quasar | hxxps://cdn[.]discordapp[.]com/attachments/892424513931837483/1363158007537733873/COD?ex=68050353&is=6803b1d3&hm=52152cecebb46f33867eaf1565a8d423daa23aaab129920d1ddae9fbaad1033a&

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2025, 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/892424513931837483/1363158007537733873/COD?ex=68050353&is=6803b1d3&hm=52152cecebb46f33867eaf1565a8d423daa23aaab129920d1ddae9fbaad1033a&

Score

10^/10

quasar discovery spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/5756-1359-0x0000021AD5960000-0x0000021AD5A98000-memory.dmp	family_quasar
behavioral1/memory/5756-1360-0x0000021AD7620000-0x0000021AD7636000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000\Control Panel\International\Geo\Nation	rundll32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
187	camo.githubusercontent.com
190	camo.githubusercontent.com
191	camo.githubusercontent.com
192	camo.githubusercontent.com
194	raw.githubusercontent.com
195	raw.githubusercontent.com
186	camo.githubusercontent.com

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_798129609\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_791378891\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_1398110264\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_1951107687\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_798129609\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_798129609\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_791378891\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_1398110264\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_1398110264\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_260947520\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_260947520\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_791378891\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_1398110264\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_1398110264\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_1951107687\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_791378891\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3476_1951107687\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133895475458040920"	msedge.exe

