quasar | a2fae5790f570b6fcd73f3d7f8513d4a72dfbab62342c0085646dc5a4c61aa52

Analysis

max time kernel
385s
max time network
389s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Script.txt
Size 142B
Sample240331-2jnmtaee65
SHA256 a2fae5790f570b6fcd73f3d7f8513d4a72dfbab62342c0085646dc5a4c61aa52
MD5 d4950b02c7ac8eca58cf586c640138b6
SHA1 d0fd3e0c009906c8356b6e8b6818a2c4e4b3b06a
SHA512 ddf0f31484f3127cf0b68be436a1c47547f90af67efccf6f41d3074d21a55362ece6934fc1b52eaeaad8de157e5d7867f104a86a4e3f8185335939f64503d468
MD5 SHA1 SHA512

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral2/memory/5308-710-0x00000254C1EB0000-0x00000254C1FE8000-memory.dmp	family_quasar
behavioral2/memory/5308-711-0x00000254C23D0000-0x00000254C23E6000-memory.dmp	family_quasar
behavioral2/memory/5308-713-0x00000254DC580000-0x00000254DC590000-memory.dmp	family_quasar

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
131	raw.githubusercontent.com
129	camo.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
210	api.ipify.org
209	api.ipify.org

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 50003100000000005a581a7a100041646d696e003c0009000400efbe5a58c8707f58a2b42e00000072e10100000001000000000000000000000000000000678d0001410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 84003100000000007f58cab41100444f574e4c4f7e3100006c0009000400efbe5a58c8707f58cab42e0000007ae10100000001000000000000000000420000000000b1900c0044006f0077006e006c006f00610064007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370039003800000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 78003100000000005a58c8701100557365727300640009000400efbe874f77487f58a2b42e000000c70500000000010000000000000000003a00000000000846bd0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\NodeSlot = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-566096764-1992588923-1249862864-1000\{4848110E-A6E2-4FD2-A761-BC5818706447}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0 = 66003100000000007f58cab410005155415341527e312e3100004c0009000400efbe7f58cab47f58cab42e00000015070000000004000000000000000000000000000000fec206005100750061007300610072002e00760031002e0034002e00310000001a000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0 = 66003100000000007f58d7b410005155415341527e312e3100004c0009000400efbe7f58cab47f58d8b42e00000009da010000000a000000000000000000000000000000ddc780005100750061007300610072002000760031002e0034002e00310000001a000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	explorer.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4276	NOTEPAD.EXE
6084	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5628	explorer.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe
5372	msedge.exe
5372	msedge.exe
2884	identity_helper.exe
2884	identity_helper.exe
2872	msedge.exe
2872	msedge.exe
5492	msedge.exe
5492	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5388	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 42 IoCs

pid	Process
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5308	Quasar.exe
Token: 33	3984	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3984	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5308	Quasar.exe
5308	Quasar.exe
5308	Quasar.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5308	Quasar.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
5628	explorer.exe
5628	explorer.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5372 wrote to memory of 3208	5372	msedge.exe	97
PID 5372 wrote to memory of 3208	5372	msedge.exe	97
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 440	5372	msedge.exe	98
PID 5372 wrote to memory of 2744	5372	msedge.exe	99
PID 5372 wrote to memory of 2744	5372	msedge.exe	99
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100
PID 5372 wrote to memory of 1748	5372	msedge.exe	100

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Script.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbcdc46f8,0x7ffcbcdc4708,0x7ffcbcdc4718
  2⤵
  PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=122432340869120 --process=156 /prefetch:7 --thread=3420
    3⤵
    PID:1952
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3208 -s 824
    3⤵
    PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4668 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1792 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7620 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2640 /prefetch:2
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7420 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8012 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7632 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,11696488495792251127,8753525661197639425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5216

C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Quasar.exe
"C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Quasar.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5308
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12"
  2⤵
  PID:1984

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5388
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Open.Nat.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x4e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
MD5 SHA1 SHA512

