quasar | hxxps://github[.]com/quasar/Quasar

Analysis

max time kernel
350s
max time network
347s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
01-12-2024 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/quasar/Quasar

Score

10^/10

quasar office04 discovery persistence spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
5000

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

10.127.0.217:4782

Mutex

3093e9fd-e45d-42b5-89da-584a9975138e

Attributes

encryption_key
1B79B50E782DC113361A295FCA874452CD564DF8
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 7 IoCs

resource	yara_rule
behavioral1/files/0x00280000000451fe-555.dat	family_quasar
behavioral1/memory/1312-558-0x000001882D2D0000-0x000001882D408000-memory.dmp	family_quasar
behavioral1/memory/1312-560-0x000001882D7F0000-0x000001882D806000-memory.dmp	family_quasar
behavioral1/files/0x00280000000451fd-559.dat	family_quasar
behavioral1/files/0x00280000000451f4-627.dat	family_quasar
behavioral1/files/0x0003000000000347-687.dat	family_quasar
behavioral1/memory/2348-689-0x0000000000A30000-0x0000000000D54000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\Control Panel\International\Geo\Nation	Quasar.exe

Executes dropped EXE 4 IoCs

pid	Process
1312	Quasar.exe
2224	Quasar.exe
2348	Client-built.exe
4372	Client-built.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RAT	Client-built.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RAT = "C:\\Users\\Admin\\Desktop\\Client-built.exe"	Client-built.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client-built = "\"C:\\Users\\Admin\\Desktop\\Client-built.exe\""	Client-built.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\New Value #1	Client-built.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
43	camo.githubusercontent.com
44	camo.githubusercontent.com
45	camo.githubusercontent.com
49	raw.githubusercontent.com
34	camo.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\a264c936-e126-4fb1-b82d-c62264754e4e.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241201191451.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1512	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "5"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\NodeSlot = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1 = 7e003100000000008159eb9911004465736b746f7000680009000400efbe575900728159eb992e000000050904000000020000000000000000003e00000000006cee72004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	Quasar.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4044	explorer.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
2440	msedge.exe
2440	msedge.exe
4732	identity_helper.exe
4732	identity_helper.exe
1124	msedge.exe
1124	msedge.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4044	explorer.exe
2224	Quasar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeRestorePrivilege	3464	7zG.exe
Token: 35	3464	7zG.exe
Token: SeSecurityPrivilege	3464	7zG.exe
Token: SeSecurityPrivilege	3464	7zG.exe
Token: SeDebugPrivilege	1312	Quasar.exe
Token: SeDebugPrivilege	2224	Quasar.exe
Token: SeDebugPrivilege	2348	Client-built.exe
Token: SeDebugPrivilege	1416	taskmgr.exe
Token: SeSystemProfilePrivilege	1416	taskmgr.exe
Token: SeCreateGlobalPrivilege	1416	taskmgr.exe
Token: 33	1416	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1416	taskmgr.exe
Token: SeDebugPrivilege	4372	Client-built.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
3464	7zG.exe
1312	Quasar.exe
1312	Quasar.exe
2224	Quasar.exe
2348	Client-built.exe
2348	Client-built.exe
2224	Quasar.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
1312	Quasar.exe
1312	Quasar.exe
2224	Quasar.exe
2348	Client-built.exe
2348	Client-built.exe
2224	Quasar.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe
1416	taskmgr.exe