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "5"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheVersion = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3833542908-3750648139-3436651901-1000\{71F23FF8-7A8D-4AF2-B049-1042E2D12FDF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\MuiCache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheVersion = "1"	PaintStudio.View.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 6600310000000000935af07510005155415341527e312e3100004c0009000400efbe935ae775935af1752e0000004a430200000008000000000000000000000000000000883040005100750061007300610072002000760031002e0034002e00310000001a000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheVersion = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 6600310000000000935ae77510005155415341527e312e3100004c0009000400efbe935ae775935ae7752e00000049430200000009000000000000000000000000000000d6990f015100750061007300610072002e00760031002e0034002e00310000001a000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3833542908-3750648139-3436651901-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\6F8FBE2003D8F699D840AD2CE3AA5034F0432949	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\6F8FBE2003D8F699D840AD2CE3AA5034F0432949\Blob = 0200000000000000f40000001c00000084000000180000002000000000000000000000000100000042006f0075006e006300790043006100730074006c0065002d00320038003700610065006400320032002d0039006200610063002d0034003200630066002d0061003000370063002d003500380064006400610039006200360065003300340037000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072000000000000002300000000000000140000006f8fbe2003d8f699d840ad2ce3aa5034f0432949	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\32B7BDDC37BB567AA2C27EBE51B55F5E10AEAD7A	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\32B7BDDC37BB567AA2C27EBE51B55F5E10AEAD7A\Blob = 03000000010000001400000032b7bddc37bb567aa2c27ebe51b55f5e10aead7a0200000001000000f40000001c00000084000000180000002000000000000000000000000100000042006f0075006e006300790043006100730074006c0065002d00320038003700610065006400320032002d0039006200610063002d0034003200630066002d0061003000370063002d003500380064006400610039006200360065003300340037000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072000000000000002000000001000000f8040000308204f4308202dca003020102021000ad0b9bba0a0c9aa1039543d89c94ab300d06092a864886f70d01010d0500301b3119301706035504030c10517561736172205365727665722043413020170d3235303431373134343732375a180f39393939313233313233353935395a301b3119301706035504030c105175617361722053657276657220434130820222300d06092a864886f70d01010105000382020f003082020a0282020100998f5dc2c62e6d98819f0c125218fd2f2a4eb74d61f0247dc09495f0c78a95e5eb612af6fb63eae6d9f3cd823d0572a5eeea55d07472748de60d6481d48cef73eb6d891fa526605e65d2485b826f01c5bd377a55e8dc26e9fd646e96033da608d155994cadf87a95f2803933323d0b9b2ae76229e9422c668010effdbfbe104c638b98e8e31cefe05a15300275ed53caf1537cbaf8e3aed185b84fa2946a853eacc1a91e85487944b430e19ec629f616c2595b7d32cfdd0b62c2fb2d2c1c6ab8dcc05aa0b3a3f48e9f61906f48b560cd712754afe04cfb8e8ce4b28d8dfccdfcaa5192abbe3575952edc55d5a3504599806aa9dc1e8040c3ae6449bac3fd34a4badab52055243355290ca724d4d00d560a72eb0ac2e3ffa254ecbe18648bb670dec8bc663603f8f9e7d4c66ced763d7fa44b0418d4269f41b375e88b81f5df212326552bce0b1627c9a452ee903596cdcf38dfc6c80074adeb4732be5cdd01950288f1e63dc832bcbe82993c28577768b8526271d5359b55fccc2eadd262a7a6fb45d1c810a11a05bb0886b40f07c9df3ab2b2c662e053b2e94491d3dac63b7a702f5cebf82e9b91607425a887d13184b1146af847dd7853a7e08bc1607b5ed63bd347ac7579403b7fdc26e85ee2b643eb94b47a67ae6a6064bbc09413f1c5301d92ce1cd0cffdacb918c623c2ba386e8ddb6f48316c784fb50649b16622cc910203010001a3323030301d0603551d0e041604146f8fbe2003d8f699d840ad2ce3aa5034f0432949300f0603551d130101ff040530030101ff300d06092a864886f70d01010d05000382020100296c512e31a5edbb5bb183460cc0e31687711d7ad22569d4fa9d4eef40dbd3ea6b8a74d68cb31e3b606a5fd200d51d82676000c7b6f35b3b2bad8d6759867383f5019e52727b650a8a48d0a52115a104b8940cd090cfc09e71c969cda813b926eb5070a4b563486eee541d6e4544d7403ca5838005ed9b676d8b16800139ac5587b0a9b9f76edafb145fb7cc17f147793334d3d8e05347dc6300b72ffaa4c0b2b8b94bfa9d13117872c24600e5fb543fd76dd3f31cef209af50bd93af2e0df9b9a91c2ce0fd5156161f134bff99e697dde7d6fe9402d2ac9e050ccd8c3fd50f875d2de873165f85f58a4f5a70def635f2782cc793f2f32d108d07b5c3ab377fd189892d2c190d5d71908b08303fd8de3f62afed22cd4af624a63d148e0a435dc83b67aa910080682d740c52e2025abfe3becee66b2807aeb2ad73c3de96255233dffecb87ad705721844b1dfe97a0ddcbda886863c0713017bdb1b71de3b64c0d3722c683cc4a9761cfd3aa5f0307e832565f46d9a8ef47d50c0db018d81de5fc24982d8a2b43f55e1be405b87600ab7f6386cd955c9c6d7ec639676ccd853ea17575252552727ab505e85ea1b4643130959b69978a712b98d182e9c3afaaa9f2bfb23ed4127fa11922663a67f45f7ad69f8625e92a15e0afc997743e4a8c8ed4640b0fa98849f3eb98350b9c338ee38b4372c9215c8812cfdcda2d57ae4608f	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\32B7BDDC37BB567AA2C27EBE51B55F5E10AEAD7A\Blob = 1400000001000000140000006f8fbe2003d8f699d840ad2ce3aa5034f04329490200000001000000f40000001c00000084000000180000002000000000000000000000000100000042006f0075006e006300790043006100730074006c0065002d00320038003700610065006400320032002d0039006200610063002d0034003200630066002d0061003000370063002d003500380064006400610039006200360065003300340037000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f007600690064006500720000000000000003000000010000001400000032b7bddc37bb567aa2c27ebe51b55f5e10aead7a2000000001000000f8040000308204f4308202dca003020102021000ad0b9bba0a0c9aa1039543d89c94ab300d06092a864886f70d01010d0500301b3119301706035504030c10517561736172205365727665722043413020170d3235303431373134343732375a180f39393939313233313233353935395a301b3119301706035504030c105175617361722053657276657220434130820222300d06092a864886f70d01010105000382020f003082020a0282020100998f5dc2c62e6d98819f0c125218fd2f2a4eb74d61f0247dc09495f0c78a95e5eb612af6fb63eae6d9f3cd823d0572a5eeea55d07472748de60d6481d48cef73eb6d891fa526605e65d2485b826f01c5bd377a55e8dc26e9fd646e96033da608d155994cadf87a95f2803933323d0b9b2ae76229e9422c668010effdbfbe104c638b98e8e31cefe05a15300275ed53caf1537cbaf8e3aed185b84fa2946a853eacc1a91e85487944b430e19ec629f616c2595b7d32cfdd0b62c2fb2d2c1c6ab8dcc05aa0b3a3f48e9f61906f48b560cd712754afe04cfb8e8ce4b28d8dfccdfcaa5192abbe3575952edc55d5a3504599806aa9dc1e8040c3ae6449bac3fd34a4badab