Submit Download

5132090c-754a-44a5-a554-95975fe824e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5132090c-754a-44a5-a554-95975fe824e0.tmp
Size 9KB
SHA256 12adbd4085f22b2bc7bd365550f0172462415ef1f5c2b7c44875acb891228914
MD5 544dd6e9f055c4dea63b87eafd49f6a1
SHA1 3439609979679a8453d48e23c072453a715a7a3b
SHA512 310c0baf6cfdc2033744d4c545b3ead62513b9804039cc3092f244690e23e3974c22d36da35bc9d2c0cf8f54ab5e25ab989f21e550e924868b61f8b50569997e
SSDEEP 192:ntkgorCddWMjP+u6ct/LGsirDYskC5DOLbbvMAeTN5Vg:ntforsWrqL+oow
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 198KB
SHA256 f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb
MD5 cda68ffa26095220a82ae0a7eaea5f57
SHA1 e892d887688790ddd8f0594607b539fc6baa9e40
SHA512 84c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62
SSDEEP 6144:/91MkLIQ79U1IvNpR0Q01wFrUf99d1GDyc:LMkLIQ79cu01um1c
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 24KB
SHA256 d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d
MD5 b82ca47ee5d42100e589bdd94e57936e
SHA1 0dad0cd7d0472248b9b409b02122d13bab513b4c
SHA512 58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383
SSDEEP 384:WVO9Au5n8w8JCE3z7e7Ttbu5+Esl5fnOoHYSDzExWCI3+IEesI1uBVm5ih5DTcOU:fWkn0RSdu59s3nOc5zExGd5Mt4OU
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 69KB
SHA256 3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6
MD5 a127a49f49671771565e01d883a5e4fa
SHA1 09ec098e238b34c09406628c6bee1b81472fc003
SHA512 61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734
SSDEEP 1536:O76VBiDmGlrMd/+kdwYZwLnUU+wI8jDfqyToN:O7bm+romkd1qUU+w5Df9E
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 34KB
SHA256 a3c49c1ac2dc2ba5609a4b54a70cce63e46fdd40567b875d4c9b201bfb2fcaa6
MD5 736fd708f1b321b2a84d7fe3287d26f6
SHA1 997e6fc05a0960b28c10422c42b7e3ed79be2c0c
SHA512 d137cbc22ddab4a36d4a4fb815a3b12997ef26be894abc04234aa72ee5e5e8342b3897c8cebb907e1ad9590e71906ecc8f2a6ca435ed7cb56802ed320490ccbe
SSDEEP 768:2Q8ZND1Ppc+uC8cI1q8G4vhP0x6Df6XYkSiS7mM6S/:2vPK+uncD8G48DXYkSvmMB/
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 1.2MB
SHA256 dd35fa6ced81d040a5aaa4726885204f44abc7ff1f7a83874b76f34bcc4d1598
MD5 8f4b4d5d848b49f72ec9d45000e45fb0
SHA1 6517ec20d81ce901746076948417cfafdbcc2d20
SHA512 9704356124a9f7df23cc91ff93b13fbcfbc0d09d92fa0a5d4c1dec65f7ab78ad2786ffd9ddc304bc24df4a0cfe43afa24cc0c6cc3c721088320feb5c6f7e7baa
SSDEEP 24576:IaKtKILtsqbCbE2xDSc1M6e97coQc/GFhB5bFqukVnwSeP7PVuAFxp11Zv0snbjz:IltKIZsvA2xWAneFwcuvTFquAwHdphF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 32KB
SHA256 851c67fbabfda5b3151a6f73f283f7f0634cd1163719135a8de25c0518234fc2
MD5 bbc7e5859c0d0757b3b1b15e1b11929d
SHA1 59df2c56b3c79ac1de9b400ddf3c5a693fa76c2d
SHA512 f1fecb77f4cdfe7165cc1f2da042048fd94033ca4e648e50ebc4171c806c3c174666bb321c6dda53f2f175dc310ad2459e8f01778acaee6e7c7606497c0a1dea
SSDEEP 768:u2dY7tWR/J2509QM8nvXyHjI3aCAbNUJhWNwWDcMhKWGwPnVSS1:u2d+tW1Jv9YnvXyHjAaqWNwoP8s
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 75KB
SHA256 beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615
MD5 cf989be758e8dab43e0a5bc0798c71e0
SHA1 97537516ffd3621ffdd0219ede2a0771a9d1e01d
SHA512 f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7
SSDEEP 1536:kaLheQOQWTpGt2kK++0+H+IZNmUsRkL5XpCg9:kVdGt2kKVhEUekho8
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00004e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e
Size 216KB
SHA256 ba5ee8d786d03919172492087ca52accba04471392724bc594a480fb7ee1b60f
MD5 3c0dc8ddf3adbc684f63dbd30f0e45f2
SHA1 80f8ee035aacaa8657ad14da85f79a4e98c7388c
SHA512 1d0ee73206dd85787469c32427ca908fb525a4c1b668f63eec372d12e9c7b3a62b182e9c4eda834970534f432fe2a98fb78b52b9f0a6c9d70a85e79ae091e07c
SSDEEP 6144:Vg1CKJKngdKFFdK1IfeBi8Z8dBuCperfa4hc4Dvp:Vg1pdt1qeR8GCpeer4Dvp
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000052
Size 47KB
SHA256 f80fbe6eeab5aff01dadbedc2e67de991b753da360d76741267ac7f6165a40ec
MD5 01431d5302bb16297a9b547f001cb900
SHA1 c467acd763351b69244967088b9b961a1f6e63a4
SHA512 df0a98466ad16d48a4a53436ca3a35ec5e6cf57177377748c51d8ce3bf8c67da78233e0b03beb2251c5ca0dbae97a5fbf601fa9225541ba74c3e186f6c902eb4
