quasar | hxxps://github[.]com/quasar/Quasar/releases/download/v1[.]4[.]1/Quasar[.]v1[.]4[.]1[.]zip

Analysis

max time kernel
65s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2025, 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/quasar/Quasar/releases/download/v1.4.1/Quasar.v1.4.1.zip

Score

10^/10

quasar discovery spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/3460-725-0x00000291B1C70000-0x00000291B1DA8000-memory.dmp	family_quasar
behavioral1/memory/3460-726-0x00000291B2180000-0x00000291B2196000-memory.dmp	family_quasar

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1187602109\offscreendocument_main.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875694815666258"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 = 66003100000000007b5a538a10005155415341527e312e3100004c0009000400efbe7b5a458a7b5a538a2e000000f840020000000b000000000000000000000000000000ff5caa005100750061007300610072002000760031002e0034002e00310000001a000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{74123052-3864-46AF-AD30-E00ECA82F7F7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{EDA9284C-73DD-4823-BD37-A183115ED80A}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0 = 7e003100000000007b5a458a11004465736b746f7000680009000400efbe6d5a6f767b5a458a2e00000068e101000000010000000000000000003e00000000000d890e004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 50003100000000006d5a8680100041646d696e003c0009000400efbe6d5a6f767b5a408a2e0000005ee10100000001000000000000000000000000000000fb789500410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\NodeSlot = "5"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 78003100000000006d5a6f761100557365727300640009000400efbe874f77487b5a408a2e000000c70500000000010000000000000000003a00000000006ca45a0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3232	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
872	msedge.exe
872	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3460	Quasar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3460	Quasar.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
3460	Quasar.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
3460	Quasar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3232	explorer.exe
3232	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 3124	5096	msedge.exe	87
PID 5096 wrote to memory of 3124	5096	msedge.exe	87
PID 5096 wrote to memory of 2328	5096	msedge.exe	88
PID 5096 wrote to memory of 2328	5096	msedge.exe	88
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4252	5096	msedge.exe	89
PID 5096 wrote to memory of 4836	5096	msedge.exe	91
PID 5096 wrote to memory of 4836	5096	msedge.exe	91
PID 5096 wrote to memory of 4836	5096	msedge.exe	91
PID 5096 wrote to memory of 4836	5096	msedge.exe	91
PID 5096 wrote to memory of 4836	5096	msedge.exe	91
PID 5096 wrote to memory of 4836	5096	msedge.exe	91
PID 5096 wrote to memory of 4836	5096	msedge.exe	91
PID 5096 wrote to memory of 4836	5096	msedge.exe	91
PID 5096 wrote to memory of 4836	5096	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/quasar/Quasar/releases/download/v1.4.1/Quasar.v1.4.1.zip
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffb22d2f208,0x7ffb22d2f214,0x7ffb22d2f220
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1904,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2340,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2484,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3464,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3480,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4984,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5044,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5584,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5572,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5936,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6280,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6512,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6512,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3880,i,9381324619889037435,4832478400816042736,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffb22d2f208,0x7ffb22d2f214,0x7ffb22d2f220
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1772,i,17714644283031814091,3374266601167519012,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2340,i,17714644283031814091,3374266601167519012,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2076,i,17714644283031814091,3374266601167519012,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4128,i,17714644283031814091,3374266601167519012,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4340,i,17714644283031814091,3374266601167519012,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4128,i,17714644283031814091,3374266601167519012,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4480,i,17714644283031814091,3374266601167519012,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4688,i,17714644283031814091,3374266601167519012,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4696,i,17714644283031814091,3374266601167519012,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
    3⤵
    PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:736

C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe
"C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3460
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12"
  2⤵
  PID:2508

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3232
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtAddPFX C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12
  2⤵
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Filesize
16KB

MD5
cfab81b800edabacbf6cb61aa78d5258

SHA1
2730d4da1be7238d701dc84eb708a064b8d1cf27

SHA256
452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f

SHA512
ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
998db8a9f40f71e2f3d9e19aac4db4a9

