	family_quasar
behavioral1/memory/4960-844-0x0000000000170000-0x0000000000494000-memory.dmp	family_quasar
behavioral1/files/0x002b000000045295-1228.dat	family_quasar
behavioral1/memory/5296-1230-0x0000000000720000-0x0000000000A44000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Quasar.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation	Quasar.exe

Executes dropped EXE 3 IoCs

Processes:

Quasar.exeClient-built.exelol.exe

pid	Process
4444	Quasar.exe
4960	Client-built.exe
5296	lol.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
39	camo.githubusercontent.com
47	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6bb81e4f-8521-4545-9802-ca7ee5c04445.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241201214601.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 64 IoCs

Processes:

Quasar.exeexplorer.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0 = 66003100000000008159dbad10005155415341527e312e3100004c0009000400efbe8159d0ad8159dcad2e0000005f0b04000000070000000000000000000000000000009cec06005100750061007300610072002000760031002e0034002e00310000001a000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 66003100000000008159f0ad10005155415341527e312e3100004c0009000400efbe8159d0ad8159f0ad2e0000005f0b0400000007000000000000000000000000000000741e24015100750061007300610072002000760031002e0034002e00310000001a000000	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\NodeSlot = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Quasar.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid	Process
4576	explorer.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exetaskmgr.exe

pid	Process
1748	msedge.exe
1748	msedge.exe
2380	msedge.exe
2380	msedge.exe
224	identity_helper.exe
224	identity_helper.exe
1060	msedge.exe
1060	msedge.exe
5208	msedge.exe
5208	msedge.exe
5208	msedge.exe
5208	msedge.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Quasar.exe

pid	Process
4444	Quasar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

Processes:

msedge.exe

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

7zG.exeQuasar.exeClient-built.exetaskmgr.exelol.exe

description	pid	Process
Token: SeRestorePrivilege	4328	7zG.exe
Token: 35	4328	7zG.exe
Token: SeSecurityPrivilege	4328	7zG.exe
Token: SeSecurityPrivilege	4328	7zG.exe
Token: SeDebugPrivilege	4444	Quasar.exe
Token: SeDebugPrivilege	4960	Client-built.exe
Token: SeDebugPrivilege	5416	taskmgr.exe
Token: SeSystemProfilePrivilege	5416	taskmgr.exe
Token: SeCreateGlobalPrivilege	5416	taskmgr.exe
Token: 33	5416	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5416	taskmgr.exe
Token: SeDebugPrivilege	5296	lol.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe7zG.exeQuasar.exeClient-built.exetaskmgr.exe

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
4328	7zG.exe
4444	Quasar.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
4960	Client-built.exe
4444	Quasar.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exeQuasar.exeClient-built.exetaskmgr.exe

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
4444	Quasar.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
4960	Client-built.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe
5416	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

explorer.exeQuasar.exe

pid	Process
4576	explorer.exe
4576	explorer.exe
4444	Quasar.exe
4444	Quasar.exe
4444	Quasar.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 2380 wrote to memory of 2764	2380	msedge.exe	81
PID 2380 wrote to memory of 2764	2380	msedge.exe	81
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 4400	2380	msedge.exe	82
PID 2380 wrote to memory of 1748	2380	msedge.exe	83
PID 2380 wrote to memory of 1748	2380	msedge.exe	83
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84
PID 2380 wrote to memory of 1520	2380	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/quasar/Quasar
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff8363846f8,0x7ff836384708,0x7ff836384718
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff73ff75460,0x7ff73ff75470,0x7ff73ff75480
    3⤵
    PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7448 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4949297650257508256,14314598013433981182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:3264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:528

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4048

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap3418:84:7zEvent20518
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4328

C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe
"C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4444
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12"
  2⤵
  PID:1780

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4576

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4960

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5416

C:\Users\Admin\Desktop\lol.exe
"C:\Users\Admin\Desktop\lol.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ccff51f965f8f4176e4ad112c34c86a7