SSDEEP 768:dsAwEkV09fFum0v+fkJUErtsXYg8M0SH3tLS+Cog++oCl+CVoaT2NdOVT0/l:6AwT2BFum02fk4b8M0UWog+u+CtyN0Gl
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000053
Size 784KB
SHA256 a7160e67f2722ceb69a20f04167731a39c501b3c0444b8cc7faff168f30d7a36
MD5 ad98878f27b516a0194840c45845d69a
SHA1 405e69432b172319b5f6519245701bf1e03116ed
SHA512 5b34225af563a47565935eb30db11b79741937ec50c93b8e9a9db9d85e022ae4c824c8b7391ce9013627dd2c601095455dc0874a80b12cccf20e603c90f2355e
SSDEEP 12288:U7a67uNOJwPjjDcFK+x0GIc/cxAfanm1+4tPrLZEah0p6VuIiAZzeelgSTUIL:U2m2j0F4GIcGG1RtJES0QVPgSVL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000054
Size 31KB
SHA256 f4cfe06cf4f1a1b15acec42f0f7a62f86eae9b97df06c38474c014c2590ba3e6
MD5 33e3dd1d17d6bb961bf6ad1af0110ba1
SHA1 70dce63112f7bfd4b1854f3e2b5a0b55519986fa
SHA512 8cf53be0c1fe4b0c9d2592580af7a6da1cb2def1d5af0013de266e5355fbecf509c024480733f538f1d604618a0435aad2537ac97c8f0ad5f7761ddd46b45075
SSDEEP 768:XUJf1HAgrL8bg06sV0hZSLGy62wsKWHKOVqWP8fOwDW:XURqgf8bnHVIZSLGyMsKWqQqWP8mqW
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055
Size 33KB
SHA256 0f2e7ac4c4aff799101178dcecf2dbac3d00a8209009f2137cc425a0f2b0db3c
MD5 0c0ab95d1c165a6656102cc23db9e2f5
SHA1 bd6f3a4330e1ffb2087a41b42677a1f04e839153
SHA512 2becd3b0322e3b9c1386edaf1ed6919e2bedb4f4c1fc6c9b8d474b1d469a5643289267fb34ca031fdde7211267529c472f1bb0c85b128026f322c497241ca287
SSDEEP 768:6uDbarvJSoh1YL3rhywhsAwz7owQZtBkFlamvTM2Z4hB4I/:BDbazUhywuvncWFAoTlOhB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 2ff6d21f3d333815013421aab4b363c7836f4f4afd0c47cdd757360ba34d37b8
MD5 b0c400a74d8ae3a493cb01a091d5487a
SHA1 31a8aea020d823a3fcfc3d11c726f542c8a46fd3
SHA512 7b07ad9d1906931aea530245c06cac42f348c5d4816014c7f8edd532d4efe101953dffa385328f08ff8bf9d53435a4c3acb753681785a4f1437dd820a39e8ef4
SSDEEP 96:xZuhTHF/X4e0WJehN8dFYJ3zS6A6aeFykVwhGPuaC3GM2wVjRHVBxZvY8mq0lMRy:xsWzJyDxvGK4xWCwehgqijSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 a88fee775b20ef349a711c501a0c3ad48fe6fdd5bd65ab2eedd361187dbf7570
MD5 3c694e29b7bccbca3d310e70210a59c1
SHA1 e622b7aeb79549527d05ce867b317676b5ae3982
SHA512 2c5292ac9c9404e57e6c2cc5bd82255af92b95b3762b178993d4f05df312f37530865cd4d902b173d33b167eca3f73efc7fc1e4d538b31c6cdc784db166bd960
SSDEEP 96:BuhTHF/X4e0WJehN8dFYJ3zS6A6aeFykVwhGPuaC3GM2wVjRHVBxZvY8mq0lMR2E:0WzJyDxvQK4xWCwehgqijSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a2482d4e93cada9dd71e3dc88fc8c57196a37ab7a38a025a58088e8faf6f2314
MD5 01f2702430cd5c8d356fed5af65cc62d
SHA1 48e2d570c82a1032968afe22caae0f9a01c1711b
SHA512 83ba4f08c0e8448f49395d1b4030abad741d18315f52ecaa5f19679bab26191dae6578ea7118cb638c379e2547e5be78db31b489ab2b6b726524a4a664ee34bf
SSDEEP 96:tTHF/X4e0WJehN8dFYJ3zS6A6aeFykVwhGPuaC3GM2wVjRHVBxZvY8mq0lMR2S0n:1WzJyDxk3F4xyBObLyTSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 c8fbc6b5094d77db8564a2b7db9bbfac7b085009638929ad409719acc0b09c9e
MD5 9e07000ebef70edd4c916af1437dbf4b
SHA1 86ed4be011524f27236a341ee09d73c135ccc6b3
SHA512 73008b4eadbbf3455d80a95350f84ee8dabb9e028a4497734b235c9ac473fcd3dabc3d509dbf77de9352cd08ab0e2592dff0b19e2148ff3145951882389a27c8
SSDEEP 96:8vx1GfhTHFgXle0WJehN8dFYJ3zS6A6aeFdkVwhGPuaC3GM2wVjRHVBxZvY8mq0t:8Z18wzayDxB7+4Ey2FTqzSD
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 fd83f102e19dabdfb7fc627b04cb3f4cda72a184c49a8af43a1a174da903a012
MD5 aa6a044928432f1044ffa46040cc0a37
SHA1 b0883a17b72b52ce1091ece9f092dc585e031b4c
SHA512 658526713d2be3fd9a8c640c575ea03ee0af24700654be1f2ac5b339826d78592a8898adaaf15b47deaa82319a3ad11952c8077c09502ce0ce8dc2c5a5f9455a
SSDEEP 96:CGvx1GfhTHFgXle0WJehN8dFYJ3zS6A6aeFykVwhGPuaC3GM2wVjRHVBxZvY8mqb:RZ18wzJyDxB7+4Ey2FTqzSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 d054a7e6ce56bcd037668f9fe7b8c41aa5cceeb9fcd6ce819bf517439e9e182b
MD5 2ddbd8d784e7027d830c8bdc0db2f790
SHA1 a62781c92efddafe199f287502afe6aa5469505c
SHA512 33e80aa8fd0f182b6ad85fdffacf36e27b31129a923defb7099d3ac4b18504875c74a71886611ef1bdb6b954a8ba64b583343a5be3a065563cd586d96fcb624d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 44223e1a4fcf67e3b67382e848c46c1b8a131edcbe5d885d8f3c952d1e4e99f2
