quasar | hxxps://www[.]darknet[.]org[.]uk/2020/05/quasar-rat-windows-remote-administration-tool/

Resubmissions

22-01-2025 19:57

250122-ypc7gsspdv 10

22-01-2025 19:54

250122-ymnv7ssndy 3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.darknet.org.uk/2020/05/quasar-rat-windows-remote-administration-tool/

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

bypasserlinks:4782

Mutex

QSR_MUTEX_VDnhaeH7vivjNtAe0g

Attributes

encryption_key
5nCOBTFm6Txd37SEHX8E
install_name
bypasserlinks.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000400000000073b-379.dat	family_quasar
behavioral1/memory/5988-381-0x00000000008C0000-0x000000000091E000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	bypasserlinks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	bypasserlinks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	bypasserlinks.exe

Executes dropped EXE 7 IoCs

pid	Process
5988	bypasserlinks.exe
3640	bypasserlinks.exe
4976	bypasserlinks.exe
4012	bypasserlinks.exe
5472	bypasserlinks.exe
5372	bypasserlinks.exe
3048	bypasserlinks.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
138	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bypasserlinks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bypasserlinks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bypasserlinks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bypasserlinks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bypasserlinks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bypasserlinks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bypasserlinks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5692	PING.EXE
1776	PING.EXE
5536	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Quasar.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
5536	PING.EXE
5692	PING.EXE
1776	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5928	schtasks.exe
4688	schtasks.exe
5404	schtasks.exe
5220	schtasks.exe
4684	schtasks.exe
5468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
1720	msedge.exe
1720	msedge.exe
2096	identity_helper.exe
2096	identity_helper.exe
5396	msedge.exe
5396	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3720	Quasar.exe
2524	Quasar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5988	bypasserlinks.exe
Token: SeDebugPrivilege	3640	bypasserlinks.exe
Token: SeDebugPrivilege	4976	bypasserlinks.exe
Token: SeDebugPrivilege	4012	bypasserlinks.exe
Token: SeDebugPrivilege	5472	bypasserlinks.exe
Token: SeDebugPrivilege	5372	bypasserlinks.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
3720	Quasar.exe
3720	Quasar.exe
2524	Quasar.exe
2524	Quasar.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
3720	Quasar.exe
3720	Quasar.exe
2524	Quasar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3720	Quasar.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 4752	1720	msedge.exe	83
PID 1720 wrote to memory of 4752	1720	msedge.exe	83
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 756	1720	msedge.exe	84
PID 1720 wrote to memory of 4896	1720	msedge.exe	85
PID 1720 wrote to memory of 4896	1720	msedge.exe	85
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86
PID 1720 wrote to memory of 992	1720	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.darknet.org.uk/2020/05/quasar-rat-windows-remote-administration-tool/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd8,0xdc,0x7ff99b7b46f8,0x7ff99b7b4708,0x7ff99b7b4718
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10991912506604363321,4195018524073715217,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2212

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5740

C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\Quasar.exe
"C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\Quasar.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3720

C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\bypasserlinks.exe
"C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\bypasserlinks.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5988
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\bypasserlinks.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4684
- C:\Users\Admin\AppData\Roaming\SubDir\bypasserlinks.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\bypasserlinks.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3640
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\bypasserlinks.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JwTb2HzYOZor.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1796
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:5220
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5692
  - - C:\Users\Admin\AppData\Roaming\SubDir\bypasserlinks.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\bypasserlinks.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4976
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\bypasserlinks.exe" /rl HIGHEST /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5928
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eOpv5APw40B6.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1776
      - C:\Users\Admin\AppData\Roaming\SubDir\bypasserlinks.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\bypasserlinks.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4012
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\bypasserlinks.exe" /rl HIGHEST /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4WXcXsUii5Sz.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3316
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5536
        
        C:\Users\Admin\AppData\Roaming\SubDir\bypasserlinks.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\bypasserlinks.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3048