SHA1
eab249ca0f58ed7a8afbca30bdae123136463cd8

SHA256
3eb00cf1bd645d308d0385a95a30737679be58dcc5433bc66216aac762d9da33

SHA512
8c68f146152045c2a78c9e52198b8180b261edf61a8c28364728eafb1cba1df0fa29906e5ede69b3c1e0b67cfcbeb7fde65b8d2edbc397c9a4b99ecfe8dea2dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c29339188732b78d10f11d3fb23063cb

SHA1
2db38f26fbc92417888251d9e31be37c9380136f

SHA256
0a61fa9e17b9ae7812cdeda5e890b22b14e53fa14a90db334f721252a9c874c2

SHA512
77f1f5f78e73f4fc01151e7e2a553dc4ed9bf35dd3a9565501f698be373640f153c6d7fc83450b9d2f29aeaa72387dd627d56f287a46635c2da07c60bc3d6e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
52KB

MD5
c6efd2d48bff9cb73531635a2565eeb6

SHA1
52a6ae7314ee4f989c7cfb99db071bed9c662ec6

SHA256
4e5090b1b41d3bda97158002233cce08ca161039d3898afff9834be6b27cc8a1

SHA512
dbd1041a61aa6481f5bb00e8cb0daf389198a851d20d11280ede6702432364986348a160a3cbcab08df694ba3c0782df4bdd1b44a928ad76c0ad8635a5b72f4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
144KB

MD5
c8fceeec58f0c86040c70ef86008c263

SHA1
709c3a6683ccc603f4b1a13c77f5cc8ba1b6f168

SHA256
e910cd3efb9cd2ada7d840e0a6748d3dea4b799959d7520b67717efc11408bfb

SHA512
31f71d57d19885a4e893eb06023a13974f97462c61f8a8ca8f2e154563b5f907e80bbc8665a10cf5911efb48de26bf9d61c6b1f5998dda1db04ec6a229a1c4c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
98KB

MD5
d726ce78c59e778bc391ec45f375869c

SHA1
24af29731638a2ceb28888fda7f14be048fc7a3f

SHA256
f36e8e7792f6c53a312c7d31ecd15d4244b68dcd6e0102e641f22b0c3839f781

SHA512
ddabb0640ae20796b339167d3a2bdc16c0089e6392c24ed0a2737b3d5ba5b5dadf3802b009089358f7ec711bd673fd52d284969bb1d0a3e720a21b0130cc5c52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
20KB

MD5
d0d74c9f5f71a8c1944f599486b7c8e4

SHA1
d264684445e2fe6e1afc48b868afd63df13d698b

SHA256
454939e9149527b92db720a29e9b10cff0d729b618931d59acdb3f87aaf8f354

SHA512
8875d755e453de71360e938b3ba34c5d1ddb0dbafdde8886358555fd0c3dff9827239aa120df01c81ad78a28f40157fe54e9683885403c067474ac6403de1e7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
20KB

MD5
b52b188fd917cee86e8532bc1ce3d933

SHA1
0167f4cc43ab4c6def512e5ef7c7f6a3b576feea

SHA256
18f6bfc6293f7b041e3bcbaa933c70f569453ba111dd56f0b559ff9ce92614c5

SHA512
497b478e337708091ac07d1712bb10d40e519f40ee85e4d32fb8ff949e900773638b3165ca03e1a02608725f6f741fe5395dc7f850959fab325775b2aa025c63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\13fc696ade1f36e4_0

Filesize
55KB

MD5
48ac259b195b874eeaa3c13d928c9719

SHA1
9015df83a41374c2a6e6a8fd2c88d732226ad7bb

SHA256
1f835b48a1653e322cbca6de167e392cc672db3ba5cac373c4b0bde1a74b1bdd

SHA512
deb14eb5093d0d7a471789b70286a8648fc242f241f28ef0199e14fcf53c5898d94263e6b81d28b06b7c8aec0eceb6217956f69662bc059e455660f7eb6d33b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
dfe2f26a3034cc924dfdb51b340d6c99

SHA1
6df04b4dcbbb6fb99dadf4dd6876cdc237b38075

SHA256
91058327e3dfd0d397fed7775c0e3e1e5a1e25e478c2cefb7a0cea1359e3a4f4

SHA512
5b513cbab7661020e0c146935da1826d920c675cbf6559155d4038effacad370ae7c10384a0922cf5d5458d2fecc7d42b72e80d5b3537bdc5978263d469a363a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
71c73f746acbd2c665be09b3f94d2fca

