Overview
overview
10Static
static
10Quasar v1....e.html
windows7-x64
1Quasar v1....e.html
windows10-2004-x64
1Quasar v1....to.dll
windows7-x64
1Quasar v1....to.dll
windows10-2004-x64
1Quasar v1....ok.dll
windows7-x64
1Quasar v1....ok.dll
windows10-2004-x64
1Quasar v1....db.dll
windows7-x64
1Quasar v1....db.dll
windows10-2004-x64
1Quasar v1....db.dll
windows7-x64
1Quasar v1....db.dll
windows10-2004-x64
1Quasar v1....ks.dll
windows7-x64
1Quasar v1....ks.dll
windows10-2004-x64
1Quasar v1....il.dll
windows7-x64
1Quasar v1....il.dll
windows10-2004-x64
1Quasar v1....at.dll
windows7-x64
1Quasar v1....at.dll
windows10-2004-x64
1Quasar v1....on.dll
windows7-x64
1Quasar v1....on.dll
windows10-2004-x64
1Quasar v1....ar.exe
windows7-x64
10Quasar v1....ar.exe
windows10-2004-x64
10Quasar v1....ib.dll
windows7-x64
1Quasar v1....ib.dll
windows10-2004-x64
1Quasar v1....nt.exe
windows7-x64
10Quasar v1....nt.exe
windows10-2004-x64
10Quasar v1....et.dll
windows7-x64
1Quasar v1....et.dll
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
31/03/2024, 16:35
Behavioral task
behavioral1
Sample
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Quasar v1.4.1/BouncyCastle.Crypto.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Quasar v1.4.1/BouncyCastle.Crypto.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Quasar v1.4.1/Gma.System.MouseKeyHook.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Quasar v1.4.1/Gma.System.MouseKeyHook.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Quasar v1.4.1/Mono.Cecil.Mdb.dll
Resource
win7-20240319-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Quasar v1.4.1/Mono.Cecil.Mdb.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Quasar v1.4.1/Mono.Cecil.Pdb.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Quasar v1.4.1/Mono.Cecil.Pdb.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Quasar v1.4.1/Mono.Cecil.Rocks.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Quasar v1.4.1/Mono.Cecil.Rocks.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Quasar v1.4.1/Mono.Cecil.dll
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Quasar v1.4.1/Mono.Cecil.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Quasar v1.4.1/Open.Nat.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Quasar v1.4.1/Open.Nat.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Quasar v1.4.1/Quasar.Common.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Quasar v1.4.1/Quasar.Common.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Quasar v1.4.1/Quasar.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral20
Sample
Quasar v1.4.1/Quasar.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral21
Sample
Quasar v1.4.1/Vestris.ResourceLib.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Quasar v1.4.1/Vestris.ResourceLib.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Quasar v1.4.1/client.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
Quasar v1.4.1/client.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
Quasar v1.4.1/protobuf-net.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Quasar v1.4.1/protobuf-net.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
- Size 1KB
- Sample240331-t3vapsfa2y
- SHA256 6b73c0a42d138d1f05b527c7b936e79af9f44a55d52e35f912da15c0dea43d30
- MD5 bf8d5a737e70dd3493a475b8672f14df
- SHA1 01d35be1b65293f7ca43ee1045424599923ab54a
- SHA512 ecc23ef88b80944ed135233118db167bf5dc161b0392af25ae846010f9993673bbdb62f88bf6de24dc060a48a0cfe96be261d30f5dac2705ed0f01d987fe24b8
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2972 msedge.exe 2972 msedge.exe 1072 msedge.exe 1072 msedge.exe 3088 identity_helper.exe 3088 identity_helper.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1072 wrote to memory of 1252 1072 msedge.exe 84 PID 1072 wrote to memory of 1252 1072 msedge.exe 84 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 1400 1072 msedge.exe 87 PID 1072 wrote to memory of 2972 1072 msedge.exe 88 PID 1072 wrote to memory of 2972 1072 msedge.exe 88 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89 PID 1072 wrote to memory of 2868 1072 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\3rdPartyLicenses\BouncyCastle_license.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ed7946f8,0x7ff8ed794708,0x7ff8ed7947182⤵PID:1252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,11671891882924784480,17586690560988324604,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,11671891882924784480,17586690560988324604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,11671891882924784480,17586690560988324604,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:2868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11671891882924784480,17586690560988324604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11671891882924784480,17586690560988324604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:2160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,11671891882924784480,17586690560988324604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:82⤵PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,11671891882924784480,17586690560988324604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11671891882924784480,17586690560988324604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:12⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11671891882924784480,17586690560988324604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:12⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11671891882924784480,17586690560988324604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:12⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11671891882924784480,17586690560988324604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:12⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,11671891882924784480,17586690560988324604,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3100
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3228
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
- MD5 cbec32729772aa6c576e97df4fef48f5
- SHA1 6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
- SHA512 425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
- MD5 279e783b0129b64a8529800a88fbf1ee
- SHA1 204c62ec8cef8467e5729cad52adae293178744f
- SHA512 32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 ee5709f8ac8c6879aee0ae176506a5bf9ace4f67d587da74d0423107f27c1602
- MD5 1618e8fb01a803bc9ea55728c67843b0
- SHA1 236887616f79b22994abcd4670d940196f726fbc
- SHA512 9ce2a2e9a47dd770a984453979d74ddf53f1ec9876d12f70b912ca8353d8634f984075de4bd0f4ff1d64aca99362c31e0c74bd76a6f9efdc1ceed0a6b5186bda
- SSDEEP 96:nekth1GmwpvWMoiVmdeHcmGUWQyV+VD7ziEwb:nekj0mGWMXGrt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 465812e54e94f27ccc44331979889f3e536c36474ac41f11604c41cf72192168
- MD5 86aa87decbfaa2ad3f5b1bf8f86141fe
- SHA1 bb47b97df9a54db23524fee8edc676414c4f5929
- SHA512 fe81a27c8b0d1b3ee647d31b5c6e23651bf4b28fef4686c632894e624938bb835bab1406909d5a57fdade26c26d62d59a68dd8ee3ea8687cbf4b3ca768f2445f
- SSDEEP 96:nekoh1GWwpvWMoiVmdeHcmGUWQyV+VD7AiEwb:neks0WGWMXGrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 ef2170c9e667dc58e918439fd7170edfc823c824635f04b8564376fad1f5fa43
- MD5 c12bc591015dfa633cb239e1a8fe1b5b
- SHA1 5beea0dca2700a06d5d49e99ad7f3ee8d6e69555
- SHA512 1742c8a00cac6c88adc23c7f41d81a1fce90546706309fada9ba3a99de4bce3c7aa575bad1d5a3a5ba2b1711e19d6eaee342b695e044ccaace0aae99a71f9782
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupqe2RUM+b9HznIYWLSDgScs:A9iIxuERzA83h09RZxYkYHzIDG8s
- MD5 SHA1 SHA512 SSDEEP