quasar | 8c693ee26028976b6f9377f1a95e27cb821120e2ab6b5ffb885782f66eb59699

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2025, 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

2ec8bb66e6d31a3eed3ab81af9c86633
SHA1

51775afa0bda90e7fb956897a0649302a6e3e862
SHA256

8c693ee26028976b6f9377f1a95e27cb821120e2ab6b5ffb885782f66eb59699
SHA512

a9b2fab76f360e7cdde888b205d823c062e9d883dfe97a066590a00e43ab2d6e8853223ff44e572bc221da03bd8f9bf2c419851783322172618f56a6e52c6d0a
SSDEEP

49152:rvTlL26AaNeWgPhlmVqvMQ7XSKsZxNESEZk/i6LoGdwETHHB72eh2NT:rvJL26AaNeWgPhlmVqkQ7XSK+xMkg

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

aurelosking-49560.portmap.host:49560

Mutex

9064a2b3-19b5-40a3-82ef-c2a129c8a662

Attributes

encryption_key
151D6A9E126EFB6E3B926F9127D87D6BF4A4C605
install_name
fontdrvhost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SecurityHealthSystray.exe
subdirectory
NVlDlA

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/3716-1-0x00000000000B0000-0x00000000003D4000-memory.dmp	family_quasar
behavioral1/files/0x0007000000023c73-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
4408	fontdrvhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1408	schtasks.exe
4992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1096	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3716	Client-built.exe
Token: SeDebugPrivilege	4408	fontdrvhost.exe
Token: SeDebugPrivilege	1096	taskmgr.exe
Token: SeSystemProfilePrivilege	1096	taskmgr.exe
Token: SeCreateGlobalPrivilege	1096	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4408	fontdrvhost.exe
4408	fontdrvhost.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4408	fontdrvhost.exe
4408	fontdrvhost.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe
1096	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 1408	3716	Client-built.exe	84
PID 3716 wrote to memory of 1408	3716	Client-built.exe	84
PID 3716 wrote to memory of 4408	3716	Client-built.exe	86
PID 3716 wrote to memory of 4408	3716	Client-built.exe	86
PID 4408 wrote to memory of 4992	4408	fontdrvhost.exe	87
PID 4408 wrote to memory of 4992	4408	fontdrvhost.exe	87
PID 4832 wrote to memory of 4964	4832	msedge.exe	110
PID 4832 wrote to memory of 4964	4832	msedge.exe	110
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 2372	4832	msedge.exe	111
PID 4832 wrote to memory of 3756	4832	msedge.exe	112
PID 4832 wrote to memory of 3756	4832	msedge.exe	112
PID 4832 wrote to memory of 2424	4832	msedge.exe	113
PID 4832 wrote to memory of 2424	4832	msedge.exe	113
PID 4832 wrote to memory of 2424	4832	msedge.exe	113
PID 4832 wrote to memory of 2424	4832	msedge.exe	113
PID 4832 wrote to memory of 2424	4832	msedge.exe	113
PID 4832 wrote to memory of 2424	4832	msedge.exe	113
PID 4832 wrote to memory of 2424	4832	msedge.exe	113
PID 4832 wrote to memory of 2424	4832	msedge.exe	113
PID 4832 wrote to memory of 2424	4832	msedge.exe	113
PID 4832 wrote to memory of 2424	4832	msedge.exe	113
PID 4832 wrote to memory of 2424	4832	msedge.exe	113
PID 4832 wrote to memory of 2424	4832	msedge.exe	113
PID 4832 wrote to memory of 2424	4832	msedge.exe	113
PID 4832 wrote to memory of 2424	4832	msedge.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "SecurityHealthSystray.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\NVlDlA\fontdrvhost.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1408
- C:\Users\Admin\AppData\Roaming\NVlDlA\fontdrvhost.exe
  "C:\Users\Admin\AppData\Roaming\NVlDlA\fontdrvhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "SecurityHealthSystray.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\NVlDlA\fontdrvhost.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4992

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1096

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8a73246f8,0x7ff8a7324708,0x7ff8a7324718
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,15034963493023224346,10259225098964408598,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,15034963493023224346,10259225098964408598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,15034963493023224346,10259225098964408598,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15034963493023224346,10259225098964408598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15034963493023224346,10259225098964408598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15034963493023224346,10259225098964408598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15034963493023224346,10259225098964408598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,15034963493023224346,10259225098964408598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,15034963493023224346,10259225098964408598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15034963493023224346,10259225098964408598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15034963493023224346,10259225098964408598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15034963493023224346,10259225098964408598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\666c65b1-e4f7-46cc-b1f7-8217e5493878.tmp

Filesize
10KB

MD5
9cbf64ce7c2a270ed95f8a84c97bd2f8

SHA1
5259cebf84e8473844570cd276e5203089e03b1e

SHA256
43891acf23ef02b96f49adc5e439c3b638366041db00e10d15d69ead320f81a6

SHA512
3ae7f0dbc63924f366f91158dd01434410c41bee36899a2e5ed82151cdf0e7733d40fe4cc5e6a744701ef0e02b9d2674d45da28209f0cad3a51cf6052a5bb7d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
42eea3d789ad8d8f68e53cca4cab511d

SHA1
63d1b15db47d8e3ce0af33cb9af1359f3c98c8b5

SHA256
fac4a5a322ea932e685e7d5fffc1f921a125a190d4b279239b9deecd2a3d042b

SHA512
dcfcd6c7b017898abd7af74a9da1acd62dd43d84be15163160d9eba60229ee6d4f750bc5006f348a982871504f2f7b99ac6b5f6296c7cc6a970b05970fe3507e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2cc5d54ad6071bdd9c5cb09d7b10050b