SHA1
dade0e68faef54a59d68ae8cb3b8314b6947b6d7

SHA256
1b28744565eb600485d9800703f2fb635ecf4187036c12d47f86bbd1e078e06b

SHA512
0e66fd26a11507f78fb1b173fd50555dbd95b0d330e095cdd93206757c6af2780ece914a11a23cd4c840636a59470f44c6db35fa392303fb583806264e652016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
829546e3bde171256217bf302f4733ff

SHA1
355470b0ee3627e462c332d08ffd613b6fd9a6a7

SHA256
ae728ede8e0449df42ccb8bc8cde4670e039606cbc191ec9da1daf7e50260a3e

SHA512
4b4b012a59f696782ba60548a24bcd879cf59a48a427cd11dbe1d16174efdf22470c1297407d540639af69e993478d843428808ff83eb876e0e02f21345359e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
3cb8d2ff78e38d81aa7efc0bb100222d

SHA1
834dd39cc7644ae5ce571ff4b2a3aa9841f811c2

SHA256
db04767886b375c8795858011dc9a6eaf2dccacc5a319440251a234092ebe4ea

SHA512
0e92b6d4e1fc32505015f10567c6aa38516cbe2d89d96d5d2c33eac70348f3609eb0f01e1b27ebb86c247e50c3386102ffbd972762e59044a966674489cfe712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1fcf0f09-d659-4eb1-bba7-97bf0c8ab7ac.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
19b05a5e550bd2335dd052b9eb40b3a4

SHA1
3927e9f30c71947f709b038900d1fbd094059b46

SHA256
d48a3dc99740add6f37a2a3e6be81e4adcff9ab7e9dab058cf9796169984fcdb

SHA512
5e2ba5e505ac9d39e19da8dabeae4e2c13f43e7592a7ba88f37ef69492d725f621acc9fca3f1bd8f1f2ca815228fc70c8bed1e3aabd280fc5ac86674b5b38929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
5b1e3d153305a5a1f200e9be5f085649

SHA1
8e3a4446c6c0756d132f787779fa54e10870eb6e

SHA256
7e9da3830e1056b74af6783bda193c6d106f4aeebf911d2ddf5ec1530c72e14a

SHA512
d8b1be879c12ab28c379db79fdb37d71cfd9d5ce8c44c1afddb8722b9d7ac0f2d468d17f4482ef49ea38977cbbb58d1c62d4eb09347accb24fae39f70753cdfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
58bb0909fa01428c5d7c073797b7bde0

SHA1
517ee878fbb7f86abae9077b5b328fb8c8efdea8

SHA256
9e260f58a990d6ad90fec6f1458c322d66af79845914b1a9009ae3cf9dfc1d63

SHA512
18e1c65596f0a32f6e5a81b60d5a7ec38c0db664947e8435e33c689f83b19759dc65ef68193876bf73fcc68b24568b1f5d8df82a47c704fb099355e11f7154ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
b8adfa16f0792c89de029fb3c1d867a5

SHA1
23db0002c443fa47612bcccdcdfc9f90d835fd15

SHA256
3d2cf15aa3e0a4d6ae1e73cb46522795143798a76a060fe142cd2a82136cbee6

SHA512
baeea9203deb98b74f26500352752175ec827fbcd222f5a209aa928e3eb8ab1ce4c285f2b49b973f971c5874dcf4ecfa2e6ea6be8f2f155a927b373687b4e5d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e

Filesize
3.3MB

MD5
13aa4bf4f5ed1ac503c69470b1ede5c1

SHA1
c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00

SHA256
4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

SHA512
767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f

Filesize
19KB

MD5
5e5ae2374ea57ea153558afd1c2c1372

SHA1
c1bef73c5b67c8866a607e3b8912ffa532d85ccc

SHA256
1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3

SHA512
46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
87ba26e52059d17c3f84e9dae96d2e4a