SHA1
1cadb98c06359a4227467d00d9801b78e25a48ee

SHA256
686a1270644ebf61a28080abd7242d446f88c38e82dc75a040c88b0bb732e014

SHA512
f3ad18b69fe12f40401a69f5030755efaa90da1810fba4ee3aee0dde77506dc4a4272511c269ec2fde55874084c028fcf17ac0209fc8d85ae82a353411d11329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8fd651e5599abe79649b6f45ecc76fc1

SHA1
049d5401b369477a681a6875de3136bb447e9ab2

SHA256
bf0d4812203ff091ca187b71159d9cf85a3faa682c69b7c90b33b0fc328353ca

SHA512
97618c6ecb05c579b3a495d92244269290169717f06a8a41eadbd6fff3d25f39b2ff5e886f71eaeb4ad3fa4b4bed522b2d47e738ec1fc333caa995343907044d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e13fb02b42cb3ac22a4d630308c79bc0

SHA1
108f20bfbd15d2ab9b98769bbd1ca10331503802

SHA256
f6ebafa22d54c419666baa7db070d5edf88b868fa71e0c151dedc5336677291c

SHA512
49d9283568995d3c316b8c141c58afc65ce7da03a3e3bc58a80245e12a2a19a4bf19eefec4c1d1fbcafe64b5dec5b529827ac816f78b544c2f0ebf97713ce55f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
30322550d9f9c54f345ea1c71f3b2e8f

SHA1
b5a3cff2995147279c2bbed7c03b2280ecb286e5

SHA256
4e7798d8476361378f8fbfb0442db63c7f6bf7e1830d50808bfdb8a58700d8f9

SHA512
261d1f5bc9c8a369f815eb846c252f54681f70862153bd49959411450870207b3ee240cc9016533c27401922527d561cc1ea7bb23708e4a257f071d010cf55ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
61ce206431745479b22229be9f1b232e

SHA1
39740b19d5d26e74a915b65883d3b96ca00862ef

SHA256
86648fee162db31b79617774bdd0373c296703a8ee033a255357c03cad0233e0

SHA512
1afff326c5c6390cf4be53c9d13978b849389b897d6927cf2a5ea7aafad6158c00ac3e8b5ebff63077593503f341dadbd16f4641d092fac17aa6245cb54805e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58b224.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6564823a7745a7a55125d1a47bb58177

SHA1
a64d8138f1e68f01e772f71043c11d0ca5124a75

SHA256
9095c5b6e6491b09a77f15eb48e71cd151f1a9b333fd438b83a30009fba55dbf

SHA512
2d8c19485634c052182ec1892b8e994edba62022e42be31532fed3d588e97e0d7c92e2b9dfb2c7df2e6aa8de4c48e338bea9c09f0bb3fa0f605b92aad436bcbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b07f93f804156a57fae6a24b7246f0db

SHA1
1d3384cad41b974739101dc04774b2cb27523306

SHA256
5207d1c2e31d4d6c2d408a7e6d982dd50de60b3258d68fde36f348f215077f75

SHA512
8f4a054f05245a75debdcd369567b87e4ff36377a3b589aeff4279c105a45ac5e84b88e8890be0f5d3d5b1e523f92358f68a6a2c6422da1f3f4603dc2ebb7847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ae8d3b91ac22259ed4bb0800b4e4e822

SHA1
24c878c1ef956039cf7be70d406a07f3168f3733

SHA256
162ac7c8536b7914d66d3a473b8976a2fe2923eff15d5aa3b1e2384e86204fc4

SHA512
302d398d314d9baa837d804b3ec3cb1e5d11fdf804d55185c56129a05625887fc3de1de2620186a8eae4565d558df33934d0c4092162750398556c5adcc5e571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
677c475cb3fe1f2812acae191cba3562