MD5 0a851fe13e3fb83cda8530a31bad4ca5
SHA1 ebf868bd0f73448fc9d800de2e4a7426653eec72
SHA512 2f2f414afeee5b634bf8d203b3c3471e00e6a8bfe444d2e3b9693e908a00f059857e2bd6f5c28e56b7242e855a1ff759c34b96a954d074e379806994fdeaae43
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 7KB
SHA256 102cb805b09751874659579dd3c822e2e22d5053e30bc6e2275197d46ff4de1f
MD5 8ea048c8f92fa7ea00c3a662b853e759
SHA1 4e3c309cace24982b1d237f5a155a0b8aa57ef0e
SHA512 da20dca9971fb0c5aa4970e335fbff0a10e17939a7d6e96f645ef33e38d3d167670cc94e46adabc3690384cb36587bbf3ea485622fc4e41f040e6627b19d97a2
SSDEEP 192:KVc4gEuIUjm/xq0Mh6jTTF9VaZv2C67rOhFS976red7P+LypV/4EdW/5Y8DsMftT:KVc4gEuIUjm/xqVh6jTTF9sZ+C67rOhn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 232a7e96f715ba66866a0d44a62cfa7ff646072760055f3fdb8894d167c718e6
MD5 63f255f6b86740f653cd721f22859ebc
SHA1 af74681373fdc24248769b561861308319a40488
SHA512 651ef40aa15662e649b9cb471a520374e46716c75c80ddb0f8625bc6058406dfd8bfc4bff0d7dc4f9123370424ba30c2383121ad78e8b6def11854e6226e2c6f
SSDEEP 96:W5ayc4gEuGRG5jN4hF/xsj0MNX6jTGulFuG3G9GdGE3G6TG2YGimGTZG8bk8GBLu:KVc4gEuIUjmhF/xq0Mh6jTTFuey83VTU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 6KB
SHA256 8916e3e4753da7724a729405dfbed04f667b2b8f30faa313645afc853c12d5f4
MD5 bb4ef963bf90f35ac15f502f016edb79
SHA1 d35a3622d42c8ad72de70c1cffd2af1e5f62b7fc
SHA512 e97542fe2271bac42aeb3910a72c829ba63e7a4086dee7bbcba0f448998c74c4a2786d164881d714c28d887b9968a5fedf96787962fb69dadd5f0d4bc626300e
SSDEEP 192:KVc4gEuIUjm/xq0Mh6jTTF9VaZvFh7oC66a+mzrOhlbX3Y5O/xL68mz:KVc4gEuIUjm/xqVh6jTTF9sZthoC66ah
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8849f9a539d2c30c078c7ce9b6d22fbde8638a7c2792ba2df771cad0bee61b2e
MD5 49e90b40307d88f4079aeaae1974bdfc
SHA1 647c8715c6d1aa538a3f4c9e192d9d423bb25323
SHA512 8e1d80f453392a8d47a3ee957cbd5a7f3c7a97b1c768c735f42041d85b9ad2ec8bad7949323b4acfe4820d6d79fbd3a6b504fddcf66acadfd8d8c57aa29dc1ec
SSDEEP 96:ntk8sQnOH1OZlQwpClWMoijR5mdeXuPS1GYgMkNvYPaL9foIHTXh5UWQyV+VD7AE:ntkDorQRlWMjBu6IYg2PaL9AeTx5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 9e819a7c84716d7f3790990d91449b77ccd974e067456d320007a54358a4735c
MD5 e6b8cdd46933df5d6d3d3f11e7fe763b
SHA1 fe98f8716a6d8a84451800b2028d1a9dcef2e852
SHA512 a537c432ae81fd38af761577fb9dc87ae9f97d2bd94d1afad913ed4d451ac714c28046437e64739ee1982f50586307b8ab23cca574d966731d9558a770f05c0c
SSDEEP 192:ntk8IorPruWMjLBu6IYg9DYskC5SBLbbvMAeTx5rg:ntkorCW0MyUa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f0fb0cc033d5aab13ea09f7737d6f013acd5bccebd80d690a62f25c6cbc8b9ef
MD5 3a55a3075b79581e266c101fce19b183
SHA1 f35ce22b0a90e2176e4710f8fc902c0bb0f277a9
SHA512 e57e5a570d7734bcfd280d8119390bdad38c6481020cb47883b3e6b40e99d931fd902a0e8effeed3941c477d55d24ba3293496642cbb71c5d4effd07bbac1f48
SSDEEP 96:ntk3OH1OZt2wpvWMoiVmdeHOHTsK5UWQyV+VD7ziEwb:ntkAon2GWMXETN5rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d3766c0df9652bc0b6e2489334338aff086ec65e1b894f4fb88350bfb42e12aa
MD5 7b74b8bf6c771936eb431c68ff0fe401
SHA1 4a31a30ed2c14a15c362a9a5dcf3c5202912459d
SHA512 65875d90db59b6f5a05b2737e6d33804bb0ac2f56f46a9b45fa692d3c1e23b7381a0aa3095b8ecf75e1c005ea2290ef52cb1821aa234ca221b5ed897df4f9ff4
SSDEEP 96:ntkgOH1OZlDwpvDWMoijR5mdeXuPS1tuPS1fvYPaL9OHTMK5UWQyV+VD7AiEwb:ntktorDgDWMjBu6Du6WPaL9ETt5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 27874c266e61afef404354c2be6206961408c85dbed6f6fcb9a3abf88f637009
MD5 02b3108578f3fb99b7abec1d424869e7
SHA1 e45ca9988bf1512724819b0dfb18d80dccd0dc7d
SHA512 f56c6a872d6323b918a2132cfe7ef5a1ddb473b61e12d24b6250ac75b0eb61535828e4740e969c06d21dbd45b37b175e2542bc3f1dd6abf530c347428b3dfca9
SSDEEP 96:ntkPOH1OZltwpWTWMoijR5mdeXuPS1tuPS1fvYPaL9OHTMK5UWQyV+VD7AiEwb:ntkoort5TWMjBu6Du6WPaL9ETt5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 eb033e271bb7a57661cd18a7d18a81c19d8476bca670e86275e6b52b9c63bf0a
MD5 61a177a053303849b98b08f950ac64b9
SHA1 0b09f4b9776fd3670ac463ea839f96f098e230d6
SHA512 552c90a1b7b8379cfab4ef46a98363777d698ece9a37a1c7f2bd285a73eb8f725652fe34ad1108e2acf227963b1e76565ba11ce0e317197b3132da282eda3975