SHA1
5ad9233eeb9f6c2935cd932a3cdea540922e9e82

SHA256
c16754a90afc4dbe58fadcd2faa417b43eff99503d30ccad39a90fc339951154

SHA512
00ed047cd91169dd380d83f5e18137f690fd615845764b3d9293117a80029bd0d361a2bdf5e3c20b7a2a336160e8479bc64339a867035fb0b3beab1ecd8ccae4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8eeb7decc3e353571f1279386ef80f5d

SHA1
1ea51866a64c50f616848d372d88a20bd5ac438b

SHA256
7e9e388c5c203960bdc1ff06e0a70f17856106209675a14ea6534b756f889e67

SHA512
98543e5d5a448a859a1ec8e6ceb3ec83dc2266820126e72eacb57ae0dfb8f9f1eecb4c58a2d9adaa9ea688151cd6953886e113eb2f63b50bd451019154923c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f63d619d7e7a8216676df171db2e2763

SHA1
a420e9bb4da6e013cb2d406df9c977615e6ccb65

SHA256
dfcc1a407a9de6d7487f085323e7afb40cd25c34f2199678104e60cc946c7997

SHA512
c5d3eca89af9d80af11bf63e91b05173822374b7268996299e7ec4d00531981a37a7019cc901ad5edc1ad448024d524859eba6416cb7faa460cbc36f5f60ad12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e60e6682975a0b5183f839c5a29b1235

SHA1
ed072b71ee0be61efd878baab4a747eb8e727b34

SHA256
5d8686e80763a7be631d47746c11056bca8cb9e5cd56292855c458989e921a7d

SHA512
dd271ae688b0048a38a9767a0aaca905296fa2858c3b49db2cfc1ab517c464912904ad2b6593130415295f05404f23113d47cfaeabd30d3794bcea1abe669bff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
233a5e755f1cf7fbbee0fb0f2020ddfe

SHA1
50c5878b38aba424a74d7e21b2a1294d11860d4a

SHA256
0ccbe08de345b41b6c7b654247e3737e65e80d7c39ba7bc4680a550ae1bd5693

SHA512
b5a099cf91e96a9f31fb7a2276d8ee9e9616b799413aa5452ec1d8c45cd4f7b1524ff14766b4d40e85bf646347135ce4e3de241dab56885f68bbcf605d97803f

Download Submit
C:\Users\Admin\AppData\Roaming\NVlDlA\fontdrvhost.exe

Filesize
3.1MB

MD5
2ec8bb66e6d31a3eed3ab81af9c86633

SHA1
51775afa0bda90e7fb956897a0649302a6e3e862

SHA256
8c693ee26028976b6f9377f1a95e27cb821120e2ab6b5ffb885782f66eb59699

SHA512
a9b2fab76f360e7cdde888b205d823c062e9d883dfe97a066590a00e43ab2d6e8853223ff44e572bc221da03bd8f9bf2c419851783322172618f56a6e52c6d0a

Download Submit
memory/1096-29-0x000001A4DBBA0000-0x000001A4DBBA1000-memory.dmp

Filesize
4KB

Download
memory/1096-18-0x000001A4DBBA0000-0x000001A4DBBA1000-memory.dmp

Filesize
4KB

Download
memory/1096-30-0x000001A4DBBA0000-0x000001A4DBBA1000-memory.dmp

Filesize
4KB

Download
memory/1096-28-0x000001A4DBBA0000-0x000001A4DBBA1000-memory.dmp

Filesize
4KB

Download
memory/1096-27-0x000001A4DBBA0000-0x000001A4DBBA1000-memory.dmp

Filesize
4KB

Download
memory/1096-26-0x000001A4DBBA0000-0x000001A4DBBA1000-memory.dmp

Filesize
4KB

Download
memory/1096-25-0x000001A4DBBA0000-0x000001A4DBBA1000-memory.dmp

Filesize
4KB

Download
memory/1096-20-0x000001A4DBBA0000-0x000001A4DBBA1000-memory.dmp

Filesize
4KB

Download
memory/1096-24-0x000001A4DBBA0000-0x000001A4DBBA1000-memory.dmp

Filesize
4KB

Download
memory/1096-19-0x000001A4DBBA0000-0x000001A4DBBA1000-memory.dmp

Filesize
4KB

Download
memory/3716-0-0x00007FF8ABFF3000-0x00007FF8ABFF5000-memory.dmp

Filesize
8KB

Download
memory/3716-9-0x00007FF8ABFF0000-0x00007FF8ACAB1000-memory.dmp

Filesize
10.8MB

Download
memory/3716-2-0x00007FF8ABFF0000-0x00007FF8ACAB1000-memory.dmp

Filesize
10.8MB

Download
memory/3716-1-0x00000000000B0000-0x00000000003D4000-memory.dmp

Filesize
3.1MB

Download
memory/4408-31-0x00007FF8ABFF0000-0x00007FF8ACAB1000-memory.dmp

Filesize
10.8MB

Download
memory/4408-17-0x000000001C390000-0x000000001C3CC000-memory.dmp

Filesize
240KB

Download
memory/4408-16-0x000000001C330000-0x000000001C342000-memory.dmp

Filesize
72KB

Download
memory/4408-13-0x000000001C3F0000-0x000000001C4A2000-memory.dmp

Filesize
712KB

Download
memory/4408-12-0x000000001C2E0000-0x000000001C330000-memory.dmp

Filesize
320KB

Download
memory/4408-11-0x00007FF8ABFF0000-0x00007FF8ACAB1000-memory.dmp

Filesize
10.8MB

Download
memory/4408-10-0x00007FF8ABFF0000-0x00007FF8ACAB1000-memory.dmp

Filesize
10.8MB

Download