52055243355290ca724d4d00d560a72eb0ac2e3ffa254ecbe18648bb670dec8bc663603f8f9e7d4c66ced763d7fa44b0418d4269f41b375e88b81f5df212326552bce0b1627c9a452ee903596cdcf38dfc6c80074adeb4732be5cdd01950288f1e63dc832bcbe82993c28577768b8526271d5359b55fccc2eadd262a7a6fb45d1c810a11a05bb0886b40f07c9df3ab2b2c662e053b2e94491d3dac63b7a702f5cebf82e9b91607425a887d13184b1146af847dd7853a7e08bc1607b5ed63bd347ac7579403b7fdc26e85ee2b643eb94b47a67ae6a6064bbc09413f1c5301d92ce1cd0cffdacb918c623c2ba386e8ddb6f48316c784fb50649b16622cc910203010001a3323030301d0603551d0e041604146f8fbe2003d8f699d840ad2ce3aa5034f0432949300f0603551d130101ff040530030101ff300d06092a864886f70d01010d05000382020100296c512e31a5edbb5bb183460cc0e31687711d7ad22569d4fa9d4eef40dbd3ea6b8a74d68cb31e3b606a5fd200d51d82676000c7b6f35b3b2bad8d6759867383f5019e52727b650a8a48d0a52115a104b8940cd090cfc09e71c969cda813b926eb5070a4b563486eee541d6e4544d7403ca5838005ed9b676d8b16800139ac5587b0a9b9f76edafb145fb7cc17f147793334d3d8e05347dc6300b72ffaa4c0b2b8b94bfa9d13117872c24600e5fb543fd76dd3f31cef209af50bd93af2e0df9b9a91c2ce0fd5156161f134bff99e697dde7d6fe9402d2ac9e050ccd8c3fd50f875d2de873165f85f58a4f5a70def635f2782cc793f2f32d108d07b5c3ab377fd189892d2c190d5d71908b08303fd8de3f62afed22cd4af624a63d148e0a435dc83b67aa910080682d740c52e2025abfe3becee66b2807aeb2ad73c3de96255233dffecb87ad705721844b1dfe97a0ddcbda886863c0713017bdb1b71de3b64c0d3722c683cc4a9761cfd3aa5f0307e832565f46d9a8ef47d50c0db018d81de5fc24982d8a2b43f55e1be405b87600ab7f6386cd955c9c6d7ec639676ccd853ea17575252552727ab505e85ea1b4643130959b69978a712b98d182e9c3afaaa9f2bfb23ed4127fa11922663a67f45f7ad69f8625e92a15e0afc997743e4a8c8ed4640b0fa98849f3eb98350b9c338ee38b4372c9215c8812cfdcda2d57ae4608f	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5328	PaintStudio.View.exe
5184	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2412	mspaint.exe
2412	mspaint.exe
2768	msedge.exe
2768	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5756	Quasar.exe
5184	explorer.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	2488	7zFM.exe
Token: 35	2488	7zFM.exe
Token: SeDebugPrivilege	5328	PaintStudio.View.exe
Token: SeDebugPrivilege	5328	PaintStudio.View.exe
Token: SeDebugPrivilege	5328	PaintStudio.View.exe
Token: SeDebugPrivilege	5756	Quasar.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
2488	7zFM.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
5756	Quasar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5756	Quasar.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2412	mspaint.exe
5328	PaintStudio.View.exe
5184	explorer.exe
5184	explorer.exe
5184	explorer.exe
5184	explorer.exe
5184	explorer.exe
5184	explorer.exe
5184	explorer.exe
5184	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 4548	3476	msedge.exe	86
PID 3476 wrote to memory of 4548	3476	msedge.exe	86
PID 3476 wrote to memory of 4776	3476	msedge.exe	87
PID 3476 wrote to memory of 4776	3476	msedge.exe	87
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 2988	3476	msedge.exe	88
PID 3476 wrote to memory of 4228	3476	msedge.exe	89
PID 3476 wrote to memory of 4228	3476	msedge.exe	89
PID 3476 wrote to memory of 4228	3476	msedge.exe	89
PID 3476 wrote to memory of 4228	3476	msedge.exe	89
PID 3476 wrote to memory of 4228	3476	msedge.exe	89
PID 3476 wrote to memory of 4228	3476	msedge.exe	89
PID 3476 wrote to memory of 4228	3476	msedge.exe	89
PID 3476 wrote to memory of 4228	3476	msedge.exe	89
PID 3476 wrote to memory of 4228	3476	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/892424513931837483/1363158007537733873/COD?ex=68050353&is=6803b1d3&hm=52152cecebb46f33867eaf1565a8d423daa23aaab129920d1ddae9fbaad1033a&
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x344,0x7ffc142cf208,0x7ffc142cf214,0x7ffc142cf220
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1924,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2300,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2360,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3496,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3560,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4288,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4348,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5148,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3528,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5532,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5540,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5492,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6236,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6400,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5284,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5284,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6816,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6836,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4432,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6344,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6968,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6944,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7176,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6928,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=3472,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5448,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2636,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5216,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6100,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=6204,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=6592,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3772,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=4568,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=4420,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7452,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=6352,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7128,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5276,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6156,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4480,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=7224,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3320,i,4594207659168769809,3708424776933261421,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:8
  2⤵
  PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1856