SSDEEP 192:ntkYor8VxWMj0bu6qyCjVdsQrGsi3gDYskC5lTLbbmvMAeTH+5Vg:ntbormWZGvr+XFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8d0e5fd0417283f5849c747adc69d20555ddddb98314cfe6785370a4ebe605ad
MD5 88f148936fd18333fbf86291c9556eed
SHA1 aaa80a7d16ce1a82a04abcf55d12d14a053b4045
SHA512 9b11ef8bf93a287a70f69fd59c1c78b61e9ad3a72ef9d981558e9b6f6eaa02b38704880f5a3e7c0f7748a13a8000c8e53802903d7eaab91109c98e66c2147649
SSDEEP 96:ntk8sQNOH1OZltwpWTWMoijR5mdeXuPS1tuPS1fvYPaL9OHTsh5UWQyV+VD7AiEc:ntkhort5TWMjBu6Du6WPaL9ETg5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 17e89775464e65392ba16c98bcbf5afb122a4b100fd8b2f5e9bc276b89a4038e
MD5 a20e2389c75c70c3339d75b2b60afaf1
SHA1 0ce027276aff8fe7d3e56c3e8ab43b57b72ed325
SHA512 cb91f748de679e7195781c6924d2c7cc43bef0abca4cd9b8a267adef59f16a63aa8fec04cef47b84797ea0d064fab2f2afff5556f04d036f57f47fb6eecc42e9
SSDEEP 96:ntksOH1OZl2wpvWMoiVmdeHOHTsK5UWQyV+VD7AiEwb:ntkJor2GWMXETN5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 74b940dc11f6db7ba314943e32eb22d04670b286695e07bcdb2981f4884397e3
MD5 406ac6d96ec22dd2f5e15394aefac4b9
SHA1 1a2f4e52cdde15a225dac4f5ff7e92401ad6a76f
SHA512 423f372c6c67d7633db964e3bdfeed134de92d4de521aa00e3c568d0ad67cb623f8f107d91b7ab841e34364189941e849d57736420025d8c280381cbd4b4da0b
SSDEEP 192:ntkJorZddWMjP+u6qyCct/LGsirDYskC5lTLbbmvMAeT/5Vg:ntqorVWrGqL+okw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7c5baad42df558ffd32a7fee3e81f20d485c4060d6a333c2426137e790369c1c
MD5 4a31455bee4b00627184a5c71e40eff2
SHA1 42e9c99d15e29618a26b323e999f83cc3c04606b
SHA512 c82c10daff32879e6a400f6710091b62597fb083a1c667c0b2bc4d356809b2149be2c1d2ead09fb0035c65b08148138db5a4cf4c35d4209eb776cdc680391f78
SSDEEP 96:ntkmOH1OZlTwpvWMoiVmdeXuPS1fvYOc2OHToK5UWQyV+VD7AiEwb:ntk/orTGWMHu6WOc2ETR5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 276ffe74538ffd5ae546c706d59e4949bea572e8612896ad6dd16969571905aa
MD5 f4452c996b6f430a888e380dfb196c8f
SHA1 1ac920bc145efa3336148fc25fac036a8e90b99a
SHA512 53274933c6b908258311f7b11d0b90277ad244dd5e149749b8925b6b87555ae0111f9eb764eb69830cd53d32bb7eeb4e49d98f32544c639267950c0e7147c42a
SSDEEP 192:ntkYor8MnxWMj0bu6qyCjVdsQrGsioykZjDYskC5lTLbbmvMAeTG5VG:ntborlWZGvr+O+d2
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\15ca738d-29dc-4e30-b287-a892d97c2108\index-dir\the-real-index
Size 624B
SHA256 9a4bf9aa7932c433ecf74304a60e7aeb37ae7b9113563b996ddec7cc211efebd
MD5 7c99d74551956ec392d3c3a906cce045
SHA1 a7b90d270d06452218035d7076c5a06d667486bd
SHA512 1304fb2a6547c40147472fcaef4b115ced2f15f81f1b353da626f255edd004586ee552c11a648399ff12bf6e8ff47fac95a087e600bedb3fe6c584df47105b66
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5c1276.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\15ca738d-29dc-4e30-b287-a892d97c2108\index-dir\the-real-index~RFe5c1276.TMP
Size 48B
SHA256 db29bd7aef2050c01e57fdbd7a7de3b1e6eb46f20be10ea3da2390dd7d93e022
MD5 a65eca9a4f196b9c105d39ac9847bb06
SHA1 8d8d2d37ea96a7a1ee5a741322308378231efc8d
SHA512 04e557927516072f824b083d4cb7b319032255aaf7cd84b41966e19d723542500f9253889777191797565109cad27e4987ccb9aff11d027686bb7f1f047acec5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9fb62635-eecf-4e4d-80e7-a58cb3c1dc0b\index-dir\the-real-index
Size 2KB
SHA256 c7837c41a5c57daf9433a0f6d202734c1c254cc2479664c40e6613686eb8d5ec
MD5 327d637766cfcfe4f2d4697a0388b886
SHA1 7b455f61a2ce7be8190b52c8a1244ef2e620b0b9
SHA512 300c41b32f027028cc0a30e79fa9b383dc1d1ea2ced067c7f839f2c7cd5eaab0fbedadabe09f08ada8105fbe0105fb9156ebbbbcb0e8044e1bcba77a30a0eecb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9fb62635-eecf-4e4d-80e7-a58cb3c1dc0b\index-dir\the-real-index
Size 2KB
SHA256 2373ce52bd5365b58e100ad6a46ade03aefda134cfb8519d034527d282dc5931
MD5 0ae82b8fe5173e4a34dcb82c863e5f9e
SHA1 323c00b5ecb40dcce97e557dd4a6f33348cb43b0
SHA512 a6c3ef2328527ae27716643539728d8aa094e860b82d861833adc5f404d100ec0825f9a998fd96d239d92e88846044aa152b5cb4089125f9e9e1ae3183a8624e
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5bbc86.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9fb62635-eecf-4e4d-80e7-a58cb3c1dc0b\index-dir\the-real-index~RFe5bbc86.TMP
Size 48B