SHA1
f829d54e19f89b012c0f4f148133edb299965354

SHA256
48a1aa88e1a40708cdbcd9d88eadcdba229301a73cf89bf2af8e5661913907ad

SHA512
fd43e6d7adce18a8aa8c92ca79b317ae44a33e5112c7f983dce48a2f458d247c57196aaeaceaa604a4fe9e8145f4e6256a781fac46c6cb617a7d2b6c1ef5276d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Filesize
346B

MD5
4421405ba861600b62dbad33eb255a13

SHA1
b84918bbb43f7b7bbb745dbad4205e28728960d6

SHA256
eec6dd77a4f2f41d775be30bfc4e51c232b8d0a15fb31cbaefdfaa396dc6ac78

SHA512
e9a1921a430c10c719fea6eb2b40c3642324aff9fdc70510e20898832a1798bee5218b798c8efc5b6390647b3829f31b508e51db0414f0bb3ef01407e597d2fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Filesize
32KB

MD5
d56a22c2600c786487e9600787fafca6

SHA1
69bc4adac6314402df313f5055a0f6377a94abf1

SHA256
227f7d0317abcacfc9627133bd05ece9af1583221e920a0bf26cfe1204414f05

SHA512
c3a20ce63e0f4180f7dd7adc0b09a8904a699e35e136906d7e0317d530094743e176a0fd6099b0ca42a2221f3fa211b9a0e638fbd695a4a476408ad4203b14e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Filesize
399B

MD5
a15ac2782bb6b4407d11979316f678fd

SHA1
b64eaf0810e180d99b83bba8e366b2e3416c5881

SHA256
55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a

SHA512
370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
322B

MD5
2fb97c43f4a8147b0803f5f232f548cf

SHA1
1ae960fcdbe093934e92aa34b757f1310c3065f4

SHA256
4bb3d38bec1448952a792d41ee654c0f7b10fb25abbc730398fb1dc217168787

SHA512
0e5802169accfbafe0cf2c2a812c73b1ac04c33205c5f76c72528b042fd890f31fc334143facc20b91cdf1405b01f117220c6978ce52b09e01458b05949a294c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
5d7c67a847d6182ab0cb7ca71fa82f62

SHA1
7a25108174002171c3261e901a9494bf7e213d4b

SHA256
9790f885aa0f22acf6fa1207b3aec98eda55d5077041d8eafd7bc67be0f35943

SHA512
6c688f13db540707b4bb04f2b0b934cddb5caafdf94760669b098d0ac515103e12c05ba345808e7b706aec0b53f648d8d9b07c489ef2942e613bef081f45de36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
cf02c632e95f8581898c432ea0df2939

SHA1
bfd4b1905879d6fe82d8ccf0964b0065476ba8a0

SHA256
cab10bb4a06ceea32aed7665b749ab74119976a896e1d525ed3c386ec13dd7ae

SHA512
d00ff77173148ec5e52c1608603b3bcd0d37f0149f1e12bf25ad98ced99f6fa3069f147f6f298059f242b889a8defb42aac1ff32a29e4ad499273c2c086d32c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
14fd9d8be007d729126cd9fb5f3cb015

SHA1
e32f3007df3cf5623925a32cfb69739ef63b56c8

SHA256
b9b6b996a0d023d8994e89c5a4c4782c0536d479d8dd5a0c57e3b0cc742ce987

SHA512
8f717d0e4a1a628c0c21fe714b97c00600e561ec42165bd232611c1df4f7866bb4e1897d6380859b558cc3317cdf9ce2e10896c827e5763323fed41f0e426159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
188B

MD5
01c172db366aba7dddfe11e359e018c8

SHA1
d78e0b20e4daa7a0a4d0606ca0d17b58d9e42fb3

SHA256
930bc62fd6d110b42ae0a741b4d6ee4b2fac8318d3af1b90c720178f2c0d8720

SHA512
4f6d6b2c0b55f79bfab2d4043fc8391758c2a7ff118dcf2c94591c2433a11cf5654f8e4ca21c431c1f8c7f4ce071c403c666fa1f57e7834c338b69c411c39a05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
3d843500780c198768479eeb91dcc7be