SHA1
6750200b109a52a40cc50b1095230fa3352593b1

SHA256
e19b1f03a1a2ae97d382613f4ea5269d097f5d90e397111bc0015a52ba1f4876

SHA512
b1c348b81ce1eecbe00505207f7aa907b8823d26ace70692c5bfa28c88bbd57e5753410e6233f27be2331105a2bd26e9f4f249167bc8be34a902f08f973a765a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7ced30a1edce57c46d58a7d3ec27649f

SHA1
370d3779664b816925fa444782f5d152273b2c48

SHA256
8937b46cef5786aac9777b41400adac26d53cb4104f18fb99f51751bcb53c03f

SHA512
2781b0ef37f37ddf2a34f6b8f138a34a3307e5d5a014e2bc5f5402c01ef4f7729fe6f7b08fb2b6a67b6c252446c5e417b2fa58046b7ac98dfcabf9c7cca925eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b1931d73c15dc6a891b3bc8436fb07bc

SHA1
69844b18dc17fe2aaa6a141eea14117f580de808

SHA256
76a7f9adbd874a9f8cbf45bd5a44122a77e7498f5c2f6b8d42c425f5baf0b02c

SHA512
40f28407eb4d05d04fd3df6de7d77521d095ae5663e7ba4b4d6b4906740722c57fa83e0beae656decf5b348b602eb762e639ce6b14764c724a462dffd01fb134

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cb4cd8f8952dfd9a90fb77c424f9d9ef

SHA1
bb247a2312f7848cfc651851ff48f08f60a2509e

SHA256
3eb385cab51b9d4d51fc71ef6041a97fcddf0a9dfea27354be079be0c15fb49b

SHA512
36d082651bec480dd005713d3ee10c99c3b1756259bfc242c476ca0320e1b5a4c20838ef9786589eec8c42d975001946c0129361c0a75429b7d6d88066656cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5f98285674241656a547d2958139be4c

SHA1
b46cbb60becc8ea12f948cf9825bc5d5fef7a3a5

SHA256
23146b1ea99c83cb9af54ce05cc715eacc184d1abe2e7857e1d577b078b6d02c

SHA512
7fac1a80de841f9c7cc9fb227ef77c3f2247c48245472d3f0cd005d6cafa1fa2c4d5163555526f3133bd34f2965271912abeca106cdd89e81976bcb5b3f3020d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
86aa28ffd286b08415aa197216684874

SHA1
d99924976c73e3220108817ad6bc1d8b1795ca2d

SHA256
a6dc4bc6ade3039e57b538f2620b91602199f1908b23c4a2beb3fd3aa721579d

SHA512
a51fbd1af778d32f2f95a9a863a59f42a7eb804dbb8ce85459297959eea21fbfe9625d74c3f91ad65016031d4b3e26eeb748c1c59e09ac68778fc670d408d0fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
26978f38b0bce48572b90b762b7d937c

SHA1
8b8b88012fab1d37fca79575a5db81674b424867

SHA256
b38f05e2e63a1f87026aed06f5b85354570c6f91d28947466f0555276bab6afa

SHA512
501e0de5f46bfaac901cde5c39a321edc411426fd91c83427f36710fa56d20b5f6ab8f2219d963f7ab495c2df7def879652381db3876b7e2a7080921cce78379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
48cf78edfc2235778f754b3e0c83c493

SHA1
01aa8e467060a56054bb10bd633a5c56054132d1

SHA256
443c60e42c2470fbd89a726832a1d297d29bf7fb52f298f7e4f798a1a2293522

SHA512
69913ede7b66420c2b87d0405d4825286f058c170306f295c9e971a918ec7309958060166bddd9500fefb42546a6ac5bd448a2c810cca80227e2d5cdfa00de48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
132b5d4d29987c33e1af49d4775060dc

SHA1
2766cc874bd939e169aa038613395961d6c1120a

SHA256
937b166c5bfd017504dbc53c2e6f4d02bd2257580888f4e3220e2f32b33bb4b2

SHA512
61ba48c932d3116031d3754fdc404be3308cfbdb2143bb5ae21109dc943615b1718d2f0d8685e6a803b1792e97214811b42ca45c2a098eae741a86ebbe8b90f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9fe67a1ae5e62211358432e4cd1185ec