SHA256 d46350bebe78e12dfabc130a7a979889d4da213955aa1e865c087819aff93dc9
MD5 9e6907fda8cace03edbc491ff1f90dea
SHA1 291040dcc07f8c951a512a84e4f02a41149b0ffd
SHA512 934f2b76ff36359f36f2fe7c16e4b595eb2cc3b2828160ad1d8ddd4427f6410192cb2ccdc907c5c01374d4477533571cf39dc23d93630f6bafb5cc18bfe506c3
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b6cceaf9-c4b0-403d-a206-c02cb6facb48\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 89B
SHA256 8785ed2bb969912ef5130bcb5689a7a2ddfd1412411bf1e7ecbf91eedf420ca5
MD5 db721708bbf821ca973f93e5d774c6ed
SHA1 74d35e401baacbce63177e332cf73fb7291e1e47
SHA512 1ca7420983cff5b1bc9600b4f9e37c5330637bbabd7596dc55f3932daae43615f717164e9d7b203dc2217810d3d5654a872c334fc34992563d9398ba7d09a8bd
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 02c4f621154f16d6c35795c04644cd596f08154e25d28818a46efdf3ef650c7e
MD5 6921e11140825d3ad420717b925d777e
SHA1 652fade3b004419c8a4e0457bab09f208a602eaf
SHA512 7e87831bb9606706d258d3f1027eda0e6720bb10cfd2e24bbdaed77a5836ee6edc60b413c400dfd6cbb430b4e3072903f9b5833187cf1ea1a3698cbb7a9e6e3d
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 148B
SHA256 95a9ea69a1827dada24d00e1f2724ca3f92aae00d4ff7b51ddc7280c0b6b0741
MD5 6127f7271b8d24e184625915f87c06d7
SHA1 e391f4794cc72d74f79e354b35a3897f67e05ec0
SHA512 445fd86c70020b571c46ce64b5812cc57a2e57dbd56a699fa3240081a37441b822b8f2486ef4d6835602d2bab85005130b966c7492b7273318c5dd893af435ab
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 157B
SHA256 0b77e9843a0ad903fa742664e1acc7840702b07f974e9c1f20ff844a45b1ac16
MD5 926d3b5f37ea0945f01a9041019ed8ed
SHA1 4171cb757f80c51da12502f3f8e98b106da2a9d4
SHA512 8a0e97c5b191f0aba344cb5e3e419fd1259371a4870c21b0aec788ae025f8370fbc1d3d5ede46eb80cffcb2bf90a201cc77a58bdff0ae3e18c175c0bec98c1e6
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 017e163e03d4d56e01992e429f910ff4ff90f76d3af7cc77ef96642677582291
MD5 3a028ce14ff19f8d5159886650cc9fc4
SHA1 66034557cf8c1a710c0161bb86a9dba179c62c6f
SHA512 ac2ecdaf4dae7c879322960513a0848cf09a879cc96d907e49b7632c85af537aab0b9cc027a0acce2196640188ffa86150b4080be32d6dbe8cb4f31257daf48f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 84B
SHA256 eecb3edeb2ca0b91558cd61ebde02afb166f0337e7dcd47dff3f3b53e5e0750f
MD5 d9460f3d1f1942c28413fa0ae0d1c34b
SHA1 cf0c4e33178d60afe1819d971f53ddaaf53bd1c6
SHA512 713e410eb314aa5dd767d051521db3aafe5f6025e9b7e11fc6e3dd06c00ada2c2246c4cd1d0ceab530e6feef04953775409f49ed069e2bc64de7073969fe3ac0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 153B
SHA256 d92728983c482bdcc56275f61231fb212ee74d40e70b58421fb5391587220b17
MD5 859436383a84a65163e796b2899ef2d6
SHA1 580549522da9684f6cab2100ae39659dfcea903b
SHA512 dee7ca2cfda5649981811c96beecb706cc125851870274f60136b892ca39d2a0de6fea0a968207abc75d68845ceb326d86f6bfe01c13f74234d9d18ab8cb0cfb
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 79421ae59937d70e4f87fdc25137a9dc42e76701286256148bd8a5999bc3f629
MD5 ab96bd32476f3902fcabcc70bd56ad9f
SHA1 c3a634091ff106320b25aae883d9c9bb7b1027fa
SHA512 e4668d24865b0755234161dee08c269acd5fc3ae5591787f99583b1357126fd88af6fa068d12cf228f4768836450142de8d80c945036459b6bec315038ee6611
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5c0df2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c0df2.TMP
Size 48B
SHA256 9528f8efacc5cdc9a309ef8c1272208864649397e9b9d00523fd2668a7092c6a
MD5 6562b091d26cecd7d4115c5b649ff39d
SHA1 1272a2df5867aaa4581dc4dbc4dd6888c566d9a7
SHA512 8e2901505d2061608e2ebe1a3b8e37bb631489dd66d5374928ee2da0aa6237ad7ae49be2708ef75cd713cdd76e239744c501fbd733d79dcb3638aa8f619a9024
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 a6b5a17ca298abc96e4b9cd692a68dddfc86ffc5bb101585b1ff9d07e1d98a42
MD5 a8d5593a228156061c3e156ff18a9135
SHA1 ce6354ff711e04cbef68bd7fac8cbd76fc035521
SHA512 34d6d7b92b2ab7b9a8a1dbf96d77c53af612367b8d24e01a20ce77925523fcceedcd94bd54d7c1b13ca97fd5bfceb8df9755b9ebfb63da68fffda633981186b2
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1d0099d49e5b8956dc942adbd8534e81e7d80a3c48b5f6998b49de9b567fc077
MD5 a2b5865832de25ff089944ebed0d2bad
SHA1 94e61a9cce0d49a4021eeb6c5387cd53a45feb81