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\COD"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2488

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\COD.png" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:5148

C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5328

C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Quasar.exe
"C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Quasar.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5756
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12"
  2⤵
  PID:2668

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5184
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtAddPFX C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12
  2⤵
  - Checks computer location settings
  PID:1584
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\cryptext.dll,CryptExtAddPFXMachineOnlyAndHwnd "C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12" 0
    3⤵
    - Modifies system certificate store
    PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping3476_1398110264\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3476_1951107687\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3476_260947520\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3476_791378891\manifest.json

Filesize
160B

MD5
a24a1941bbb8d90784f5ef76712002f5

SHA1
5c2b6323c7ed8913b5d0d65a4d21062c96df24eb

SHA256
2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747

SHA512
fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3476_798129609\manifest.json

Filesize
160B

MD5
c3911ceb35539db42e5654bdd60ac956

SHA1
71be0751e5fc583b119730dbceb2c723f2389f6c

SHA256
31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d

SHA512
d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
aaf83b637d655e56700e952fdc1addba

SHA1
5b359e8810c6fce1a45e981e5a8f3a8bd0f847c2

SHA256
8358981741cfec6e5216e2f10199b21ddc4d7ffc65124215a9c297629651ef43

SHA512
6b2cb7a399f302ee64c76774bf7d872db6bc34d727b5d092e09f87cac2ef51c8a7bf0d8bb5dc0ea32e97b4399c783334519a9d51cefecf9700d2a9f4062b3d1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
08db5d4969ced98b35efaad8df68671f

SHA1
3ea299fb7dd34691afa783c2547ab5f0dfcd60a5

SHA256
37e306e690e7d905450872ea5b0a25a3992d8ede385b7cfc7abe2734e24386ab

SHA512
72d1b1a6e26b0bf240831c2737a353445f37fad283b74b6fffc698f62fc5dc8f5808cc717225e2eb8a2c067dd5a90e44ff9281f93eb29db180d155388720d7d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87d6b4d7-33e4-4806-83bf-199cef7a4869.tmp

Filesize
14KB

MD5
b42cf28b35fd949356e9b65d1bd203c8

SHA1
8d930c55b94ef0081463a3da10c0b0fd99d22e03

SHA256
71f20a3a36a1a0c3761c76498e29d3e61429389d25b773d3f4d941e253e8f856

SHA512
4be949b2f3e70954600a4d3208cce061a40e9352d4866162acef710bbb500a3bad88976d3ef2f975634ee5f149eef875db0a23a4192ae8d281937859a47ba35a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091

Filesize
67KB

MD5
cc63ec5f8962041727f3a20d6a278329

SHA1
6cbeee84f8f648f6c2484e8934b189ba76eaeb81

SHA256
89a4d1b2e007ac49fc9677d797266268cd031f99aa0766ca2450bff84ac227d1

SHA512
107cf3499a6cf9cdcbfa3ef4c6b4f2cda2472be116f8efa51ff403c624e8001d254be52de7834b2a6ab9f4bcc1a3b19adc0bba8c496e505abbca371ef6c8f877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d2c5cc2cb3a642edb05971efe98b9949

SHA1
d09df76b45a2f2a39b5c3988453f6e9838ba768d

SHA256
3db5fd8247ea7d63d337d8e372452289dee779ed35d3014fef72a26a9e3c1979

SHA512
69cfc81589c318d91da20c024881b83805a4b2d2236f66a7636be5d7f31ccb2ca9e02d1100315b5b035cb34588e95989e149bb2d4661a07b3aa1c29f95330386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
be6bbb695338b664a1770c3251ce6676