SHA1
2b16b50b53ef082da3610ec5f356c0160b87aebc

SHA256
d7d37edead7e998986b4b2f6d9720b2c4f956f00335fe610a4e28236fb48e59a

SHA512
4327211912f01757b5d3528fe1f69d430b1b07662c5c2940f8ee186552f69cd09da4159fadc2f08debf7ff46bb5e890c97d8a94ebd5fa80d41da2afc094ff4ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aadc1c46f8df4e1f4d08b0e9a6aa8440

SHA1
58f3f50a7e83e13b52fdd119c586502167105bb7

SHA256
98c068603e2b8eff32107f545467f2053d53370f4c427a2bad1c6940a9a229dd

SHA512
97be95954f0f3a09425b079b3077632c8ed2a134d979a3ee0c5b5fa15a3a0e72119cb8daa7ed784b6b103ba193de03fa947eb74583557da0a3fecb7448a68cb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ec63.TMP

Filesize
1KB

MD5
510b7a8242ce055023f8f6e316f6dbc2

SHA1
6097d4df97a2a531cc0e2aaac55ad9a4381cb9fa

SHA256
731919c7f8599f182315e296116460349a698971b1b66fdb2be4a28a370bc37a

SHA512
315229d373842b82578d69a2c077cac2e70ba17fec0223c430be134e1dfd126e0b75ca11c74aa06b94817d62327abaf9c154ac5de0fa8eccf65b6b38845b3096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b0973bf704b95fc46182e38327067923

SHA1
294c098b81b68781865cc7bd640fe27790d9edac

SHA256
c131af4086edb8b4de165a031f8af0c1463e77d9cc08dbf4d224890c650f35f5

SHA512
4a71c2985fb56c5f7533ac999ecf4d75610d3d6ef82fa114862fa276c30863048ad8525b575b2d1386df5b5e218c73208926db62d3e9b0e45bd7a3dfae4c833e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b27f3162b1425d204c5e57ebbcc8df3a

SHA1
d5246f563a7ee0e3ee31533f0c8b9dfba183aea3

SHA256
d4320205d843308a6a5d4a6fecc215dcc31360d843a49e4c61ecfa625b046080

SHA512
1363fff8de0311e78bd458d67efcea3b6db9e7a5fdc3664fedc01fd53ce9a2b47e773268001e064889033e73dfafb1a213f13db1926501759f024c21d5f505bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
09a66906741c8e6ee03728f2d290ae9f

SHA1
c59941df6e20c81c292408912816c9ad2cd6ba0d

SHA256
5e13e6e0c0f5651e7935aca796ff544866c1ae18e13b21708ce16dc1094e80bd

SHA512
e5f62eab6c05c43952d149b75d885b8bab978dd83d90f42dc68fd17111911a5e9748645ece1eca0b1ed2120f129755e55b3dab07a39ba804743af0e847388bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
35f4f26389134e6d32210a79ed92e8ca

SHA1
43a1ff8d0b488f7492e2c9696de46a7457cde65d

SHA256
77a16ded2985aa8aab1e304bd35484212d1c9df980cc715c4a946b688aca813a

SHA512
e7edeedbca59f4fdc784ed5d8993b5600fe88c8c3987665d5db8cde43bee1115afd87c8a4c27685a99dc8964aca16eeb63652b799b209b673aa92efb0d4f65e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
73232449e5a677e82edffc0fe0a1edde

SHA1
655b7fe491fc8541b935285e63ceecab02b7b057

SHA256
3f64d3aea09e3c0bc628db81f8646f6418b928fe71a2bf8f13fca5500c4265c6

SHA512
298b9c23c43a789468bf1c849ce2eff63a934a281d28c0a3715eefbde6e9aeb80d5cab7da7696cd82d2169168127247504d2cb3dcb7c694ea4aebf7bdaa60f54

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-584106483-899802418-1877852863-1000\b933c5c4012f7de6593563839dd364ec_7bf069a4-a9b6-4a4a-be85-4546a5118e43