Suspicious use of SetWindowsHookEx 43 IoCs

pid	Process
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
2444	OpenWith.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
1080	OpenWith.exe
2224	Quasar.exe
2224	Quasar.exe
2224	Quasar.exe
2224	Quasar.exe
2224	Quasar.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4600	2440	msedge.exe	80
PID 2440 wrote to memory of 4600	2440	msedge.exe	80
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 4712	2440	msedge.exe	81
PID 2440 wrote to memory of 832	2440	msedge.exe	82
PID 2440 wrote to memory of 832	2440	msedge.exe	82
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83
PID 2440 wrote to memory of 3800	2440	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/quasar/Quasar
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffc34b346f8,0x7ffc34b34708,0x7ffc34b34718
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,12373127373959216469,9945789514508347155,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,12373127373959216469,9945789514508347155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,12373127373959216469,9945789514508347155,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12373127373959216469,9945789514508347155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12373127373959216469,9945789514508347155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,12373127373959216469,9945789514508347155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6b94d5460,0x7ff6b94d5470,0x7ff6b94d5480
    3⤵
    PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,12373127373959216469,9945789514508347155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12373127373959216469,9945789514508347155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12373127373959216469,9945789514508347155,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12373127373959216469,9945789514508347155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12373127373959216469,9945789514508347155,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2236,12373127373959216469,9945789514508347155,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12373127373959216469,9945789514508347155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2236,12373127373959216469,9945789514508347155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3996

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap3070:84:7zEvent7297
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3464

C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe
"C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1312
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12"
  2⤵
  PID:4472

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4044
- C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe
  "C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2444

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1080
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe.config
  2⤵
  PID:4372

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1128
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:1512

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2348

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1416

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Quasar.exe.log

Filesize
2KB

MD5
f6c287509481140fda8116c8e831b7d6

SHA1
781f9e972037007da6ebe92d0e9ba51f4fd5d714

SHA256
a23d0654fdd344a19d1c8e0feb6f4e1803292a4d033773e14dad26e17dbff661

SHA512
63ec7882fd46ecc88e50672478533be670a77dd4f8056418db59d3ce6e776e44f5a39a89ee99e092fcfb9be61079cb34f20fa8a3a5c59b342afe05e113fa8ab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
467bc167b06cdf2998f79460b98fa8f6

SHA1
a66fc2b411b31cb853195013d4677f4a2e5b6d11

SHA256
3b19522cb9ce73332fa1c357c6138b97b928545d38d162733eba68c8c5e604bd

SHA512
0eb63e6cacbec78b434d976fa2fb6fb44b1f9bc31001857c9bcb68c041bb52df30fbc7e1353f81d336b8a716821876fcacf3b32a107b16cec217c3d5d9621286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cc10dc6ba36bad31b4268762731a6c81

SHA1
9694d2aa8b119d674c27a1cfcaaf14ade8704e63

SHA256
d0d1f405097849f8203095f0d591e113145b1ce99df0545770138d772df4997f

SHA512
0ed193fdcc3f625221293bfd6af3132a5ce7d87138cd7df5e4b89353c89e237c1ff81920a2b17b7e0047f2cc8b2a976f667c7f12b0dcc273ddc3b4c8323b1b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
245262011dd1e54424edd7af71360cd3

SHA1
c26f799c68894db23c1af9c3cc2cd703fb29a2d2

SHA256
04ae00691d8ec577b62d5afc7b98ab8135420e291ccf4b865e919da5a699953f

SHA512
41f2e61235b5d242d2ebc5881b1b2a3d68a95163c50392c9cfe2290030663f650aede5730730d41f653a8d2eea8265b5b6e5af1379c755ce265ebfed42a46a9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
308808789ab147baf6cd1908aeaf24ca

SHA1
37291f448fd0b6f4a6ea50dd3354e2f2d1684d67

SHA256
32369d85be06d358d06b5c58450694e98cb159ec97ff03861b40c112d305f54b

SHA512
bcd726635013fdbd7678fae3318791bbfd2575078a456e9baffde5065f21dec6ce9eac37dcfc2bca20ff5f0e6f667ac500c5d694d4fac422c541916eae127942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
580B

MD5
b2be0b91d96be56fdbb89506060fa0a1

SHA1
74c768352c4a3684fd9f28e3efe3efc578fedf7c

SHA256
996f6d2e255c465fe859c5cf6ca28e722cbd6e33449020e54df2029c7922f145

SHA512
0296104048192a9c41b3c251a2d2af02edc6dee1644e6ef489eb97c67f7cf8e51f5eba468f1038a972e50f5e11f04edb7d3f3f7f2f6265d7f70254036ff995ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe57daef.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a81eebdbe3c082447175f73746feef78