SHA1
e5257fcbd02810a1c03fdb1cde3595340420e394

SHA256
ab2cc76826f0fc452e6b4f5db9fc6cf20d43e2087ff5f9cb0d2c541391c7fe78

SHA512
3751a9ccaec0689cc816efd4fc29297078f9ee81988034ca53173aa2817dedcb12f70a6fda04cf9fe26e3e3ebc5c29e8953377aa8d0314d146b8335fdb984af0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57c757.TMP

Filesize
4KB

MD5
41f316bacb4bf1f2ee75d26428bd3016

SHA1
0b31fdaef583be5cdd33ae4ab7c1647f5c0b39e7

SHA256
be8fb1f2bffc4bd0e301d441c8f05a2b2cdc6aa002ee0a8c4340337803281793

SHA512
3671607712dd2189b7e95b08775ee25204c90b54a5f20d72e067b16d7317516452de32763ee4d1931d3aced384db7f81887c944cea6044a061bfb8dde913df01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
16fba51640e1881b1e7f070691ffe21e

SHA1
34db066b9caa5f8e1ea7dc7115d3b2646b4bf592

SHA256
7067c42663bd4c7a9d3bdb3c036745d3e40c53f0a2668a48843eac992b13b307

SHA512
5461a5c640dafd3d117d7de12e2a44b49827650a4cead7880f9d70fa5e8d09022e39c6125ef5e41793f8bb4349f1bfebecc024570f7fbf1a5fe538749f564160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
279629287e71e7dfec666b03e9033c16

SHA1
e22bb4ab429c6b1acca0e577f123e4c03c16bdef

SHA256
442f958ebffb8b99835cc012bb41b3a537c5b13b8914e9f7b713e64dd86d174b

SHA512
5481d9949cd78d05f48d3419acf3f1c618d1f567de86b64a42b1ddb086b730a69cd8ee4f4609bafe1923bc02fc0bdba5886d847e9d23f53c6745647d3166c3a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
b325383b27d5fa98f48d52964b5c3d56

SHA1
f2c7976f6b9a1ee9bef19496bdbca07e930ab1b3

SHA256
9315a53400d0600cce8656456f25a5f3db58a6bed0141609f2d27b4ac25e42b4

SHA512
21d43934332e54fc31afe6ed8709c65f10a615a8af8eb2e4deac270c69041aa6fb1a72dc8a54e5c8f8e0861c7d9acd94995d675c5b9a8d28f627b2ff13c5a9ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5879af.TMP

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
c58f58023cb14140f5cb31abd024c823

SHA1
f2cd8a77f2f797a46b4a2ede399813390ef3343d

SHA256
b111d130f64b0061e2094342125bfeb4f768a1b970673514ea54c34fb685fc37

SHA512
b864d1b93730a4c33d6281cabe53cebfab4c5f0db97512afc787b44a3f9180ab557ddda68191e4a9b43325155d584c3d0eb0c96219f40a4ce200b257ef8f95af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
dec96c65a195a663fee7a816bfbcc389

SHA1
5fe264b1cc8c4b49f38f79568f66e0d02e990653

SHA256
24bfaae0484dd897f8bf962bb91af20d9ad2477a3973084c907a1fd935417fbe

SHA512
d4c59353c0f94e1c12e503bf96904891d01047283d545987cd37d9121a3e52e41faf4bfd3af76c7d9f0b64097504d45ed4281c0ff6793617f1afed91e08648c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
332abf2c0ccdd2212be89f919a681084

SHA1
0f882c73fea64bdb5e808406784220d3b26c63a2

SHA256
a42645884be1e90fc30b5b0aea36a677507e8c757a5fcc6e35e736a8266891bc

SHA512
4017149b978b9e3f5ad2e51a1a68b372e6cea21ac9b9fc5c1d015f720884161e6839ff2ac2ba227d3ae8cc95769a6c9f64d6db6a08bfe7ca4c001a129aa2da93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
db4cf9daab2dd740c3ea7c09011c12f9

SHA1
54e205544e94e53a63e58e6f4db2d14686924f5a

SHA256
3a2ca3bdf868a537cdf8d37fd43ba1d59f6d283324cf742fed34ec930a15464c

SHA512
8825b3238dd1c35df23b3cab4d2fc3d5440b98d6c03ee7017262e752bde0947ed2ca8264aad457d936eb4d7633523e70bbc8cc689334d13e62b12e473999d763