C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\Quasar.exe
"C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\Quasar.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2524

C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\bypasserlinks.exe
"C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\bypasserlinks.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5472
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\bypasserlinks.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5404
- C:\Users\Admin\AppData\Roaming\SubDir\bypasserlinks.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\bypasserlinks.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5372
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\bypasserlinks.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Quasar.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bypasserlinks.exe.log

Filesize
1KB

MD5
10eab9c2684febb5327b6976f2047587

SHA1
a12ed54146a7f5c4c580416aecb899549712449e

SHA256
f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928

SHA512
7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
66KB

MD5
06702fdff4205590c1caa29b580e9620

SHA1
966017a8f488ddc3707f7d2c22a6c7eb51f58f29

SHA256
7586590346cdb9520dc3cf7131e5662b3c4407d2624ec22dd0e1c1eb9725ce36

SHA512
7c39333eb130eba6c9f57c50b8b6fbebf90c3cd49bbd7a967c6d31f7b997ea085770b84caf4ae2d984898a445535a20777c671e382e2da01e21e1c40248d322d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
20KB

MD5
bf19963f072b61208a423c95d2b0dbb2

SHA1
7b39999fbfdfc5f646c47e07eddff767a8f77057

SHA256
cc731c3775c0ab17bb6d658c01591c6aa240fc0fd4ef4872792389020f1ddc8c

SHA512
49ad4dd456ee69f86de1ef6dc6b8c48bf9e6652e0df7e3370ddf944867c7b416d3e7e3703f01831cafa845270f0af6a1b088b897afc6a48c67477c424fa6cbee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
b588a97aad669ad62c94db16b2f93ceb

SHA1
a81ecc3278172df0119777565a98d4968f2ceae3

SHA256
953ca67360420bb7e4405bed0b14a252c78cd3de911ebc24aaee4048d86b179c

SHA512
977e49fb102b56d3dad7f1311b07767b072e3c8c7cf98e8daa67d440f13039e21b8aad22777d804f42aa485ae13eb4fbf29ba206e0df009b5f803ee4da52ba23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
3c13a088f861972a3a025c9eac03b53b

SHA1
7c77424a92c51e06804fd03992c0f4a3f8b3df9d

SHA256
67385ee9e3aa805bc06d1bd876afe488362127699296d70b9762a755d4066f03

SHA512
fdfe4b9513ff9bd217168822534f3d4a984abf186d7a3261acb5ac322abc8e0dd2e68ca8e5a0e7aca12de3058c2ea6b5b7f1732b3f80c1ac876ae75a45a458e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
571d8ca2155300a9845e566f0912ca09

SHA1
c63400254b6e75596a0d89cb67019069fdd333fa

SHA256
ca82006ef762cb91c9087093890fdb9173dfff9649f714bd04b9d8502bab15db

SHA512
7bf407093f71779d36f08a4e3cd76eb41cb9679cf92e0fc81af8e48acc17da64be409badb41df16688da0b962241d4d35258139a1fd4f4bd76b6b09b023f3c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c9eb8517a2edf76b98a58e83aa442e5e

SHA1
4fbedce4650b140821982104348ada54e3319323

SHA256
4d809dce37a8e6ed65bcd8b19be380a5bacbc10478fa0c0aa247cdc45a5cd568

SHA512
b3a7bc33bf50c6c6a1386c980bfc2db7a5144c853e65e89eb41b16cac4a0d40baa9ee68ae7ecf57dc90a8e7664f106f15cde7c044935cdd0f0d04036ae99ef8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
85fc38a9dd5d06f11c6296bb6ecd364e

SHA1
214b17cbd118768b643ecaad7cc0c27e54f4e9c7

SHA256
eae693678cfb26f39246101591d47f7ce66a30096122f6f63aa829c39532cb3e

SHA512
916c1f601e67cc20b4e07873875fa8e519eacd5e3695cee515ca435430b465694ff31b4259b585db4dd32b9898b25bd8e962f67a1958fcac9a3a03241faef539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
532B