SHA1
df55398a9b41e8184aeebc3ab548193082db87b1

SHA256
330bc51c0e2ae9727f03085e7edf24a89b39ce91098bb35068e5f5d822093246

SHA512
f7d9d983735886532abe83d5763667fced4b50e48be167368fbbb51f0f616657e998ee698924ba63128aafa6d3e6ddc99cffd3fe9cfe8c0696d8ff0031b949ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d0ebaca60e03429d241d526452b9db74

SHA1
92564d753f14e5c46602f6a9cc6d2a04057c78b3

SHA256
f061575c63c36245dd897e7e2c8d510bea7060094960657affb1109547cf97e9

SHA512
5747cd79e2b5e13fb37e3f3a4088d799772c14abdedd56b75f9178b0d423c5722857d830a85ad886885fddb3ae554b8b7ae5df433a5ea1ad53a9b30e20f86a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7d69acf43e9608a97a5e2d3ef51f99f

SHA1
1e319bf885099e7628cb0ebde39faa602e8dfbf6

SHA256
8b48315fbba22ea2793c136980cea5e8047b7941b4dfdd0c7e2f78f470b33c26

SHA512
58eb8a7ca17d3e39040230f1c40757f9a3ef61be1f04c9f71e23ea8b5f135146330da12e3b650e07de0fad145ee19bbae8d5d3d51beeb28e48410e87b94a989e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
884cb2d78580844a83caf1a2c986ba7f

SHA1
9a3aba01a6f71833e740f2f18cf8c22386ffef12

SHA256
d75be0c9a186ce495420df2e8b9c3313426b2975cfa915ea1bad99b6cacaafa5

SHA512
3b19ed13c3bac517dd04f17563bd696268b6c78a92de52c99458e7568d257da851d2cc06e8271e582db7d6f310abef45140cfa2ad537c058da011c5b1245567f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3b964859deef3a6f470b8021df49b34d

SHA1
62023dacf1e4019c9f204297c6be7e760f71a65d

SHA256
087debdcfba4666c03a5ea699e9bb31cf22ef4e0fad7c961cb0b500e5d262fb5

SHA512
c30b7e1b28820a5815b52634b46cb210c241704e33e41304400cb3ed29e82ec547a1068fc819350b368456bcabd27034afade5add3251dc74e4174f51b6c7adf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5c2d5c900312f44e72209416d45723cb

SHA1
68fb8909308589149399c3fb74605600833fbbc1

SHA256
56f7a77549e5fc45bd4b1f7c2db3e8b4bd1dd9234545207613a80342cee8e7d8

SHA512
07c2920cff7c1125e3a2fe66bf21d8606a1f2a3d36be2d8e136da0d2a21130242ac8324f18cedfb0040304cf804815861767c969a6923d8db851312bf9b4348b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4c83ca3957e08f6a9a04f969086a7a1d

SHA1
8ba7016a6905a08121786e9148b95a8452364584

SHA256
ec4ea441ece21b238a25046694814d710870ecc23986b57784064ee6ab2b230b

SHA512
afdf02d8752c4ea2766b06a19f3dea09f243890800148a71cd6e700d87c235406c43ef73e190dd0b255e5959425d55b0926f2eee35f1e77ba927a354a898ce15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2814e892edbca60524e3cdedbb2a6a48

SHA1
dd2f5a87d61af112349ea8d95297cbb44a2021bc

SHA256
44b9e587069d0292a514c7683160eac941d5cc273543667f37073667da61c1e4

SHA512
205b4cf363040786426f183571094e8212d037c55760d66655f769f93efcb645fad6972416ec82c4a0f1899150b59040b526573c0d8754c142bb0eb3071fcb00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bfd5.TMP

Filesize
1KB

MD5
077d3aaccabb52899941e766032fb485

SHA1
38fb2760f37615ca86b194f0043b18fe5ee158a1

SHA256
ad0b9528f537d2fe362a634e3bb0e74a3f248260b99db69d1868d917f0deb0ce

SHA512
60896bf34646bb1b9de2cecd0f2f01b45ce043c9eaff65cdb35581a35f7c6d235c38d62a0a95fc343fb5f582cb886138dcc54d14d63f295225e7b88f089d3214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e6028456958833094cc51abb5804b3a5