Filesize
3KB

MD5
d4435c99655ceb3ce50234f4458c6441

SHA1
934e7585311e26e21a15092a12b64ba8577e91c1

SHA256
443c60d407dbf2afb7796e78a73086793cff73c9c7034a16190f2f9ea0d3e893

SHA512
fb5f553c9ae6ac322604239e87c9be005be12a95de9e3c8df96ffb85c4f88d46588f58b2dc33a8ce6d80eaf69a850d8998514de5658ecbf6511e55d122c0305e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
00da47aebf194b985a23701f0e4b68b1

SHA1
52e54301904f3c69da8a00c3345ae0868f199789

SHA256
dd4f11dcf83745625438bb1d33f1786d4e1aa28f24be14e9a47bf7e835c7749b

SHA512
49aeb102818564ccf2f6ebcf8769c7d3bceac79c3a15fd60e3feffa244ecdb948301a76734a7d3d6a58787bbc1d43db1b8ac1aab17d3a727f34ca92e215a639d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
96564ec53759b46bd66e5a745826b7d9

SHA1
b2972ef081c4ae882b90cf1e2ae801be762d9518

SHA256
f63c21edbe518b76b5306a1acd36219bee44d8b937f7fd32c9e32b81b44e5c13

SHA512
eda0d4ad613bfb9b0a9f78bf9d9db63db12bdb9edd0061bdf7b6b96d88faec5915f9f476ab825f76013d801cf3fe888c69009b4525815cda230709e734ff5db5

Download Submit
C:\Users\Admin\Desktop\Client-built.exe

Filesize
3.1MB

MD5
2c9b5a5f7459326197c8811f31d5d037

SHA1
c3e6cb54b1e0a4a8e87aa3f8eb5002ec6d2336e9

SHA256
2a5bb8a1a204f791a8f8b5bc0b5454a6ee05a3d88f73274eb82cb42c7cf95e9b

SHA512
06cdf68bba0d5d9cce13d1bd5de6ceeb2d6ccd87d90097228ce7e9d69f5388491ba9a2c81fbb860a37e049b41f6a97e317717b00c3402bc2d7a7bb1fcc528513

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\BouncyCastle.Crypto.dll

Filesize
3.2MB

MD5
0cf454b6ed4d9e46bc40306421e4b800

SHA1
9611aa929d35cbd86b87e40b628f60d5177d2411

SHA256
e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42

SHA512
85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Mono.Cecil.dll

Filesize
350KB

MD5
de69bb29d6a9dfb615a90df3580d63b1

SHA1
74446b4dcc146ce61e5216bf7efac186adf7849b

SHA256
f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc

SHA512
6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Open.Nat.dll

Filesize
68KB

MD5
cc6f6503d29a99f37b73bfd881de8ae0

SHA1
92d3334898dbb718408f1f134fe2914ef666ce46

SHA256
0b1e0d8f87f557b52315d98c1f4727e539f5120d20b4ca9edba548983213fbb5

SHA512
7f4c0a35b612b864ad9bc6a46370801ed7433424791622bf77bf47d6a776cb6a49e4977b34725ead5d0feaa1c9516db2ca75cb8872c77a8f2fab6c37740b681f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Profiles\Default.xml

Filesize
1KB

MD5
b76d3ecc1a5ba29a2f1f6ded3f969563

SHA1
4ec8432d3ad07e1e2cc3cfaabd2a53f6327c902b

SHA256
4b8ce1301cf76891f721773a614353b75595f0ac60b92b4e4144fc66e2d26823

SHA512
518048c4abe30f4c052d2a443a12013abc26819f199e3d2faa10df0e5b87fdaea4b2b7257b82c38f46f65356391a0698d14f62b80ace08476cfdd8ff775c2310

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Profiles\Default.xml

Filesize
243B

MD5
567e9325e4824cd7d9287a91a68058c0

SHA1
658f046204c9fe5b7a93b9ba55f0357ef0fdfedd

SHA256
0551f26588bc96c91db3306381b9499032049e4876c7a8476256cca13ed18679

SHA512
66c070a35d06e96403aeef49893169c4a4fec4e99bafdbb51ecf87798c7f76cf797a0cd30cbbf15e30b9a5fd0aaebc8ff6ac6a7879d3c7a3c179bed1b37c9694