SHA1
e3eebd23e45fa38f74bced498327a1a558cd1690

SHA256
8c6497f2159ece17b9b17247187b7a31a73a5c25ad912416758ccf75a45e357d

SHA512
17821393fe88bd9d1c861cd88c1da2bde445914f38d74d17af370d964c7bbc4eda5d1897570907fc59fafd6e51d106995514ce5b2e2c02cc51d41605731ee46a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
d6f3200d259fc16a8314499c728c3db5

SHA1
0b33e676a7c6e5cbdb805192d435bcb35fd5acd5

SHA256
4a3db608839cc13e310890bac481556678fee90bfd33a9a3176d53b7987c2d06

SHA512
4fb57551d19b32699c8b4e3fd4b1bd8071f03a2f443100b165474c676d925987b3868b11737fdb3e80a0f6888e0a12a8efdae110d071b9f4b37af0c9f9fb0727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
338B

MD5
977bd07e69c3e50c52c3ddd037573a42

SHA1
e097501f881a6f57d6d4f7a717a6dce8b75fc7de

SHA256
449fc618ccdfb827bcebe2dcf6415ba46b839963be118776d97d4af7543e4488

SHA512
a7c65cc93b3611cb454b80d4037ca41c5dae1626fa1c616d821d2a3b211544a2687320a87a1a60a3911223f184d5088bc1148577373bdb784ddc91d30d386354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
b3b928558f352918f5dae488d31917af

SHA1
b2a990475b0acf9132f1dcf85e41ad5f27908b04

SHA256
f31d137d11e7e8c0dc673b3387efb90d41d2e715ae80d2c1a3c7d7766513f205

SHA512
0308aef015337b437bc790e8e4c09d17197044f9f55cdb6500e156a67e4c525ed5f13a45ec4632a7b4d81018bb378eab415f1fd0b3c475c3d34a641cf9ece00e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
aaf6717c2abc4ed273a964f93ce7f608

SHA1
4c232de428a9360115c80a9aab343cf69d4abf77

SHA256
ae42dbd7c20f7ac418c05efdf9b1da1c71122e06c63769c6e9e0c795aa242226

SHA512
b4205071d3b5d09ad0274779f3d7830ad9d214a0ed111773c47d62ba37f4f0850047df2c37d819e4d607e206e06ea80448ea5cc3f41b8ad8c35abd0b9eadbefa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
25KB

MD5
ca1b6775b0a83f70334409695faf488d

SHA1
1b5d49dace3b4864843c765cff69015ea5505e19

SHA256
ce156f5dd707448253ba920c87d06c46a1952a320dbddee762221dc77a26c1d8

SHA512
7d210aa90a9b39a516d6c8ace1ed82b8653e7419bf5a55a476f19779ac7bf8d998be0e2f6326685002207141bf6a36b81d907da7c53b702e02e67a62a4f1d5e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
a5808a8da3d7cfe4e1fc0f3349aa7721

SHA1
14f52272fc144d1e07024f75eae2ff7d40b7c6a3

SHA256
83e9123e55b061f418b71b6637c8db994d6e46fab62f154c0b1edc0ca4fdaeaf

SHA512
ad680a0a81deae5a10b7d1617f7cd4d57bef4bccc2eb24e27f3824486a7e7869a4115fc7f6b4c8b7ed5cf606daba737df20b043b316013c662c146a0d74b343b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
228KB

MD5
22964c117323687cd7373b3c895ad735

SHA1
5c81f3f46af21b4ea8bdb429fc856605b02a9921

SHA256
e01d3d9c7c74e83688001c237f6fc1233e4269d93545cea5865bd83df45323da

SHA512
f9d108bbf384540944bbe8dc764d5b0ee19c9a24d6ced689028dbed4b1451931397262b15685e059187c41c1ac3a57a9a791b22934756caa39a3d6d1734672b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json