MD5
11aefad87e41b6e81ab4d7e72db9207a

SHA1
01324bf6f7000e377c9977828f092fdebbbf4b81

SHA256
749b44ac9742296109ae1b5e5f864f7f937042735310fc69a17aa102dea909e3

SHA512
63d60a48fffbe4be99adad5e213440f1aa257b977a977f4da515ce0c6f42e02b08ecbf02fcc4980c68a0ebd38c2e3712e89bc14b7a1d5084d4eda0d8cb09bcad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fc90.TMP

Filesize
367B

MD5
580227866e48a32f907ad1e5b22aa135

SHA1
821369b7cd3c1452728b4129a7d0baa341bafaba

SHA256
893a4a28110d7123d48f6aad523be32b7d1a34fe42e575dbd1541a485c33abd0

SHA512
28e3673f47cd72663c3033d0d0486331d9ec36873aef5f131cd6483eaf755db51b6babafcbe8e15d45ee951b7f0a35e39c37b4f5aeecfd809d7e12df849aee97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a0eec9ed82515bc8e7cdbf420281f589

SHA1
da2056f17431d7cbe79bd767be9326da1943882d

SHA256
2424762b5dc20c626ced131cf32df4c719d5a037bc6964f8f8d4c161651e4962

SHA512
e8f09db46994dd3e1a6f314babb2e2f44fcf0de92345e5bc117b5e178218fa285ef76e2101b73c99f79593ef57aa612f5869795c9e5d38dbbc0e36a1d5758764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f5b9ff2440b2e48feb8a526b2097418c

SHA1
aa1425780f18006595e0e84eeca65fd6a5bcedcf

SHA256
342fd629dfa4f758edb78dc3c209e10345fb5f37c298e6340c985ef920689004

SHA512
6b836cad0463e2225ec0a96e27e3f90cf02120acfa041bad34f2135b5d4fe053b11760c89f2b896d847ff25ad6ba2ba16a450cb730a4ef54c898af87adb8a307

Download Submit
C:\Users\Admin\AppData\Local\Temp\4WXcXsUii5Sz.bat

Filesize
214B

MD5
e6f22c9d365538b3bc0c82560e4cce80

SHA1
5baf0919370dff270ace7124388641efa8e2f335

SHA256
8e6d93dc17fc471088f3aedd8c97fa0abb5afae440df8cdc3893d3296add296c

SHA512
ccd59cb521b7dced74e7870dbfbd6763949100dcc2342372d970005793281b57e596660d3899ceb7f5b42f025e83b10f92935432b4463c7aed08295dd987757f

Download Submit
C:\Users\Admin\AppData\Local\Temp\JwTb2HzYOZor.bat

Filesize
214B

MD5
9bb2ac57e890fa5a5c879c238bebf0a4

SHA1
d3cb3298afeb1d8c61492a5accfdb72f4331b5a3

SHA256
d9ad7df9597653964e35dd7644e422371343735094c3f3ce9566c1df75ec5576

SHA512
4f5b952b30291778c846e9babe0f9c331f7426759a7d8bed237d690b99c50d3969bc8f47076c0c2af48442f77d836efbb14be5d05740de6b6e7232e9f23a6265

Download Submit
C:\Users\Admin\AppData\Local\Temp\eOpv5APw40B6.bat

Filesize
214B

MD5
a28ecffe9aeddb03c4e6f7c226ff9a01

SHA1
45da7f18a6630429fe6ae578819477bdab0f0d13

SHA256
7631c3f18cb3524180c831d6414dd1182d3580d4887ff3361a337be34e7b934a

SHA512
7fd50dbc36f31cd053005c2d90550beab0124d39291064bc274b0fea7477067db9162e0c7bcdc58bd665c63c9a3b9e7ff0203de3772ad7094d25526600712dbe

Download Submit
C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\Profiles\Default.xml

