File name:

Client-built-appdata.exe

Full analysis: https://app.any.run/tasks/c192c061-e23f-40d8-9a57-57fecd5fda37
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 13:01:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
rat
quasar
remote
evasion
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

AEC658DAECC20E123B815D7F07A750B1

SHA1:

E4F06DE96C0711997148AB35E2EAC808239DDBA0

SHA256:

61C02EF5FECCDA0461966793E2BD93CC4B3CEE97E3B0B5DCF1A856398BF4AAFC

SSDEEP:

98304:Y2uiieRyd72QsLDil92m3GJEDgqcCr2dX:lmgc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Client-built-appdata.exe (PID: 6584)
      • Client-appdata.exe (PID: 6508)

    • QUASAR has been detected (SURICATA)

      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)

    • QUASAR has been detected (YARA)

      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)

    • Connects to the CnC server

      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)

    • Uses Task Scheduler to autorun other applications

      • Client-appdata.exe (PID: 1560)

    • Steals credentials from Web Browsers

      • Client-appdata.exe (PID: 1560)

    • Actions looks like stealing of personal data

      • Client-appdata.exe (PID: 1560)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Client-built-appdata.exe (PID: 6584)

    • Starts itself from another location

      • Client-built-appdata.exe (PID: 6584)

    • Reads security settings of Internet Explorer

      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)
      • StartMenuExperienceHost.exe (PID: 4984)

    • Connects to unusual port

      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2200)

    • Checks for external IP

      • svchost.exe (PID: 2200)

    • Reads the date of Windows installation

      • Client-appdata.exe (PID: 6508)
      • SearchApp.exe (PID: 1232)
      • StartMenuExperienceHost.exe (PID: 4984)

    • Contacting a server suspected of hosting an CnC

      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)

    • There is functionality for taking screenshot (YARA)

      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)

    • The executable file from the user directory is run by the CMD process

      • Client-appdata.exe (PID: 1560)

    • Starts CMD.EXE for commands execution

      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6004)

    • The process executes via Task Scheduler

      • explorer.exe (PID: 2552)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 6004)

    • Loads DLL from Mozilla Firefox

      • Client-appdata.exe (PID: 1560)

    • Deletes system .NET executable

      • Client-appdata.exe (PID: 1560)

  • INFO

    • Checks supported languages

      • Client-built-appdata.exe (PID: 6584)
      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)
      • chcp.com (PID: 1156)
      • StartMenuExperienceHost.exe (PID: 4984)
      • SearchApp.exe (PID: 1232)
      • Client-appdata.exe (PID: 5820)
      • TextInputHost.exe (PID: 4864)
      • identity_helper.exe (PID: 420)
      • identity_helper.exe (PID: 6876)

    • Reads the computer name

      • Client-built-appdata.exe (PID: 6584)
      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)
      • StartMenuExperienceHost.exe (PID: 4984)
      • TextInputHost.exe (PID: 4864)
      • SearchApp.exe (PID: 1232)
      • Client-appdata.exe (PID: 5820)
      • identity_helper.exe (PID: 6876)
      • identity_helper.exe (PID: 420)

    • Reads Environment values

      • Client-built-appdata.exe (PID: 6584)
      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)
      • Client-appdata.exe (PID: 5820)
      • SearchApp.exe (PID: 1232)
      • identity_helper.exe (PID: 6876)
      • identity_helper.exe (PID: 420)

    • Creates files or folders in the user directory

      • Client-built-appdata.exe (PID: 6584)
      • explorer.exe (PID: 2552)
      • Client-appdata.exe (PID: 1560)

    • Reads the machine GUID from the registry

      • Client-built-appdata.exe (PID: 6584)
      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)
      • SearchApp.exe (PID: 1232)
      • Client-appdata.exe (PID: 5820)

    • Launching a file from a Registry key

      • Client-built-appdata.exe (PID: 6584)
      • Client-appdata.exe (PID: 6508)

    • Reads the software policy settings

      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)
      • SearchApp.exe (PID: 1232)
      • slui.exe (PID: 6016)

    • Checks proxy server information

      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)
      • SearchApp.exe (PID: 1232)
      • explorer.exe (PID: 2552)
      • slui.exe (PID: 6016)

    • Disables trace logs

      • Client-appdata.exe (PID: 6508)
      • Client-appdata.exe (PID: 1560)

    • Process checks computer location settings

      • Client-appdata.exe (PID: 6508)
      • StartMenuExperienceHost.exe (PID: 4984)
      • SearchApp.exe (PID: 1232)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6004)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 2552)

    • Application launched itself

      • chrome.exe (PID: 5328)
      • msedge.exe (PID: 3580)
      • msedge.exe (PID: 2044)
      • msedge.exe (PID: 5400)
      • msedge.exe (PID: 6700)