Filesize
12KB

MD5
18261eb12378081f939fb9415ca0c9e1

SHA1
20d4ff782e17fe45e71c3f9fc60a94655f72ec7c

SHA256
12bbeec9a0af9e3ed945b28b9b8ef89b2f897768d1ba3ffd6f3fbb42fa5bc556

SHA512
fef634b4ce77c2f36ce1bdd63e8ac28e76cd089f0bff33f4425c757ddf37fe9fab30dea7b5bb51c91eb27012cf78800e03643e13d51a25bf624ce58ab3488a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log

Filesize
2KB

MD5
9831f8971d288869f99025b044972c0c

SHA1
ccd881fd56be3bac6784e8ebdbfbd6808713490e

SHA256
90bad6d2dcb55fe3bacc487d20e2b041a5d82102c5be68f0f78d44e6d147d887

SHA512
c1a800c6f1645f0843b0c407456b6b0bf8f78a80ee6e1903bda06502ca7cc035cfae7eaea8581c8e09d441e89769becca6dba15079e3e5c64ebcd8ad2fb43f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
14KB

MD5
46523aeabaec31098d22835c8b28b184

SHA1
00744634635db526c0cc325c25488b5e7dae204c

SHA256
1648f56a32ab6d5126173425d837d3edc5c4566886a2d0bd9bdf9e6c276c127a

SHA512
33f39537fa96b1e658707b3a92fb2a4d8779d9d21cf1111efc6f209eeb37ed3b3fb26206fbc1a2fe08a0e42d3132bbe57518fde4d9d3776477381fc68ca82f82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
2365cea7623f69bb7ed9c9144536b30d

SHA1
b44d3ffd078a940b02050540bac2af9b3b2bbd19

SHA256
e540dda315df8e0a24789443674e7a1008037d777797088325ed8d69b2959f75

SHA512
a33f0e6293b7313679100ef9a17788aa56a2b88bcdc509c6f349cc7568adfbdbeeff78eca8655797a8df51ef8ae07f5a40882b3410055c9c7baf6e8b7f0ea0c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
98f9f80caadccb540dd0671a4e1fd3ba

SHA1
504a0bf81b1d3f13019830ae3914631d709ceb21

SHA256
b0ae375b736f449f030a06847f2461fc1dd9309af9798f315d26a7018de944c8

SHA512
ffd32e550f7c9f921f27f65c36fda18532132b5685851dc17ee4d2f692a81eccbe34396b6a480a710721ed0dd65f59a8464235152e27f6f2f0111e6c2b5c9af0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
60aafa0a24f4759f21991d89779d6fd6

SHA1
9bf7520d0ced569d2b38ca086ccf84056c759e0f

SHA256
11b880cf1f32ba2ecf566aa93149cac9f013cee7d97cb330dcefb41b2ec82019

SHA512
745e20448dee007255708254f47b4d2fdebafdd8a1a8b3f7f2268fad5bf449fb0ce79299b507fe38f4defc60d147e5021e87d05de0414479a5e45f2988962685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
87037275d3dc19b8d6f4fda33d3431c3

SHA1
53f0bebb802128ed47fcbe3ca9dbcb9b902b7a9a

SHA256
4c44def4011c177c297c9e471248c4c887b8879b8b36aac1d922da2f09282390

SHA512
2142669901a1fcf3022632011ffc926eb838032a5d0bd520649e3c5f2b748813fb96ae19d1edc5fdc29f683318a2f09f5ad685f9ccf04c83712ced6c68f99019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
82e506d0d63d675b586db0f35e9ab528

SHA1
1c607c491129d7b47291511ba8dd3237d1c96707

SHA256
f4f8fb05f2466a8f32c86910f071fc9f5a2e24e13807cbe19081cd1097f9f0e4

SHA512
be1d975b7fbedf80a3b907707c7a336f61602092847a88bfd03e8186a58da6e80b51b37be130132c4c16b60708874983e5c55916a427330a437f071798c753fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
41986e831088c086e2f9bf2a650715df

