Analysis

  • max time kernel
    1799s
  • max time network
    1804s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2023 10:46

General

  • Target

    Rat.exe

  • Size

    3.1MB

  • MD5

    568d2c9150438d4acc8e4b53b6ce70a2

  • SHA1

    4906af8218e049b73dcf8cf036b193c3da013b70

  • SHA256

    9a92c27447113d83d81208169d6c000808a584b9a3223f90a2db04e0bab41272

  • SHA512

    127bf3bc191ce3c4fb0515ceaa18975ba1d24f1b5dd219d6fa0a905f31b0538fb22d8c255c2c12f7e0f56810ba4cf0f54f3fc2db867143a4c286193da7054b8b

  • SSDEEP

    49152:uvbI22SsaNYfdPBldt698dBcjHCFvXE/sekCqILohd96THHB72eh2NT:uvk22SsaNYfdPBldt6+dBcjHCFvrm

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

95.148.114.81:3074

Mutex

438705a4-4f8c-4da4-ae1a-091d6679f4fc

Attributes
  • encryption_key

    AD7FCF7C9C76D3C7D6730075A1E1EB444D205087

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rat.exe
    "C:\Users\Admin\AppData\Local\Temp\Rat.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4608
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc83dd46f8,0x7ffc83dd4708,0x7ffc83dd4718
      2⤵
        PID:3584
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        2⤵
          PID:2552
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:880
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
          2⤵
            PID:3136
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
            2⤵
              PID:3332
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
              2⤵
                PID:556
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
                2⤵
                  PID:2964
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
                  2⤵
                    PID:4972
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
                    2⤵
                      PID:792
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1224
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
                      2⤵
                        PID:2572
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
                        2⤵
                          PID:1440
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
                          2⤵
                            PID:3344
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
                            2⤵
                              PID:3484
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
                              2⤵
                                PID:1312
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
                                2⤵
                                  PID:792
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
                                  2⤵
                                    PID:464
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
                                    2⤵
                                      PID:1072
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
                                      2⤵
                                        PID:684
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
                                        2⤵
                                          PID:1084
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
                                          2⤵
                                            PID:924
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5896 /prefetch:8
                                            2⤵
                                              PID:4524
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,62228301988960546,16807351812153033846,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5992 /prefetch:2
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1992
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:2708
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:1388
                                              • C:\Windows\system32\AUDIODG.EXE
                                                C:\Windows\system32\AUDIODG.EXE 0x2f8 0x150
                                                1⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1100

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                Filesize

                                                152B

                                                MD5

                                                e5c27b4a4d5a3c9c60ba18cb867266e3

                                                SHA1

                                                dea55f1d4cdc831f943f4e56f4f8e9a926777600

                                                SHA256

                                                860ed0acc83eb0096cc8911725e2c631ff879ad8c35854577651af502c4b69c9

                                                SHA512

                                                56eda28e9c61e8081dadc220d23e7bb3320a9ba557eb7511d17a3d2836aa61f301d1d714a3d611eedd7c4b91886c790af7366b01acdb3b637f3dc4fb024f3f6b

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

                                                Filesize

                                                16KB

                                                MD5

                                                48c80c7c28b5b00a8b4ff94a22b72fe3

                                                SHA1

                                                d57303c2ad2fd5cedc5cb20f264a6965a7819cee

                                                SHA256

                                                6e9be773031b3234fb9c2d6cf3d9740db1208f4351beca325ec34f76fd38f356

                                                SHA512

                                                c7381e462c72900fdbb82b5c365080efa009287273eb5109ef25c8d0a5df33dd07664fd1aed6eb0d132fa6a3cb6a3ff6b784bffeeca9a2313b1e6eb6e32ab658

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                Filesize

                                                1KB

                                                MD5

                                                3e1b5e7e35fb8731804d1f6988aa2ab4

                                                SHA1

                                                5a7f9c35cf0ab13994563260ec594433d6463f44

                                                SHA256

                                                003d4d7989db54d25611f07e0edcb3683d32880a8b6d0378a197580d6163b5c9

                                                SHA512

                                                ef4cf16df2a288bb2288d9363695fedf27683c7e2b7511c3afc848cedb719d8c266c78240ed4b2f156aea465684a10cc07abe7936726d621f1f8adfeb2d6ea42