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
8734cd5e3bbea7fce7f7a40186aced9b

SHA1
aa5b9189128ef94951341bae84b19382713f55e2

SHA256
031375c5a1d20464762764e0214e83f5e9daab34f34bb90cb8374073c6991d37

SHA512
1149099efc4abaf77164de47bb461214a87a38c4c7be58d9941df2b9240733f45b221c333870fc7b7e2e8d31d6a55f76f49e95faf9fbdb06448c5e225cbb7ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
9e20a92aa2810273cd5270942e69dc3a

SHA1
8ea9014eaf901a62c4ec752e7ef3afcec9a93626

SHA256
0bccfceb648e7d5d7ea73cdd6980da2dfef2e67195aee53be1b5d358ec73a6e4

SHA512
423632cf278e6bc52ea83f6eff04d280b4b78f4da5ad6dedf652e0793e50b0377a00f1fefd3eccf7e27f9701ca0308f5c5c36216ed6d9562b3fe41c7c1157c95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
880B

MD5
c201bbd1a6ef279569026190c5714734

SHA1
7683daa4092135f65c79e2c4a13249b59dc51aac

SHA256
7fb64d6cc2c8e04a71c49691203e39f79876ba5d92dac26e1dcba79e34802319

SHA512
a9eeeb84a3c2406d3c23081bdc2f20763f8d86a41df8afbdcf4599756a68d277ebbe6a31fa749816418ace2f517ebab9732ba4738a66e9f88247e657556f4bce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe58625f.TMP

Filesize
469B

MD5
3afa8500675ed22875aa8257b1d23967

SHA1
4ba659af42dc739f24517a5c9bba7ea94274218a

SHA256
214ab644c8792a2b59fbdbef0499af520b4119f10bc8bd215d3a4c0f32ed5706

SHA512
67c120fe80d11c8298bf03037fd605e37ad8345c85d613289a533abf1dfddca914287bd2a6c96ed72f806dbea0e76562c2b292e94f9f9c7d5e1f62db6656952b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
18KB

MD5
f18b79a3435844f3cd10f1b52c52502d

SHA1
686226dff62991217fcaf2118b30364ed5b08220

SHA256
d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c

SHA512
203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json

Filesize
3KB

MD5
94406cdd51b55c0f006cfea05745effb

SHA1
a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9

SHA256
8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e

SHA512
d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
ade7c5e0e5ddfaacb33ffeaea0343506

SHA1
9102728c18b8852febf089da7c3ab9cea510c040

SHA256
f57e9cefa3d774580b1e8ed50fe4182acce50284deaada331b56512c86be71fb

SHA512
d02a681dc8d63c7f970eb223495671e3bcd146bba60c17f32e16567aed3362871d24ce8fdfa76f2372303d3e739fa24a1b6ac67d6a1db443273caf382fad4595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
59e0a0eaeece644bb83b0a004649e714

SHA1
c0dd80da7075da55d36be1a10df35d24b45134a9

SHA256
243b14342d3d2bc83b76c433147f91c1b8179980274b29247cde26fb9944c786

SHA512
4d7f9614df85f1dcd9f2d9f029b253ff2bced1dfb5ef9bef9a78a0bcf6164411272ede55d16a814e552a362f85072b144f62ab698b04bdbcd699727fe881c409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
250d7677d142b42e23c5bd15c9f57c5d

SHA1
145ed396b1e07de1cf7718ffb2459d4419db5e8e

SHA256
5ec3205241eae3ca7b3f3667e9029e3690934bb49e29847c121a53be5cd0568a

SHA512
d8a76ffa9c39ad446de3ad4783cd623b5d3e9c69f7b23e51e92f29f5c2f5d27938c9a87834dc2ad08065f7c608f5d3b6b67acab66ab79c8942524ed32ee766c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
5c86a6b4d3acff33402e92602f931a5a

SHA1
0708f48e5875b15df76afd84f136096682bf7eb5

SHA256
04b11d1b3cd1b55b37640ed3c67908435977d3a6b5c51b02612df3c79b7d9c25

SHA512
8648a2a36eea6b4f983e5e2e94a27d225b238ef97b0588b1c1490c01d50cf7a393d0f1abe9ec973faaeb2e0c8e56c3c24c6ecac97e0dfa24b66ad8af3f0e4be8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
ef45b901609a8d0ee6ae54991a876d55