SHA1
016e41b78a79e0946576ba8ccf434bccd4592f14

SHA256
39b77745ff68f44984161c1b66c1d19aa282380acde43fa0337c71c4102a1d11

SHA512
aa33f170f644a40692d30d11f1d6602ab0f394f5447949d080e9200837620c5cf978e0a7ff54c53f8aad9f1046876381d70cc03fe15c629d2302e67af12baed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
dff2bfc86555ef1e61d7edc6ab169a2c

SHA1
b34a6f1933f51d608b0a380192afc42ef44c51b3

SHA256
f40825fcc39478c535cb0f3a5a4e8e8c946a4881fbc049c88cf38ebe47d2c259

SHA512
d346beaf9c4f98bda09ccf01518c8316fce1ac725bb1b91881a91aab4031561f9ede2a98efdcc380d1d0f16aceb7a46c1103ba7de5072705f9296d3b02f07204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
25ea8dcacd8a47bef66a672c1b38f4af

SHA1
86265e4aa5621d5fd3126be7f3bb7dfd81d421a9

SHA256
5e9a8ae989ecd89be3a226555bfbdfb2d5f7503f9869043c6691b6f71fd591c8

SHA512
4647974b1f163bb8d59c60bed8fe2d0a1192f3eb35b1af9f1678eaaaefb1b492996c9828a25bd4d86bf0621be1501409662e25d57d89f54ce9ef4af2aa1679e3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4152190078-1497776152-96910572-1000\362b7becb2b09adff53d943da8a648d4_2c66422d-2e9a-43a2-ba7a-ba47156abb73

Filesize
3KB

MD5
7ba8b0f960663457da65af9ad2cc5182

SHA1
236b684c2b709361211fc43349f3d11b3b97f424

SHA256
bd6662c331646c5283ca92883bff4d46cba6e1da3b3623e91546f1c5c8d8dc97

SHA512
caab259fde1ce5ac8d2b1a96e09fa11cd11064132adc2127f6ee0ab181aa8e54caa08b75ae68ab55fbdd3bccea5457bf421ec9263aa072604cd51315d59e2e7e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
52eeb18c3a316a0fc76a925048f6107d

SHA1
c19b44e856d6ebc5413936af73e6e2155c1b6b63

SHA256
0db1851487641e5fc7ea766f3d959db814ea51401827ad09df784356b7d0408d

SHA512
453084b505be2d48e3fb3b2176b6cf2c814e4d752bd5983b54689e1adb1c7a63c2d24b9e3b9f4875f9d264ae7a9fab65aed58bf0bad286989deda648edb4e512

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
3536c3990537533eec65e3ab3a2ee345

SHA1
0c971a5745915b2fb416cec679255fcc4bcb778e

SHA256
44bbb02fc2e14dbd2c38b8c708d0f990b18a999c25bf5735a32fff729d30f859

SHA512
3312f40a33c67adb5eacd6834eddf4f330f95e107bca0ac43692c401e5f463b60d72af8e747ad927984f7b365e2506204288ee9dc18406da118ad74de6930f84

Download Submit
C:\Users\Admin\Desktop\Client-built.exe

Filesize
3.1MB

MD5
3cf8ac84b2b820aa8afd9312fe9ff2e9

SHA1
5287894656a168f0d5527f1fc74a7f5c313c9821

SHA256
884f6ef60d9e52f5516fd6806456e95244fa87f112b6f4c015a2a775f7e606ed

SHA512
442b80f7d6d7d2454498c9eccb4817608d6686796d8ff71e86cad643c705094072905e9960cf2e2da75d421a9b512fd54ed2734b5ee0d34d7412c63b276db80b

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\BouncyCastle.Crypto.dll

Filesize
3.2MB

MD5
0cf454b6ed4d9e46bc40306421e4b800

SHA1
9611aa929d35cbd86b87e40b628f60d5177d2411

SHA256
e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42

SHA512
85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Gma.System.MouseKeyHook.dll