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                Filesize

                                                1KB

                                                MD5

                                                15c241c20d7b6e37ae2e82af667603c3

                                                SHA1

                                                21a9dfa73ea1351f88b0ddf2b7bdfa16f6580e5b

                                                SHA256

                                                396a6da43a0f5492b3a5fb4ab96651e23ddce8bedfc6783e2b4881cbc905b2b2

                                                SHA512

                                                f485e12ba7cc4cf891726af0febbdc0b7a8d45e886f17c3d664c14ae8d1f2cf36c051204fe6d3ea93cdc9a2f6ba01b408026d22600f803560bfed0fee4c68f59

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                Filesize

                                                111B

                                                MD5

                                                285252a2f6327d41eab203dc2f402c67

                                                SHA1

                                                acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                SHA256

                                                5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                SHA512

                                                11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                Filesize

                                                3KB

                                                MD5

                                                39ae2bf08152272bb5c4ea140bbcd16e

                                                SHA1

                                                127dd81573366bf069f0e967330fe7d49887040e

                                                SHA256

                                                31012f609a5f2548cae0250e23275df22a97782271d975a7bce2280e407af87d

                                                SHA512

                                                209c8aea9702b62084158ec333e0d9d123ddfaa430e6066f1792c1b7db8d1661dc460f3b97e667684d13c66f6f6c1a75a9575d00883aa3dfac52c5169f15ac9a

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                Filesize

                                                3KB

                                                MD5

                                                84580b7682f0efa972c592f2de4f9f8d

                                                SHA1

                                                1cf1d1c9f1506cc813c45f8892433a3b3994035d

                                                SHA256

                                                3dac3ca41723c86bf5bc8e6ce2f2db4f3e7973e144ce4a376617a3d3a417367c

                                                SHA512

                                                2416dd1f80a9c3c2ebae8eda6625c53f09f659e34005f5271b6a3e9ddeed99a3c6a48c972e5d4a0274af12ee51ec9eeb566a82b8c5ef402a3a2438e8d434957c

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                5KB

                                                MD5

                                                013cd13dbeb7a715d39077dd1304b4b3

                                                SHA1

                                                016e7d02bfe6d65bad145806447ec0dac2759b02

                                                SHA256

                                                ad29d34385eabcbab9df1b59bce08da4ff9312488df3ab5dfd13372aa0d96601

                                                SHA512

                                                b10444d136441c438c1eb2c19aaa7ffc95f68d069b8949239595a6d6ad333057c25a290fc386ccb9d5dc61248ee2bd5ca30679f5fea174f2829b2dc162111498

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                6KB

                                                MD5

                                                a41b5e8235827c27dc3b8a9c6c95bc07

                                                SHA1

                                                1d5a0205bea9533b52890a0e4f9d65e47e9d8e50

                                                SHA256

                                                b2a0b45f21fb94012e20ca641353a6e5efeabfdf2988350ea8e2abca421ee233

                                                SHA512

                                                3ca1d114149869bb32e4af8d3d72ae7fa10def12259fbe4c13c8bd5618f92409df7bfd6b21554efd5b11e5c737354f4a796e792126a75bb5e750527ca3ce009e

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                6KB

                                                MD5

                                                0e30b3d3263b908f2ae89e37b664d5aa

                                                SHA1

                                                a26db667ff4df5a8ad67079ba323bd7dc19e57c7

                                                SHA256

                                                684477fa4abc8f56b9ca960ead1caa54bc5a5f0cd93154dcf08256b51c41bd7d

                                                SHA512

                                                909a6cfe2e8a2c2a7d719aa91c1f0b123cecc863c57742eacaf527352a9b977c0d3330db320b0a2d65ef4f236f181911a9b8dbed593bec01b029789041b2b5c9

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                8KB

                                                MD5

                                                37f92d32b10127e61b974264b1ad442c

                                                SHA1

                                                6f1dcfdc29f8b94bf643abda3982c9a90670b85a

                                                SHA256

                                                700e6605fbf5d96dc24043f9af3e49b79f0afaf41d1b40e957cadd025f92749c

                                                SHA512

                                                c5addd78e52af7988608e6d29619eac7968d93d84a6deb2291d1cca8a34f44f7b22842913aaee3b6f6ef677c99f6367a90f91d0129f5b01c3c3044e17b74fe80