    • Reads the time zone

      • runonce.exe (PID: 6120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(6508) Client-appdata.exe
Version1.4.1
C2 (2)lmn347583-61457.portmap.io:61457
Sub_DirSystem3Z
Install_NameClient-appdata.exe
Mutex6dded8b6-7f84-480c-b2f8-bb911a832ed2
Startupwwahost boot
TagR30115
LogDirLogs
SignaturecxbzvHwRe/n0qGA3V//ZORe0hT9hJuGN+PApbWIbFv2vsTeAo2oFfIrXx1DXFdDl//gYE4sUYFiZo8FWGJjTe7A5hkPKVEuUvex+RZRhSLwDKIldGCfnqpVSVdAVUqhXQWcBgq+imCaR//agp0FSChR7ht4Cw1k+16xfv1Mo5sXoLmqVXJb0J8Gq2Cxq2V9GEFGgvAtvhUpckBcmzOE7AbCmoAZM/FPDdGeQDFymdjTVfs3lpUn0fNidSjWqFsNNvU7KyO354V/35Q+5hrLIFh+/YlaltQLGVzKtZMlXJtpx...
CertificateMIIE9DCCAtygAwIBAgIQAJybIcqk3akDxnhNu6jB9TANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI1MDYxNzE3MzU0MFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuIKPABH+6nPTE9GPRW9OWv8ktHVk4ry6aXguYpsKcbHoh8UqahaBSouG/LPSWAlABAaq5Ary...
(PID) Process(1560) Client-appdata.exe
Version1.4.1
C2 (2)lmn347583-61457.portmap.io:61457
Sub_DirSystem3Z
Install_NameClient-appdata.exe
Mutex6dded8b6-7f84-480c-b2f8-bb911a832ed2
Startupwwahost boot
TagR30115
LogDirLogs
SignaturecxbzvHwRe/n0qGA3V//ZORe0hT9hJuGN+PApbWIbFv2vsTeAo2oFfIrXx1DXFdDl//gYE4sUYFiZo8FWGJjTe7A5hkPKVEuUvex+RZRhSLwDKIldGCfnqpVSVdAVUqhXQWcBgq+imCaR//agp0FSChR7ht4Cw1k+16xfv1Mo5sXoLmqVXJb0J8Gq2Cxq2V9GEFGgvAtvhUpckBcmzOE7AbCmoAZM/FPDdGeQDFymdjTVfs3lpUn0fNidSjWqFsNNvU7KyO354V/35Q+5hrLIFh+/YlaltQLGVzKtZMlXJtpx...
CertificateMIIE9DCCAtygAwIBAgIQAJybIcqk3akDxnhNu6jB9TANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI1MDYxNzE3MzU0MFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuIKPABH+6nPTE9GPRW9OWv8ktHVk4ry6aXguYpsKcbHoh8UqahaBSouG/LPSWAlABAaq5Ary...
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:03:12 16:16:39+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 3261952
InitializedDataSize: 3584
UninitializedDataSize: -
EntryPoint: 0x31e45e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.4.1.0
ProductVersionNumber: 1.4.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Quasar Client
FileVersion: 1.4.1
InternalName: Client.exe
LegalCopyright: Copyright © MaxXor 2023
LegalTrademarks: -
OriginalFileName: Client.exe
ProductName: Quasar
ProductVersion: 1.4.1
AssemblyVersion: 1.4.1.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
229
Monitored processes
78
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start start client-built-appdata.exe #QUASAR client-appdata.exe svchost.exe cmd.exe conhost.exe no specs #QUASAR client-appdata.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs taskkill.exe no specs slui.exe userinit.exe no specs explorer.exe no specs explorer.exe no specs startmenuexperiencehost.exe no specs textinputhost.exe no specs tiworker.exe no specs searchapp.exe mobsync.exe no specs client-appdata.exe no specs runonce.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1996,i,10896402537068255975,15284167448465379887,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=1980 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
420"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=4804,i,3849344973769167530,4128406481577757440,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
480"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=4928,i,10896402537068255975,15284167448465379887,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4920 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
788"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4744,i,10896402537068255975,15284167448465379887,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4724 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
864C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Exit code:
0
Version:
10.0.19041.3989 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1156CHCP 437C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1208\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1232"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1380C:\WINDOWS\System32\mobsync.exe -EmbeddingC:\Windows\System32\mobsync.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Sync Center
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mobsync.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1512"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6876,i,12740373943567463406,3492435754904604585,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
53 169
Read events
52 480
Write events
288
Delete events
401

Modification events

(PID) Process:(6584) Client-built-appdata.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:wwahost boot
Value:
"C:\Users\admin\AppData\Roaming\System3Z\Client-appdata.exe"
(PID) Process:(6508) Client-appdata.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client-appdata_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6508) Client-appdata.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client-appdata_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6508) Client-appdata.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client-appdata_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6508) Client-appdata.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client-appdata_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6508) Client-appdata.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client-appdata_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6508) Client-appdata.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client-appdata_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6508) Client-appdata.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client-appdata_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6508) Client-appdata.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client-appdata_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6508) Client-appdata.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Client-appdata_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
18
Suspicious files
383
Text files
139
Unknown types
1

