quasar | hxxps://github[.]com/youvegotpwned/RedEngineCrack/releases/download/fivem/RedEngine[.]zip

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2025, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/youvegotpwned/RedEngineCrack/releases/download/fivem/RedEngine.zip
Sample250107-hefa4ayncx

Score

10^/10

quasar training discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

TRAINING

185.241.208.185:16145

Mutex

22073971-8d9a-4364-9916-abbb09ac9d8b

Attributes

encryption_key
7A9A8376440E3257DB2B54403642F366A5FBE14A
install_name
Starter Module.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Starter Module
subdirectory
Modules

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/3140-94-0x0000000000380000-0x0000000000404000-memory.dmp	family_quasar
behavioral1/files/0x0008000000023d2e-97.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
4328	Starter Module.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Modules	RedEngine.exe
File opened for modification	C:\Windows\system32\Modules\Starter Module.exe	Starter Module.exe
File opened for modification	C:\Windows\system32\Modules	Starter Module.exe
File created	C:\Windows\system32\Modules\Starter Module.exe	RedEngine.exe
File created	C:\Windows\system32\Modules\Starter Module.exe	RedEngine.exe
File opened for modification	C:\Windows\system32\Modules\Starter Module.exe	RedEngine.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4452	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2868	schtasks.exe
1084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
3264	msedge.exe
3264	msedge.exe
2200	identity_helper.exe
2200	identity_helper.exe
4452	msedge.exe
4452	msedge.exe
1708	RedEngine.exe
1708	RedEngine.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3140	RedEngine.exe
Token: SeDebugPrivilege	4328	Starter Module.exe
Token: SeDebugPrivilege	1708	RedEngine.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
4328	Starter Module.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
4328	Starter Module.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4328	Starter Module.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 3916	3264	msedge.exe	82
PID 3264 wrote to memory of 3916	3264	msedge.exe	82
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 4000	3264	msedge.exe	84
PID 3264 wrote to memory of 4000	3264	msedge.exe	84
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/youvegotpwned/RedEngineCrack/releases/download/fivem/RedEngine.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb55646f8,0x7ffcb5564708,0x7ffcb5564718
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3092

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\RedEngine\Tutorial.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4452

C:\Users\Admin\Downloads\RedEngine\RedEngine.exe
"C:\Users\Admin\Downloads\RedEngine\RedEngine.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3140
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Starter Module" /sc ONLOGON /tr "C:\Users\Admin\Downloads\RedEngine\RedEngine.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2868
- C:\Windows\system32\Modules\Starter Module.exe
  "C:\Windows\system32\Modules\Starter Module.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4328
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Starter Module" /sc ONLOGON /tr "C:\Windows\system32\Modules\Starter Module.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1084