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                Filesize

                                                24KB

                                                MD5

                                                e30738d93d6789672ce8e1c4bfe275a8

                                                SHA1

                                                ce2195ec1f2e3830b9a106a9dc8d7fa5397d10fc

                                                SHA256

                                                7d60046d1238ff11bdf616d83c212ad6866a7cc630ee9be8580050dee7f74832

                                                SHA512

                                                e39c9590f558477a1b823de555bf27542a725566d8bd839a1c493459444d49d755445d8ff34f59681ede12a8e654c5a7fc34b6008c9abcfd65d09f6b1b523a65

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

                                                Filesize

                                                4KB

                                                MD5

                                                7005fe2ce78c66e2daa211bc5e34b8d8

                                                SHA1

                                                8af531d07d4de7f3a10d0bb748f5f20b0ebe0922

                                                SHA256

                                                63d93b295cf98a02c2ea7ab57669cb10fc0f9953cadfa0d3d21e8e4f2f922b36

                                                SHA512

                                                acc343c8bb1a638c008b6cc454cd09883d558f6de1d381f479050711526d64437036d1730360e75f53513fda66acd1f140cb580e0a2827abd6f990b59c48021b

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

                                                Filesize

                                                2KB

                                                MD5

                                                80265558fcf1db01aa207ce4acd262ad

                                                SHA1

                                                15fb36eb302de2f8f24f4803e9f57ca3f4e53f19

                                                SHA256

                                                3ac041fd65d81f8c7a1702687f4eaa5707d4d0a2ab3eeb0d7fd31face233e0e8

                                                SHA512

                                                544a9d766511478ef5b1ede08b5fdd41ee7ef13b07219215a14ae6bb45635b9ee624e6c7d2bf39f110e375b325a8ac3e15296dcfe21f37ab0f9dfae82705b734

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1

                                                Filesize

                                                3KB

                                                MD5

                                                adbd876e17d0e7463360872932a12963

                                                SHA1

                                                a46df0c246cc495e513692d2002d5bcefaa6af9d

                                                SHA256

                                                4852e8cffbfdc88732145ab00e23ce24f537f43d5ba08ab3af1ac7058c460eeb

                                                SHA512

                                                1beab36d0045e3c762b4f73752361d0ec6fbbc8cc45b6a287331ad1d13f4633fef5c4c601b545ff5fe0778ddd01982de647ef822f94b6e2d7cb69cbd2475002b

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                Filesize

                                                96B

                                                MD5

                                                3ff31f3a26970a53d9efb9ca88749476

                                                SHA1

                                                3ed46e4746836978f69acc2b994e2f113a9d7ea2

                                                SHA256

                                                ad195970b2190e55c0d3b60c870f82379730d3e0e4e8c857fc119408afcb6596

                                                SHA512

                                                575e37295bd9bed0bbc1836193abd6401d48dcecd1e964c812eaeda6f44661f4c6d9423b2b4a5e639c970f7c9c8e74a4b5e259467e4d59dd57edb9032a150b48

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f63d.TMP

                                                Filesize

                                                48B

                                                MD5

                                                6ad335b9f973bf110706130239fbc5cf

                                                SHA1

                                                56e5a31e6ad2f4a3ac7b3db96cbec6517d3684b3

                                                SHA256

                                                e6c416e74713e598f81fa4a314f32d27967dff4a9058bb7a5ea382e3c7993581

                                                SHA512

                                                6e50a8322dab1b4117abc59cafb4853724eb5a6c718387239a812079d9d94c90b1163d252bdcd1b54fb64005b6ebaba8aef092760bffcba3ca2a626896cf4de6

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                Filesize

                                                700B

                                                MD5

                                                8e613ae0d19c4ec567c379eb43454b65

                                                SHA1

                                                f63ee7123ae8796be153fceadcf07e12ff5a5b1f

                                                SHA256

                                                6ccbefe502808d2d2bb8f00740018d1134716dec436be0024500d49db3f7c0ad

                                                SHA512

                                                38f937d1a08bec23dc7db2e9db7304dc55120f2364b2575c6ac04b69ef9784acc477fa6a7f4ff569ab3278cd6fdce573dfa795d4081c4a52f1e295c16a80c9e8