SHA512 1b30d7696a60e7382af0172092432d4d686fd880ae5acd45d82745b30cd8eb2e320f7962cfec57bd409bd726f27322118a50289c8bcf153f9323c4c1bd54e605
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 df5bf3ac0cfc25fd083522e05c897931224027be0ad72337c37012b178619501
MD5 932238750df07959687ced7474a18a35
SHA1 e5ba405c5e40ec26e012d933ddca1396ccddf276
SHA512 d2d109cd7fbeb97753bc1c5d04a11114aeab410bced041ed053deb6df2c6d24006246c23906ff881474b82feeb92dac7a00ce0516deeb714afee7bf55fa99482
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 f9d082c43e015b33ebba429e3c190282a300fbb35b06663fed168115dccc00c1
MD5 37233b4ae10047345aa883d6d800a56e
SHA1 9f4aa51af8bbcc751add5ddbd40876492b4d37c3
SHA512 0c7f1c59fe4eb55db4abb4756033027daccc09dae91bdbb616c1e5f85530e2e26046e64f50f916bc7b3e58f7762c49cb530592d0e20fa3a60d8a566dedd24958
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 209bc55aec6e77b7c5c2bc07a98bc3ab6d385d1383f69d160d35e4fccb1f5052
MD5 54a88aa0ec3ed735e723cbd5ba88f648
SHA1 df7efa17b512a916587a87861dc8c1a04324d4d1
SHA512 f44521d83737f17714a26c96ae34ba4738c8671980da0b23655a18c41b9acaad2d7d86998cd6debfb30dfa14123280a8d33dbc80b8cf8ba4355e5d9817681a45
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 14467870d44224da4ec0a8c9895ebed92dd5047c9c374a24f61db958b0aacdef
MD5 5540e785afe870fbe42cfc2ca6969bbb
SHA1 caef7d20554caacd0faab87bfac958b05f8001b2
SHA512 ddd6edb8422bfe7f6248428cdce2d6cc156c77133ae378b4988b4b3d84c3636e3633db18dba01e193ba286d48dbf8ff63c9880b2a6d964eedc78825e4683bcbc
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 82e9d07e7843c602315b2f52349fd81272a364164f289316a03c2182f84c33ce
MD5 a9f9d6bd5884bbd020880d33c818e355
SHA1 f6de094c92bdda6964d97b24943d95a35f48f1d4
SHA512 eca6253f62ca359e674f26abae335279f60af5d37a2a15e0ebf42668f46de5ba5a926a8def51cd1d85376d7de9919dfd409d4ae9afa809369195ad7ec1f0a160
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581e8f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581e8f.TMP
Size 538B
SHA256 c339bee4deb280f9942ade099fb2d70d95579575becf95b548878667d1e8db1a
MD5 0bbfe58d2af2ed4f9bd8828844f78f24
SHA1 d97752564b4bc78a935672d23b2667bb6d9b06dd
SHA512 fa64a4dd19cec7b1281f47c69d85eed2a53b2928955b1a4c097e1ccc1db2732f7a40fc8d91f4a611e411d04a38d3ea0ee1bc60e204dadf5158816e192552246a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000003
Size 20KB
SHA256 dad5ddc6868717a6c955e0c7627f0f93adca70d5d20733c1a98324269fa19f85
MD5 a4e164f6a15386763f5a9915b9b2abc8
SHA1 8d499d52070f47a4084008fcb8874fb148994d4d
SHA512 9ae0dc6c7638553dc8b7c99f0f0b5671901409b50c0cd7666b556a08cb979b4334cee2b10bc826a3d7ce435a84536a0e81d2fbc79104e29588c5b506da97aa0b
SSDEEP 384:t8IQdW4/7+KyKw1Uko2+ZKKIvisYkpKKjRE1xAO+vB+nI:t89W4/7+nMeWkpK+RE1xAO+vB+nI
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000008
Size 17KB
SHA256 6388415a307a208b0a43b817ccd9e5fcdda9b6939ecd20ef4c0eda1aa3a0e49e
MD5 fc97b88a7ce0b008366cd0260b0321dc
SHA1 4eae02aecb04fa15f0bb62036151fa016e64f7a9
SHA512 889a0db0eb5ad4de4279b620783964bfda8edc6b137059d1ec1da9282716fe930f8c4ebfadea7cd5247a997f8d4d2990f7b972a17106de491365e3c2d2138175
SSDEEP 192:8v7IVdLfOLLIojy32RnoWXF1eyEQ0AJqgMwm96pKR0AU:78IvW4oJvMwm96pKJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 112c2092328fa24a529f4743a0563f54963ad1de5642c91261db83803f128c7c
MD5 f9e98d1efab7e616185f507feefb9b47
SHA1 6ff0c3814b2d298faecdc67375798b8b20e47b1f
SHA512 253051baee658a2a8be43db56fa267142e290ae420b94da19d7d93aa7f9c7b938d68340552a9c7ffd8421eb03a697b5e06fa07ff95ece7db62104e0fad3a7eb9
SSDEEP 192:ooCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgv2RU4SX7n4bR/2znIYWLP:Q9iIxuERzA83h09RZxYhH6ro/2zIDG85
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 62616e968d7cdb23c50598acf619a2a0d03981d0b0b367f9636d01230a650af5
MD5 9a87cc8c72b5b4ee60545e70f84ae915
SHA1 ab53617505c3298eca7202c4f14a750df8afc687
SHA512 107af3f3e0638b0a40480656c048af9dadfe4ba82546536e73591cac305c4362de7ce34b6adad6ba683da5c6360656792f0a61c6e8ad958474462369b52f7dab
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupBe2RUuybR/EznIYWLSDgSe:A9iIxuERzA83h09RZxYVO/EzIDG85
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Quasar.v1.4.1.zip