C:\Users\Admin\Downloads\RedEngine\RedEngine.exe
"C:\Users\Admin\Downloads\RedEngine\RedEngine.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RedEngine.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RedEngine.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
MD5 b8880802fc2bb880a7a869faa01315b0
SHA1 51d1a3fa2c272f094515675d82150bfce08ee8d3
SHA512 e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
MD5 ba6ef346187b40694d493da98d5da979
SHA1 643c15bec043f8673943885199bb06cd1652ee37
SHA512 2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 265B
SHA256 fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d
MD5 f5cd008cf465804d0e6f39a8d81f9a2d
SHA1 6b2907356472ed4a719e5675cc08969f30adc855
SHA512 dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2c7366a4af1678f4c9f5239b3fd274b62b0cdded027b0d14d409fd81f84c7d74
MD5 de42a5d441e034fc9ae037794d699716
SHA1 e2a95a814848e6d95722d630b405af9f90bc5fd5
SHA512 a774e7f0204e16c9e3695129fe8864582f583a5e88bf380cdd6408ab6391f6280cd837f85ae1524fcf5dc3d74fa1fe9dfbbea056624989938257de28f5d7335f
SSDEEP 96:nHktv1BMFwpvWMoiVmdeHAnKeexUWQyV+VDCziEwb:nHk5rMFGWMXGKnro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f21c7fd1e82314d39085ae4d168838476bfd0cf8eb19c2f284c8034a88646496
MD5 b91eb0b4b0091e0848c162b12dbbac66
SHA1 73c34299b2efb59a0ddbf0c3b71935b8ffc0c2c9
SHA512 93896592c741f43f075006bb019afe99c3686cb487f0b0e70d05c0f1b4212bb7a9bca4035684ed08fb8ccee9d7a6e5e5d885c545f4cfd73ad27a7f9529739c19
SSDEEP 96:nHk8sQPv1BMFwpvWMoiVmdeHAnKeexUWQyV+VD7AiEwb:nHkCrMFGWMXGKnrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 b26965f8cf3738d6affdf92853b65791d4fc772572448c37a1a178c8865e8982
MD5 d480daf11dca995a828828eab795371d
SHA1 6bf0b8c5e2dab3a907f847493de4eaecf75d2d09
SHA512 92af85fce1737cd61bcdc5a60ee636cfa73fa2358211ab7efc4aae182e78e4c10ac123bba48c436542700e16eeae77f9e0c9367e11ea7f1a0d3a400b5e06b358
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupmKe2RULkNvAi8wU8epku:A9iIxuERzA83h09RZxYmE94iPU8Xu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 3c50d900def421f6bb42497a6f8a11552337c34099c5968ee468fbadbbc45a86
MD5 aeab8cdc474ca67fe1c1503a94135792
SHA1 437981a401d5eeee2314beb8c69289eb0b423bad
SHA512 1957e333ac06c95ebaf03b7bac71cf61c4c91d88c30e4ebecd936e0d1307ad0b7e01fe61017991fc7400134b2bafe1d66025458dc87c476e741c7630098dbd11
SSDEEP 192:BoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupmoe2RULkNQAi8wU8epku:99iIxuERzA83h09RZxYmG9xiPU8Xu
MD5 SHA1 SHA512 SSDEEP

Submit Download

RedEngine.zip

Path C:\Users\Admin\Downloads\RedEngine.zip
Size 773KB
SHA256 fc767ffc7f989455ce6aa641b29c14510d8de441cb423c211421e41d92febc10
MD5 e0bc13d8be65d524a6e7f23a0764b2ae
SHA1 451127b271d4b6e40010b90eb74dd8b9bf531d39
SHA512 a70ab7673c006d4ab1fd88b1a44460604fcca765340eb919c77b3ccaec39f85f562a6490ec9b46cd3957335b9a421f68ed710ed9ed3d2e14776f8410c1edb66a
SSDEEP 12288:aHPXfpduG1tAIKZHPXfpduG1tGEsHPXfpduG1tGEqJPb3D58uPHjSW:2PXfpZAIEPXfpZGJPXfpZGvAuPjSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Starter Module.exe

Path C:\Windows\System32\Modules\Starter Module.exe
Size 502KB
SHA256 67e35ca53e1ee18113207c2edf4b165ae9158cfed151e08bac627327f9c60f21
MD5 7178d81c9afdabb202f31315f7eed7e2
SHA1 527a063588b3e4d3acc04cf211d9b0df33f5ade2
SHA512 80b770bd2d3541400386c4aa446da8840823864a62d73554dd62ea08d5e9596f2b737fa8046eb6fb892690d115eb928022cdb1d24f4f8d9cf2e449adfd0809a5
SSDEEP 6144:9TEgdc0Y5XAGbgiIN2RSBTuYNzBlh/gKeFwQHocEhyb8F9ODx2cTR30:9TEgdfYVbg/uOiFwR12x2cd0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3140-94-0x0000000000380000-0x0000000000404000-memory.dmp

Download

memory/4328-100-0x000000001C680000-0x000000001C6D0000-memory.dmp

Download

memory/4328-101-0x000000001C790000-0x000000001C842000-memory.dmp

Download