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Profiles\Default.xml

Filesize
1KB

MD5
af5020158a0df1cac52e0aff75329086

SHA1
a8a012dfa0171a3292b623d96ff6a2ccc67104b3

SHA256
533d95dca59b59c64ca440921c0137fdd9ecd9236f7f28c7054a59b4de3b5872

SHA512
35b164661f0e2acce9fe307b7d825d4fe9472546b6bf3ddd60e94d4668080db56bdd1137fcf32e035c6f28e374574315346ffc4a3d0a202bc3e173f7a2f47fb6

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.Common.dll

Filesize
62KB

MD5
2185564051ea2e046d9f711ed3cd93ff

SHA1
2f2d7fd470da6d126582ad80df2802aabd6c9cea

SHA256
de930a748e4dc08c851ba0a22afce8dcfd0f15f23b291f9306c8ef6ccd7460a2

SHA512
00af241c1f89b478e66d758db26ed0a413b690d695abf91211b5cbc3985133632327ea0fc41140bd61d02271b6aa278a8e8f539d8ca6ce94972aef50c1a9c868

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe

Filesize
1.2MB

MD5
12ebf922aa80d13f8887e4c8c5e7be83

SHA1
7f87a80513e13efd45175e8f2511c2cd17ff51e8

SHA256
43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e

SHA512
fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe.config

Filesize
176B

MD5
c8cd50e8472b71736e6543f5176a0c12

SHA1
0bd6549820de5a07ac034777b3de60021121405e

SHA256
b44739eeff82db2b575a45b668893e2fe8fdd24a709cbf0554732fd3520b2190

SHA512
6e8f77fcca5968788cc9f73c9543ce9ab7b416372bc681093aa8a3aad43af1f06c56fcbc296c7897a3654b86a6f9d0e8b0fe036677cf290957924377bc177d9f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Vestris.ResourceLib.dll

Filesize
76KB

MD5
944ce5123c94c66a50376e7b37e3a6a6

SHA1
a1936ac79c987a5ba47ca3d023f740401f73529b

SHA256
7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a

SHA512
4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\client.bin

Filesize
3.1MB

MD5
f4d16cfe4cad388255e43f258329f805

SHA1
fe7cc6c9eb76b5ad97867b46d053fae601fd4a2d

SHA256
8fb6ae3496d4ac025eab443d3e322b0faa3461d25b54093c9205d35746e3250e

SHA512
867045eac0f7765e6bea51e62bc4ed68b1e81ce6c2843d2e08714eb391a8ac94c2571c09828286252248400ea5c12bffa50a25c8ec5ad9e6d0bb836320ec188f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\protobuf-net.dll

Filesize
282KB

MD5
abc82ae4f579a0bbfa2a93db1486eb38

SHA1
faa645b92e3de7037c23e99dd2101ef3da5756e5

SHA256
ca6608346291ec82ee4acf8017c90e72db2ee7598015f695120c328d25319ec6

SHA512
e06ee564fdd3fe2e26b0dec744a969a94e4b63a2e37692a7dcc244cb7949b584d895e9d3766ea52c9fe72b7a31dacf4551f86ea0d7c987b80903ff43be9faed3

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12

Filesize
4KB

MD5
3fd0bf352128c173d42dc69957e3e575

SHA1
1e179b368cbed76c3700e5983ac01b9b5204fc8e

SHA256
cb5d02fd7c7996c1104fdf059bfb309fa9a49eec9e68177653afb018e9d98207

SHA512
f932e4c4330ca6b842d51d0249d0fb3c0fac9ce6344899809d0ac612c205ce8d8444a7886d1cdc390b673fc16dcf992a2300cd7f56ec4659c89878895ed4f9a0

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\settings.xml

Filesize
372B

MD5
c249e2343cc5d917ec99ad1803bd73f1

SHA1
fefb9abb8ab9ff7eff70399fbe6b8027adcced83

SHA256
b6ba14a93121c71c3071ad0c4df22b1cf974c6ef8bcfd4386593faa7b33d86fe

SHA512
34d9ffa2f5b5c9af68aedf6adbd265cb659c25530c55c99e069beb44c76e029db1d60ed644ca9d179af4deddf18f01f69e07cbc09636e68d8a2c716fd739d458