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                Filesize

                                                1KB

                                                MD5

                                                ec8d4151959fd5e14fda71421ab1212a

                                                SHA1

                                                b26f76042e241771f0f4d964225b27ec1020fc01

                                                SHA256

                                                dfcdb405023d507ee1ba4940b85daecd940b96321ece9b321c56b5d9c0262177

                                                SHA512

                                                dc45066922e59c3f4af3bc982e4ad439f02740b9d17c817e6b9ed8c81704a2cfd5d02b5bf5831fdd10bbd86918dc9d8076042a0076c8adfef0ce8d88d40ba4c4

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                Filesize

                                                1KB

                                                MD5

                                                906ccec6a2b8b83d4fa0cd336921971e

                                                SHA1

                                                4f15e5e757292cf8ef5458f5bd7c31496fb0dfac

                                                SHA256

                                                1c0a246e5f497f03158959768548e780c73c06ccab4890c0832060fe0524614f

                                                SHA512

                                                d3b8edb7eb1d1aee259dc11eec540e09d57be8866c65a868bf827f5fac8b898de903fd41ed976b4523882ffbcaebb1c391b2623ecd9ba88a777f667eee1ac82b

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                Filesize

                                                1KB

                                                MD5

                                                c9f7e7d72ffbe2d4d7227fa8e7b57116

                                                SHA1

                                                2ddc559f61e9ee8d614c4e6a47d6c11a7bd179a4

                                                SHA256

                                                08ac2b54771e7dfb510e1106574d1cb5db90cd4b16de5f96b3ab5bc42b1c139e

                                                SHA512

                                                e3d4168d985d5ea2a6b88727f9764f20c0a74952b3a1a1457f16cce310dafecffadc95b2d7183f1ac8548b76309b7cee969ac6e293bed2bdb3d26ee4a608f12f

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                Filesize

                                                1KB

                                                MD5

                                                0693b579440aeef591aeeeade847834a

                                                SHA1

                                                9d9be6e3d7e8e6b0e771b50f3b5be3379a50349c

                                                SHA256

                                                0f2e57533f992292571c9bedd34a01832ec272cc3f57575f8a00aeccdf1b8618

                                                SHA512

                                                fe4ec3add3eaec79790033f1f7e89e30ef9e2ea49edef9c2343c90fca5608882971f9065d1d615f95800bf7618054204efff39b16aeb837758b039ce2ca25821

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                Filesize

                                                1KB

                                                MD5

                                                4547a7e9545107213d1023b4bcddb6e0

                                                SHA1

                                                3828e74a7f3d8ab25af3311223f61be287fbf889

                                                SHA256

                                                741bf82be74a7b0ac57d7744ee98fc72cd01f521ea42815460ab5bd7d7a182b1

                                                SHA512

                                                a3e67ea164fac465a0ab4e0d30dbac28ff830f7e151f4ff94bf5636cff9261cead33ea6660f1bec750515fbb85b9468821ef25555ba24b19b6305cabdaba1092

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                Filesize

                                                16B

                                                MD5

                                                6752a1d65b201c13b62ea44016eb221f

                                                SHA1

                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                SHA256

                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                SHA512

                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                Filesize

                                                10KB

                                                MD5

                                                1cb49b29c55a9af9e4fde2f4e785c9d3

                                                SHA1

                                                1b2d54c29c990af9c9cf3001ceed60f066a87238

                                                SHA256

                                                913bf356f3d1d9311b07f601515cad47fd7b77caa6a152cffe3cde7a5cc607e4

                                                SHA512

                                                fae47714ddbf062ead8a9e7f8b4cd9557265bb98cac93b2243bce43bf46ed49c202004630bf3afebf116810ef3f72837e24f4bf9578b4f6f56829f689e8f8b44

                                              • memory/4608-6-0x000000001BAA0000-0x000000001BAB0000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/4608-5-0x00007FFC82F00000-0x00007FFC839C1000-memory.dmp

                                                Filesize

                                                10.8MB

                                              • memory/4608-4-0x000000001C310000-0x000000001C3C2000-memory.dmp

                                                Filesize

                                                712KB

                                              • memory/4608-3-0x000000001C200000-0x000000001C250000-memory.dmp

                                                Filesize

                                                320KB

                                              • memory/4608-2-0x000000001BAA0000-0x000000001BAB0000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/4608-1-0x00007FFC82F00000-0x00007FFC839C1000-memory.dmp

                                                Filesize

                                                10.8MB

                                              • memory/4608-0-0x00000000007D0000-0x0000000000AF4000-memory.dmp

                                                Filesize

                                                3.1MB