SHA1
d089515eba2f647a2e9a569834f45ab4575df5ef

SHA256
76aa681b5d310ac29dc4d72c1e689c6100f67c1473a8da5864a16b561ef2d407

SHA512
8c2f65d84d0f7b1c2b55b746602d1a7713e96f48cd951a6b923c100666edd897e8641e87e25a6e955380db46468b5d1d2cdad40786b81dd831213c53c93e9a2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
d0f487f91e40b439e7badcdf89f40fb2

SHA1
32af08630aef52713e1c3ce5b5eba841eddcc431

SHA256
6a7fd36c77a0252bb7565723e8af4ef875c2d3ce5c8cdb7ea623ef3e335e858e

SHA512
addeb209c8103d49310cd82d6d608428a64c26574f2ae8f2db4814b163e896abc6f6f5877dc82354044011895913d77e7085307f3dffc90f4467721447e4be04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
f7db5c51f4ada478fddcd673eb3a6288

SHA1
52b23f34cf16a39b1a0679491c883d8fc6f5befc

SHA256
e6143364a06e0668153f06b337d12c360df3f59e20e5bc4322d09bee2ab3898b

SHA512
50f2b6932f19ef9f1588f43d2ce92f92178cbb6c400ddeb0f1dc16fab87953f72427f6aacb14f07994eabc06dd660d72f1913d677e3ae95b548086d3765a009f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
752b19efe0e88b791e13e623e13550c8

SHA1
543db00911d015b7bae7f49c654f5b6a0a67968a

SHA256
5ab9089dcfdb6443a785357aa21e1da850b7ff0c47f942d7c022e42d18507b53

SHA512
85d26b73724244335c0ded2418017169f793a228f2b8c631b096856eb287ba4e4d2ed2e9463b27c12dd8e7b31b0839c60333e5235127f04afe71995161f03cf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58a469.TMP

Filesize
392B

MD5
eb35d2aacf3920fd4dc8a99d87ff56cb

SHA1
538a3435f20352a9fb0931888cb2ed792ae83dbf

SHA256
c1360e00f69a2a6a4237742050b079df078500b9df3e1d4da0cab6c0442a6555

SHA512
fb338de5357b7212380dca511c92ff60040b2675ba596e1aa67c2f026171c9ee27f3da481df51d0f95c0b8e636144c3f632c70cc8a0d8da3a9c4e0a0fe3f45ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json

Filesize
2KB

MD5
499d9e568b96e759959dc69635470211

SHA1
2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6

SHA256
98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d

SHA512
3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
b7df6b86219d4b5acc8df1f27856d649

SHA1
91e0b248a194987eff21bf0f95e73fc398df1bb3

SHA256
7e28692932a5cb37b28b67461a841eddb29f795f881439153afbe31da368a1ff

SHA512
817be36a6c8863af09fac7ed2c5f4ab6c9ceeaaf722249e13854b33b5856bcbe4922c113965941b8ca6298300c17ee044d5de02921c04f8f9e022a5f84b3a411

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
238B

MD5
340332a5a1c72965ef5438ee09c2e999

SHA1
63a8336b42478111190a2621a2a59bf6a898d749

SHA256
74ebbd0c79b29747108825186c2f7a4213b0699fec79f7544ed1ac35a09046e5

SHA512
47c17583d16ac5351671a95a6434e01828940a7f1110b9b1a918cd4f8e8648d0c6c1db481d0b34d1a80635de78fce97c7dee74a843f0f9fd61fccc8b398b060b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
237B

MD5
2b86c240cb16971cc6ce5acb8d4e900a

SHA1
fdadfbf4c66f42189b40ac7e6ddebbcae4adc6c5

SHA256
8de34ccd03129045943624c56d2c0b834f919c1abbef1ff13e1431974cee83cc

SHA512
995cdd37eb1f04a0d4250233e0ea5fc5b14965b22039bae4561414ac66ca71d6c334347aefd58c376c5f8fa622b821ddf89eccdeb696b7de9a7ccf3fa3fbbaf5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json