Path C:\Users\Admin\Downloads\Quasar.v1.4.1.zip
Size 3.3MB
SHA256 4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62
MD5 13aa4bf4f5ed1ac503c69470b1ede5c1
SHA1 c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00
SHA512 767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d
SSDEEP 49152:lYLmNgMh/9yUsRFeWMyYISDSwtfxZQNemi57PdHmeFINp/lFnsDbNFNepL6DJo+J:mL9U1yUUQykOQ91XFYBlR8P9d5uNJo9
MD5 SHA1 SHA512 SSDEEP

Submit Download

quasar.p12

Path C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12
Size 4KB
SHA256 2b8ab05be88cffad42eaf6eb6bc4b28a4379fc1fc641448d7a1710c25ca7c04f
MD5 9e3ee29389936175d7e18cdd39ae168c
SHA1 f1aa169fe05b92d97fcc3606986a7276b9dd15bd
SHA512 fcacfe9379a5cbbf029a1be29d2b7cf6d6b2d0e2cab279a43477fd2e99733d8b768f6df2112ed2ba9091b16731c4cdf8deb1ef12f325e05788b5dcc7d204a782
SSDEEP 96:60CEZ9xp5vzXWk7lGXAXgOAPSmQ7z4cwD4X039H5Wg2O:60R71zXWbogOh69H5Wg2O
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5308-733-0x00000254DC580000-0x00000254DC590000-memory.dmp

Download

memory/5308-712-0x00007FFCB9640000-0x00007FFCBA101000-memory.dmp

Download

memory/5308-713-0x00000254DC580000-0x00000254DC590000-memory.dmp

Download

memory/5308-734-0x00000254DC580000-0x00000254DC590000-memory.dmp

Download

memory/5308-710-0x00000254C1EB0000-0x00000254C1FE8000-memory.dmp

Download

memory/5308-751-0x00000254DE920000-0x00000254DE938000-memory.dmp

Download

memory/5308-715-0x00000254DF740000-0x00000254DFA6E000-memory.dmp

Download

memory/5308-752-0x00000254DEB80000-0x00000254DEBD0000-memory.dmp

Download

memory/5308-753-0x00000254DF4E0000-0x00000254DF592000-memory.dmp

Download

memory/5308-714-0x00000254DC580000-0x00000254DC590000-memory.dmp

Download

memory/5308-727-0x00007FFCB9640000-0x00007FFCBA101000-memory.dmp

Download

memory/5308-754-0x00000254DF420000-0x00000254DF46C000-memory.dmp

Download

memory/5308-711-0x00000254C23D0000-0x00000254C23E6000-memory.dmp

Download