Filesize
56KB

MD5
bfb3bd1cb571360435100bfa6ed2b997

SHA1
1325e8dd76180a165117e04da4ee4a020e996880

SHA256
a67a424013544c8270c12633e2e1e287cd5cf0b3f2e81e8d8204b37a03da59ef

SHA512
ae5a88a9e86b9e64b8c289213f814586dfa5fe5e0cc21bdbc3e48c36d81fa9e763c6e78f24e40df07696228270ad72f408846125e61e33cae867ef8ff88a3c15

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Mono.Cecil.dll

Filesize
350KB

MD5
de69bb29d6a9dfb615a90df3580d63b1

SHA1
74446b4dcc146ce61e5216bf7efac186adf7849b

SHA256
f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc

SHA512
6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Open.Nat.dll

Filesize
68KB

MD5
cc6f6503d29a99f37b73bfd881de8ae0

SHA1
92d3334898dbb718408f1f134fe2914ef666ce46

SHA256
0b1e0d8f87f557b52315d98c1f4727e539f5120d20b4ca9edba548983213fbb5

SHA512
7f4c0a35b612b864ad9bc6a46370801ed7433424791622bf77bf47d6a776cb6a49e4977b34725ead5d0feaa1c9516db2ca75cb8872c77a8f2fab6c37740b681f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.Common.dll

Filesize
62KB

MD5
2185564051ea2e046d9f711ed3cd93ff

SHA1
2f2d7fd470da6d126582ad80df2802aabd6c9cea

SHA256
de930a748e4dc08c851ba0a22afce8dcfd0f15f23b291f9306c8ef6ccd7460a2

SHA512
00af241c1f89b478e66d758db26ed0a413b690d695abf91211b5cbc3985133632327ea0fc41140bd61d02271b6aa278a8e8f539d8ca6ce94972aef50c1a9c868

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe

Filesize
1.2MB

MD5
12ebf922aa80d13f8887e4c8c5e7be83

SHA1
7f87a80513e13efd45175e8f2511c2cd17ff51e8

SHA256
43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e

SHA512
fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe.config

Filesize
176B

MD5
c8cd50e8472b71736e6543f5176a0c12

SHA1
0bd6549820de5a07ac034777b3de60021121405e

SHA256
b44739eeff82db2b575a45b668893e2fe8fdd24a709cbf0554732fd3520b2190

SHA512
6e8f77fcca5968788cc9f73c9543ce9ab7b416372bc681093aa8a3aad43af1f06c56fcbc296c7897a3654b86a6f9d0e8b0fe036677cf290957924377bc177d9f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\Vestris.ResourceLib.dll

Filesize
76KB

MD5
944ce5123c94c66a50376e7b37e3a6a6

SHA1
a1936ac79c987a5ba47ca3d023f740401f73529b

SHA256
7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a

SHA512
4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\client.bin

Filesize
3.1MB

MD5
f4d16cfe4cad388255e43f258329f805

SHA1
fe7cc6c9eb76b5ad97867b46d053fae601fd4a2d

SHA256
8fb6ae3496d4ac025eab443d3e322b0faa3461d25b54093c9205d35746e3250e

SHA512
867045eac0f7765e6bea51e62bc4ed68b1e81ce6c2843d2e08714eb391a8ac94c2571c09828286252248400ea5c12bffa50a25c8ec5ad9e6d0bb836320ec188f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\protobuf-net.dll

Filesize
282KB

MD5
abc82ae4f579a0bbfa2a93db1486eb38

SHA1
faa645b92e3de7037c23e99dd2101ef3da5756e5

SHA256
ca6608346291ec82ee4acf8017c90e72db2ee7598015f695120c328d25319ec6

SHA512
e06ee564fdd3fe2e26b0dec744a969a94e4b63a2e37692a7dcc244cb7949b584d895e9d3766ea52c9fe72b7a31dacf4551f86ea0d7c987b80903ff43be9faed3