Filesize
2KB

MD5
f4e4a03ebd0ab3a953c56a300d61d223

SHA1
97a9acf22c3bdd6989d7c120c21077c4d5a9a80e

SHA256
52bfb22aa2d7b0ce083d312fb8fa8dcda3063207186f99fc259aebd9064cbedc

SHA512
12aa71eea45720a4d7d057da0b662635671e4cd165ad2e0d30a3d2a43950b47dd60c26c1bbbe049418f815850e571b8d93e4c8b8cbbd686abc3cf7926ba719c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\90c282ce-5a0e-4a31-b560-69b1daae6ed3.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cad1d7e7-e53c-44c6-8fd6-5c5ebd43f732.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3476_306585835\3074125d-f24d-461f-bd95-d9636e0bec32.tmp

Filesize
153KB

MD5
b0917d8e6c5b6be358bff67f84eb8336

SHA1
a6e221edcb19a1cc81575b4ddd927fd9a6fbdd6d

SHA256
dff2c9d9755f96713c08f4932a9091080808ec34c0823feac2206fa526f91e60

SHA512
cd5822bbf91e8f7f5ab2b471a4bf8b464bde95465e2fccc6a57e5a287ca55d5062bdd6d4b3cd76f8529ee7a9081b6a7aad7dc2a7581c344ce4fd2d3256bdf451

Download Submit
C:\Users\Admin\Downloads\COD.crdownload

Filesize
78KB

MD5
dad3de929ead938c06eb48ccd746272d

SHA1
b2526632c5473e33b7214648f6446b55bd88a27f

SHA256
7b4ad3add4feaca35f26dce0261b19ae7ef92d3a2abd50c8a5b288f3eb0a275a

SHA512
1233059b4b1aadffb228a9bbc486c8d6deee592f8667b1899b8246ab731d7cee8f2250e0ef5abcd27d88ec48376a5e9b9b0803f084260e342a0033d50e83d9f8

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.4.1.zip.crdownload

Filesize
3.3MB

MD5
13aa4bf4f5ed1ac503c69470b1ede5c1

SHA1
c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00

SHA256
4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

SHA512
767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12

Filesize
4KB

MD5
8b49901526f595549dd9a76c57823c1c

SHA1
c256331f0c62ec732bc9b1c10f5900d474475ccc

SHA256
a87dc6ddec3eaeb4349ffc5c6981cf70ed1f40a8cb5036415c27749afde70a7f

SHA512
34355571dbdcad31030bdab51300bfe825a372b03d8f4e44d11acd3c03b304e0b27cfce632640c421678d795460829b2cbf0047410350899b2c67c33357b7999

Download Submit
memory/5148-575-0x000002257B3C0000-0x000002257B3C1000-memory.dmp

Filesize
4KB

Download
memory/5148-570-0x000002257B2B0000-0x000002257B2B1000-memory.dmp

Filesize
4KB

Download
memory/5148-559-0x0000022571FC0000-0x0000022571FD0000-memory.dmp

Filesize
64KB

Download
memory/5148-576-0x000002257B3C0000-0x000002257B3C1000-memory.dmp

Filesize
4KB

Download
memory/5148-563-0x0000022572760000-0x0000022572770000-memory.dmp

Filesize
64KB

Download
memory/5148-574-0x000002257B330000-0x000002257B331000-memory.dmp

Filesize
4KB

Download
memory/5148-572-0x000002257B330000-0x000002257B331000-memory.dmp

Filesize
4KB

Download
memory/5148-577-0x000002257B3D0000-0x000002257B3D1000-memory.dmp

Filesize
4KB

Download
memory/5148-578-0x000002257B3D0000-0x000002257B3D1000-memory.dmp

Filesize
4KB

Download
memory/5756-1360-0x0000021AD7620000-0x0000021AD7636000-memory.dmp

Filesize
88KB

Download
memory/5756-1413-0x0000021AF2690000-0x0000021AF26DC000-memory.dmp

Filesize
304KB

Download
memory/5756-1415-0x0000021AF0B70000-0x0000021AF0D8C000-memory.dmp

Filesize
2.1MB

Download
memory/5756-1412-0x0000021AF3160000-0x0000021AF3212000-memory.dmp

Filesize
712KB

Download
memory/5756-1411-0x0000021AF24B0000-0x0000021AF2500000-memory.dmp

Filesize
320KB

Download
memory/5756-1410-0x0000021AF0D90000-0x0000021AF0DA8000-memory.dmp

Filesize
96KB

Download
memory/5756-1379-0x0000021AF3290000-0x0000021AF35BE000-memory.dmp

Filesize
3.2MB

Download
memory/5756-1359-0x0000021AD5960000-0x0000021AD5A98000-memory.dmp

Filesize
1.2MB

Download