SHA1
f857c5327162c36020b552c5f30443209a0edcff

SHA256
3e6cfdf39f93f0985b5bd626e7dd082947a85e40e59e0d6fe2b96ebdecd17cec

SHA512
11cb50edddd2ad19cf1ab63f765216bf47f0a68df3b73a55cbe3b9d1802164a406c3136f35d0dd9c92eb3852de0fdfab063952b8930fe0e5ddc144b16fd59353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
5ab03e29502996c554ba689d2556523b

SHA1
d0e6c46eb2d0c254c9adbbf06f98dad044655cc8

SHA256
47d40821958d83c6cc4e902a10d8c879a03632783dd275c1ffd75ed9f5d6258a

SHA512
c5625c64562072f56a7e836886bb6b927665cc45165b11b07c0a298285fc1dff72017599ed9a3199a0650c7a4ffb3d86dab69b1c64f85e8fb0b104f23e03b746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
490f5b80e0fa696d19562755d1e339e9

SHA1
2b671a9499206a73c45549e283fbb2074aa2bbb0

SHA256
3955256cf65a933ee476e435af20eaf44cbf8885f4b956838a740de27d2a7570

SHA512
4b5d0fb164e0971c4bddc594dca293f57f45dc0bfa11c2e84a8746616095efa0b03e321546b0f40926d235f553359d85a7588bb46c74440111316e4c262b81d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
ed057ee90b268f93d418c0940c080714

SHA1
558911ef518b923ca21b3af8918ed327698698b9

SHA256
e6629bcb04d98b66509852ef11172fb4c071b95acfcc4822693700cccdceb461

SHA512
d462a610bf4c5c82246db8841e6d1211fa77aebf388fe1613dc926a5ad0256946ba83ed0133b85bc8171704177c42c4f314366fac10134027182d012b9a475d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d1e46cad7a1288a2ada2cc1a1b2760e4

SHA1
173c080882489c5b806fb333f71a23be5298e649

SHA256
e5c0acb1106f6a098cfb852c51dbf2e204ebe50ae903c21deb695fb65ff42c76

SHA512
9d065ac9eb028b84f13b289899a6c6a1dbb5f2d4d5b28a00649021f4b247dd5bc742e67a48f8d6f03644d5600bb48dd3f3fdcdb9c1842a77158c783a0b6c1667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
c78d5446774c8f121eaf9c0c675b5cab

SHA1
c2257ab47fedb9d0dc0ec49a7355cddad32557ad

SHA256
a97be1cb654efbcdcf6b09a1576515f4cda99214f5f100004fd61c41a8333244

SHA512
c16e43e59303c6a8d2de27b7e947ea5df5ec20047231a503d13887ff61f4894a296c6946f54b9b37eb1f91a9f301e61fcef31ffbb151c5bf9e070ce8311581e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
ab5fdd2698e6ed1d49897c8864fa72d3

SHA1
ae5fd88c08035fdc5eb4855fd2f5e319c5ecea37

SHA256
6ef1f0f5da601694835fc52320f91dca5f09777f2d320134f25b647e7a818122

SHA512
b73e7181a4935564ba65ad7ec0cefe6d4f451bf517cf083e9858efdae76380f16378d5005cb966b973d2f11d721719dd4534bba398f4f3c5c9529f6f492dae50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
545fad858113779f39366865ed654d0f

SHA1
351c8a4b51fa970c261a95f125888114c1e585f1

SHA256
5dfbdc974059b0079ce7ca1609933f3c73fe967f6c321e3e4832568ebadad513

SHA512
9306605545a945e2307138487a7447eb8fe213e7e53c0d851e27adad90a060deecfb4e8940fe002a92fbd219878e7933caccdb8a7288fe3decf9defb854c0a9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
b93f924299a2a85ffb9aa7fc02d4f6c4

SHA1
d010841fd232c3f3bd3293c8df6a7e84fc9b57b1

SHA256
30314e64934f7e917114f8c42cdfc909676138f7a89caf2dcdea242c406e6c2c

SHA512
bfe6f5c2e5db0e2f68fd0751184335f7fc33687893d2e407713039613d9690d3bb74de14f53968ca8c0eef419000b847d685f1cc216d74c786d4104e0343cf51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
2e762aa7689d5baaa6203b89122c8a4a