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\settings.xml

Filesize
369B

MD5
6cbbd8f02964873e6d56c33fc3bbf807

SHA1
e841fcced3d9e037911c0c13712e365d2473a0f2

SHA256
e84e89e5c2502e235dd0056961fccd8a3fe2fc802af9d3e18552ea1ac97d5866

SHA512
77fd493575914b3304aac5a539c16cfe6c20a9706f69291f3c4f4d24a2e88186d7d1043f79dc98c3fe7e353727342f0a449a5e53578f73288a6e321f56825f67

Download Submit
C:\Users\Admin\Desktop\lol.exe

Filesize
3.1MB

MD5
63179f425458cbccde34888410c2dd17

SHA1
5544dab54fd9f22e881cc924596aaa47d3247629

SHA256
d604422ef0dd7053e29052fd59fd64ae7d6fa0fa8121dd0545fb038acca99e76

SHA512
e91c2919721cd6a6a8ee48005741e86b8617499bb9b671aee99e63410137cb6f908bc7865edc98829db74ba9a404f8820e64142ccac3538c9868dd68aba711ce

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 297292.crdownload

Filesize
3.3MB

MD5
13aa4bf4f5ed1ac503c69470b1ede5c1

SHA1
c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00

SHA256
4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

SHA512
767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d

Download Submit
\??\pipe\LOCAL\crashpad_2380_CJVNRCSEGQRNUDDC

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4444-485-0x0000025CB4630000-0x0000025CB46E2000-memory.dmp

Filesize
712KB

Download
memory/4444-483-0x0000025CB3AE0000-0x0000025CB3AF8000-memory.dmp

Filesize
96KB

Download
memory/4444-445-0x0000025C96C10000-0x0000025C96C26000-memory.dmp

Filesize
88KB

Download
memory/4444-484-0x0000025CB3CF0000-0x0000025CB3D40000-memory.dmp

Filesize
320KB

Download
memory/4444-487-0x0000025CB4570000-0x0000025CB45BC000-memory.dmp

Filesize
304KB

Download
memory/4444-767-0x0000025CB4860000-0x0000025CB487A000-memory.dmp

Filesize
104KB

Download
memory/4444-765-0x0000025CB7DD0000-0x0000025CB7E2E000-memory.dmp

Filesize
376KB

Download
memory/4444-447-0x0000025CB48A0000-0x0000025CB4BCE000-memory.dmp

Filesize
3.2MB

Download
memory/4444-443-0x0000025C96700000-0x0000025C96838000-memory.dmp

Filesize
1.2MB

Download
memory/4960-844-0x0000000000170000-0x0000000000494000-memory.dmp

Filesize
3.1MB

Download
memory/5296-1230-0x0000000000720000-0x0000000000A44000-memory.dmp

Filesize
3.1MB

Download
memory/5416-884-0x0000021D98290000-0x0000021D98291000-memory.dmp

Filesize
4KB

Download
memory/5416-882-0x0000021D98290000-0x0000021D98291000-memory.dmp

Filesize
4KB

Download
memory/5416-883-0x0000021D98290000-0x0000021D98291000-memory.dmp

Filesize
4KB

Download
memory/5416-874-0x0000021D98290000-0x0000021D98291000-memory.dmp

Filesize
4KB

Download
memory/5416-886-0x0000021D98290000-0x0000021D98291000-memory.dmp

Filesize
4KB

Download
memory/5416-881-0x0000021D98290000-0x0000021D98291000-memory.dmp

Filesize
4KB

Download
memory/5416-885-0x0000021D98290000-0x0000021D98291000-memory.dmp

Filesize
4KB

Download
memory/5416-876-0x0000021D98290000-0x0000021D98291000-memory.dmp

Filesize
4KB

Download
memory/5416-875-0x0000021D98290000-0x0000021D98291000-memory.dmp

Filesize
4KB

Download
memory/5416-880-0x0000021D98290000-0x0000021D98291000-memory.dmp

Filesize
4KB

Download