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12

Filesize
4KB

MD5
9e0bb9f49da20f53d6aca564c42026b3

SHA1
a8b57a6b5fa07ac0bd77a25426beff44d5741010

SHA256
f2680adcb4678b95ab49c38040c2f584bb4ad611a443811c860eb4d948f7de4e

SHA512
4ed24629a9d9249b1ab1bcf8790c8b68b4597f81f69575bfbdd0ee93e0c7ed5be2840653f230095c60d81fba48f53ee26fa57c68897ab80aa769a3645746e521

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\settings.xml

Filesize
371B

MD5
482b40c0d7aa8a3d1bbf44e34b4d2ca5

SHA1
d6d24c92b01a2d8a1e9cd5a15669443091f1c7a7

SHA256
40adac53b3488585f0bd0dfc919d7d145184d4b78ee7641d721bfdf141571c31

SHA512
64774f6c520ba1b99c353d79747e78d07dce9220ba9d4a0d81d8abd6d593ef32941b73d7795e1666b0777571bca194d9ac7b6b4394c1b2bde32387ea4ee2f813

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 544435.crdownload

Filesize
3.3MB

MD5
13aa4bf4f5ed1ac503c69470b1ede5c1

SHA1
c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00

SHA256
4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

SHA512
767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d

Download Submit
memory/1312-589-0x000001884B180000-0x000001884B1CC000-memory.dmp

Filesize
304KB

Download
memory/1312-586-0x000001884B130000-0x000001884B180000-memory.dmp

Filesize
320KB

Download
memory/1312-585-0x0000018848CE0000-0x0000018848CF8000-memory.dmp

Filesize
96KB

Download
memory/1312-562-0x000001884B390000-0x000001884B6BE000-memory.dmp

Filesize
3.2MB

Download
memory/1312-560-0x000001882D7F0000-0x000001882D806000-memory.dmp

Filesize
88KB

Download
memory/1312-558-0x000001882D2D0000-0x000001882D408000-memory.dmp

Filesize
1.2MB

Download
memory/1312-587-0x000001884B240000-0x000001884B2F2000-memory.dmp

Filesize
712KB

Download
memory/1416-703-0x000002A6A5480000-0x000002A6A5481000-memory.dmp

Filesize
4KB

Download
memory/1416-700-0x000002A6A5480000-0x000002A6A5481000-memory.dmp

Filesize
4KB

Download
memory/1416-701-0x000002A6A5480000-0x000002A6A5481000-memory.dmp

Filesize
4KB

Download
memory/1416-702-0x000002A6A5480000-0x000002A6A5481000-memory.dmp

Filesize
4KB

Download
memory/1416-694-0x000002A6A5480000-0x000002A6A5481000-memory.dmp

Filesize
4KB

Download
memory/1416-696-0x000002A6A5480000-0x000002A6A5481000-memory.dmp

Filesize
4KB

Download
memory/1416-695-0x000002A6A5480000-0x000002A6A5481000-memory.dmp

Filesize
4KB

Download
memory/1416-704-0x000002A6A5480000-0x000002A6A5481000-memory.dmp

Filesize
4KB

Download
memory/1416-705-0x000002A6A5480000-0x000002A6A5481000-memory.dmp

Filesize
4KB

Download
memory/1416-706-0x000002A6A5480000-0x000002A6A5481000-memory.dmp

Filesize
4KB

Download
memory/2224-624-0x000001D5FC620000-0x000001D5FC67E000-memory.dmp

Filesize
376KB

Download
memory/2224-626-0x000001D5F82B0000-0x000001D5F82CA000-memory.dmp

Filesize
104KB

Download
memory/2224-709-0x000001D5F8270000-0x000001D5F8282000-memory.dmp

Filesize
72KB

Download
memory/2348-689-0x0000000000A30000-0x0000000000D54000-memory.dmp

Filesize
3.1MB

Download
memory/2348-691-0x000000001CDE0000-0x000000001CE1C000-memory.dmp

Filesize
240KB

Download
memory/2348-690-0x000000001CD20000-0x000000001CD32000-memory.dmp

Filesize
72KB

Download