SHA1
91c40867a99d169bb7d966bcf0df7145f54837c2

SHA256
58207854c7b12e27c601b6e791bc1ba309cc11c1f57ab343c9dfe6b3212ef82f

SHA512
f29a1b4089f2879963a2a1455fccfac198268aaf7feab9264badd84f6950b5a1c16e79ead578841af64b3def59e3d3f1f9ccf4a65df258aebe1eba7dc23a94c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
8fa60d4de00660a6d67ad95256d649c4

SHA1
68c209910558c8021680a701543d601ce3d3f742

SHA256
452ec992cbb725ab9f65c106995719a5730b213e22d0603de65337ef07004d5f

SHA512
aba271b8c77bf4ab3376005b589240c55088fdc4e32e31cd55898548c23160c337c6984822b283e9a27dbbd0a8628f46581ac1e0fedbd2c37380da238d702d3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
f7d5fd54af0c5e8c8dc0d2d21d5e47b1

SHA1
261e2e58a506d0645c8187a8fcec519fb8274acd

SHA256
0a495b42904873eb761c343da63ddcc31be2cfb4c33a2bfbe9096daf686c7c91

SHA512
9204d433bd35b1de033895f029c247c1680050e462c23c1213b0e8aa1460fb7207fb354cc22838198492f682d1e3d6856f76d39abda45d0388144d7241410cde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Filesize
2KB

MD5
c28a69b729caabd56e90527c61c4e316

SHA1
06ce6152100dee1884c80df4f702667a3ccd67bb

SHA256
a902b5b9d5dfd65a445b4d5eb3908a6e728abc62076c38f57eb92754892ecdd7

SHA512
c81eb983c703f8c99155b0c5be35f70756e02fd28ed86742afed6799de176973db320fe710d6840a19178fdc8394928539407c5532dc9f9f7eca1dadc34a2526

Download Submit
C:\Users\Admin\AppData\Local\Temp\cv_debug.log

Filesize
2KB

MD5
528bef6d3ae4a12a6dd5622edfc1e697

SHA1
35f6785c676b128a97e5fced8638823a7fbf6efa

SHA256
ff64883145fa8f28657df3c60c40f900f19f90c0c7d54b01b099fd5e1c018690

SHA512
d591e13149caa636cf181a1e7c31e503ee4ebfcdb1bc1141539597e8a979434e699ae6a0a1b950b14a8a74741f1c3ec4e57ba3364b6b8c84532f835279a2feb7

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.1\quasar.p12

Filesize
4KB

MD5
b02c94eb12947e3e1af84c36d16705ab

SHA1
8c44a353d367027abde3f5773dae653e263374d0

SHA256
dfa4edc021cf50ffffee91c69d4c33eaa3ce3091c5285a4b9b01139e2c3a0a16

SHA512
de819127d5d576377d8ad482256f09e695a06b4f79d91b4c561d0d8f99b824508f42190ec732d12d97fff7652f95483d7546f802c73c7562c9c90a3ff4c56834

Download Submit
memory/3460-761-0x00000291CE750000-0x00000291CE768000-memory.dmp

Filesize
96KB

Download
memory/3460-764-0x00000291CF1F0000-0x00000291CF23C000-memory.dmp

Filesize
304KB

Download
memory/3460-763-0x00000291CF2B0000-0x00000291CF362000-memory.dmp

Filesize
712KB

Download
memory/3460-762-0x00000291CE970000-0x00000291CE9C0000-memory.dmp

Filesize
320KB

Download
memory/3460-727-0x00000291CF520000-0x00000291CF84E000-memory.dmp

Filesize
3.2MB

Download
memory/3460-726-0x00000291B2180000-0x00000291B2196000-memory.dmp

Filesize
88KB

Download
memory/3460-725-0x00000291B1C70000-0x00000291B1DA8000-memory.dmp

Filesize
1.2MB

Download