Dropped files

PID
Process
Filename
Type
1232SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresbinary
MD5:F1766B47BE16456EB459D5DD8C9974A3
SHA256:3EED49780152DAA2551D56FDE02B1451FB5FE443787B89DEA1652D27C2B9EFE6
6584Client-built-appdata.exeC:\Users\admin\AppData\Roaming\System3Z\Client-appdata.exeexecutable
MD5:AEC658DAECC20E123B815D7F07A750B1
SHA256:61C02EF5FECCDA0461966793E2BD93CC4B3CEE97E3B0B5DCF1A856398BF4AAFC
1232SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZWUI0EBX\www.bing[1].xmltext
MD5:C6A28F0A469820EE75CE0094B5E05D62
SHA256:BF3C9FE8FDE4D296C0B91D494820385887C72DDE05FC7819042E4CEF57289842
864TiWorker.exeC:\Windows\Logs\CBS\CBS.logtext
MD5:84A3682006478204A9D4939E56725A23
SHA256:611E5319A1D427E4A42F0D32DA1F300881945B5CF8E6EC7AF8053F997C94DD72
1232SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\77\-iNIzuEypRdgRJ6xnyVHizZ3bpM.br[1].jsbinary
MD5:E86ABEFE45E62F7E2F865D8A344D0B6F
SHA256:5D54790C856CE13811590E18AC3B0ACEEFEFB61258852490F4C5C60748365E89
1232SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:DF367B9525354CC5543C9247210072ED
SHA256:68511E58CC309F2895652008EF4A7C0B18C023D5EDBC435BCE4E83F8BE640D09
1232SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\77\tUCiVcVWZ-go7BLlq95YW6bKHZE[1].csstext
MD5:445D78544E0CFC11EFC1E172DA3ECBBC
SHA256:76EFEBABB82AE8342985C99A498137C04B3E46BC59D78191F0DA44C660B980F5
1232SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:99B2C924EA9FCDA277BACD2496A2139E
SHA256:8B1D106599E9497E37259BAFA963B695463B7819A1709C01E82244A2D1A5EF6D
1232SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\Q84V0JUH\6hU_LneafI_NFLeDvM367ebFaKQ[1].jss
MD5:C6C21B7634D82C53FB86080014D86E66
SHA256:D39E9BA92B07F4D50B11A49965E9B162452D7B9C9F26D9DCB07825727E31057E
1232SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\77\-M-8YWX0KlEtdAHVrkTvKQHOghs[1].jsbinary
MD5:32EE4742328DFB725F3A96641B93B344
SHA256:061E63AF37D22CCEF7FB5BB9BEABA0DF2F36B64F985BB8A408638846C895D0A7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
110
DNS requests
118
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2292
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.24.77.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6876
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6876
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1232
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
2168
chrome.exe
GET
200
142.250.186.78:80
http://clients2.google.com/time/1/current?cup2key=8:SQtM6U-puxp-HZQTi4OGEMXJuXQUcyLEEaWSFIa56Ak&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
5732
msedge.exe
GET
200
150.171.27.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:c1x96TfEMxdbKtia2TG0CDFA8junK1RXsaNdTNbsklI&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
2732
svchost.exe
HEAD
200
208.89.74.27:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1751066851&P2=404&P3=2&P4=PsCzt%2breW7ZUxvz%2fOO2cjaay%2bb%2fM%2bOpQ%2b3RdGg465GyrdJVuPJ8lLs8dl5f6bSS%2f9p8IXFjTkm%2bdS5VdiCescQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6960
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6508
Client-appdata.exe
193.161.193.99:61457
lmn347583-61457.portmap.io
OOO Bitree Networks
RU
malicious
4
System
192.168.100.255:138
—
—
—
whitelisted
6508
Client-appdata.exe
136.243.53.56:443
ipwho.is
Hetzner Online GmbH
DE
malicious
2292
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2336
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2292
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.78
whitelisted
lmn347583-61457.portmap.io
  • 193.161.193.99
malicious
ipwho.is
  • 136.243.53.56
malicious
login.live.com
  • 20.190.159.75
  • 40.126.31.131
  • 20.190.159.68
  • 40.126.31.0
  • 20.190.159.23
  • 40.126.31.73
  • 20.190.159.131
  • 20.190.159.129
  • 40.126.31.69
  • 20.190.159.128
  • 40.126.31.2
  • 40.126.31.67
  • 40.126.31.128
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 184.24.77.9
  • 184.24.77.10
  • 184.24.77.22
  • 184.24.77.39
  • 184.24.77.11
  • 184.24.77.37
  • 184.24.77.18
  • 184.24.77.24
  • 184.24.77.6
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.30
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2200
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)
2200
svchost.exe
Potentially Bad Traffic
ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
6508
Client-appdata.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert
6508
Client-appdata.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
6508
Client-appdata.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] QuasarRAT Successful Connection (GCM_SHA384)
1560
Client-appdata.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert
1560
Client-appdata.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
1560
Client-appdata.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] QuasarRAT Successful Connection (GCM_SHA384)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Client-built-appdata.exe