Filesize
1012B

MD5
2ebcda93e5fb6d7db3ebd114264e4de0

SHA1
a415bbd0c55b1d11b1952519f42807d07a10210d

SHA256
f4758c6fa738e6a443d091fc4847804724d33ed37f04c90817b7a0b0b2f557ea

SHA512
207305b918a025de37b23779bcd7562b63dd5541768caf031a286e75dbe88dda866068877b4c7a4c779a6c5a08fd40bc3dc4855a1488025f2c29496256f621f6

Download Submit
C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\bypasserlinks.exe

Filesize
348KB

MD5
19eeb075395ed505aa5475dc83ad2d00

SHA1
91d0e13194ee037b06e12ee8109e35865aa90adb

SHA256
020f0f1986238ee73d714e82eb700815877159fbf92876c377fb6bbdda4400bf

SHA512
492907f484601825e8cf5f82085538321c6adbd0414c6f7855d65fd5b599a24f2fac567cbf0579aaa10c60f4287aa6ddbbd668259a5c2ef7506a9f2113a170d8

Download Submit
C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\settings.xml

Filesize
51B

MD5
8af01757cc429d1347430084913566d1

SHA1
e4ec570a0b1a5c99e0613da232eeff4b42ffaa75

SHA256
f1a33cd5b1c9368f73b8ff144bed026664577317df27baff774b2bd2acbd52ef

SHA512
3edbca5a661d0fbdd0f8aac994b50e3f844e1d6ee6bfeadf0d8aa89fab1b7cec69b9f687a704c7a989726bb676604e2cdb75ca30441e94a05fdd4027ec9a494a

Download Submit
C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\settings.xml

Filesize
425B

MD5
30facdde239bdcbd526e7871352822c4

SHA1
84aed312ea2e06a32cfea1753d425b7edc1441bd

SHA256
193ee3c728637eecb4adef533657ea84dcc8c5be364a8b1aca809be3b2ba309a

SHA512
d8c91303b7c6a0966566d03d1f58471b2ae213bf13ad95ab64feb1f5d77b016876124fb221eeed9ca3ba48a69c04c21b648f092fb452b7e778d7aa1df60bc2c9

Download Submit
C:\Users\Admin\Downloads\573430ed-e970-4c9c-af87-40928b21956d.tmp

Filesize
611KB

MD5
ac17f5bfbdc14e9d9e8100d64cd9094d

SHA1
dd5b3afeb326fc02a59e3eb667abd68e2088212c

SHA256
30a4ec904324aab10b9f77127944ec98e8e1f222c893c1862f3bed4970ead8fb

SHA512
733a79e5326f6a09b5c4b4fa648bb967cbdf5ec00b389df8a12ddc0c46bd326e4ca7ad98e61b009a373ac404828444094498408b5683fec4e63251900ba3621f

Download Submit
memory/3720-294-0x000000001E140000-0x000000001E150000-memory.dmp

Filesize
64KB

Download
memory/3720-321-0x00000000216D0000-0x000000002171C000-memory.dmp

Filesize
304KB

Download
memory/3720-322-0x000000001F6E0000-0x000000001F6FA000-memory.dmp

Filesize
104KB

Download
memory/3720-264-0x0000000000E80000-0x0000000000FEC000-memory.dmp

Filesize
1.4MB

Download
memory/5988-384-0x0000000005430000-0x0000000005496000-memory.dmp

Filesize
408KB

Download
memory/5988-385-0x0000000006030000-0x0000000006042000-memory.dmp

Filesize
72KB

Download
memory/5988-386-0x0000000006570000-0x00000000065AC000-memory.dmp

Filesize
240KB

Download
memory/5988-383-0x0000000005390000-0x0000000005422000-memory.dmp

Filesize
584KB

Download
memory/5988-382-0x0000000005880000-0x0000000005E24000-memory.dmp

Filesize
5.6MB

Download
memory/5988-381-0x00000000008C0000-0x000000000091E000-memory.dmp

Filesize
376KB

Download