Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
18-05-2024 10:08
Behavioral task
behavioral1
Sample
Uni.exe
Resource
win11-20240508-en
Errors
General
-
Target
Uni.exe
-
Size
409KB
-
MD5
4c2bb0618a6eda615c8001d5a7ccd6c0
-
SHA1
c88d2c8bfc5906a5cfef78893d1132edcffd71f0
-
SHA256
abcda524c02f9381d8d43f9ec0079d854db821d77f45e88f50606f46871f81d6
-
SHA512
6abe53339656a023e2a0547f1c2249789c33091d67a21f2e689c6411dc5357e34ec3c65634b6f6955a5023d20803f7c746b13f574bcd84b008abb4a97ea61027
-
SSDEEP
12288:rpg6M1i1v6q1ak/e7xlX7nnvGAwhJLJO:lxqiii6xlLvGjhO
Malware Config
Extracted
quasar
3.1.5
SeroXen
tue-jake.gl.at.ply.gg:29058
$Sxr-xPAuDxLNyBmZ7S2WLJ
-
encryption_key
Pw78RUs175dFrKD7lMwH
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
SeroXen
-
subdirectory
SubDir
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
g0KrMbdTGQpD.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe" g0KrMbdTGQpD.exe -
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1836-1-0x0000000000620000-0x000000000068C000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar -
Processes:
g0KrMbdTGQpD.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" g0KrMbdTGQpD.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
g0KrMbdTGQpD.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" g0KrMbdTGQpD.exe -
Executes dropped EXE 2 IoCs
Processes:
Client.exeg0KrMbdTGQpD.exepid process 3168 Client.exe 1376 g0KrMbdTGQpD.exe -
Processes:
g0KrMbdTGQpD.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" g0KrMbdTGQpD.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
g0KrMbdTGQpD.exedescription ioc process File opened for modification C:\Users\Admin\Desktop\desktop.ini g0KrMbdTGQpD.exe File opened for modification C:\Users\Public\Desktop\desktop.ini g0KrMbdTGQpD.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Modifies WinLogon 2 TTPs 3 IoCs
Processes:
g0KrMbdTGQpD.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1" g0KrMbdTGQpD.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" g0KrMbdTGQpD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "0" g0KrMbdTGQpD.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
g0KrMbdTGQpD.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png" g0KrMbdTGQpD.exe -
Drops file in Windows directory 2 IoCs
Processes:
g0KrMbdTGQpD.exedescription ioc process File created C:\Windows\winnt32.exe g0KrMbdTGQpD.exe File opened for modification C:\Windows\winnt32.exe g0KrMbdTGQpD.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeSCHTASKS.exeschtasks.exepid process 3788 schtasks.exe 4464 SCHTASKS.exe 2596 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies Control Panel 4 IoCs
Processes:
g0KrMbdTGQpD.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Control Panel\Mouse g0KrMbdTGQpD.exe Set value (str) \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Control Panel\Mouse\SwapMouseButtons = "1" g0KrMbdTGQpD.exe Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Control Panel\Desktop g0KrMbdTGQpD.exe Set value (int) \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Control Panel\Desktop\AutoColorization = "1" g0KrMbdTGQpD.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "250" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
msedge.exemsedge.exepid process 1468 msedge.exe 1468 msedge.exe 1348 msedge.exe 1348 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 1348 msedge.exe 1348 msedge.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Uni.exeClient.exedescription pid process Token: SeDebugPrivilege 1836 Uni.exe Token: SeDebugPrivilege 3168 Client.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
msedge.exepid process 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid process 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe 1348 msedge.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Client.exeLogonUI.exepid process 3168 Client.exe 2828 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Uni.exeClient.exemsedge.exedescription pid process target process PID 1836 wrote to memory of 3788 1836 Uni.exe schtasks.exe PID 1836 wrote to memory of 3788 1836 Uni.exe schtasks.exe PID 1836 wrote to memory of 3788 1836 Uni.exe schtasks.exe PID 1836 wrote to memory of 3168 1836 Uni.exe Client.exe PID 1836 wrote to memory of 3168 1836 Uni.exe Client.exe PID 1836 wrote to memory of 3168 1836 Uni.exe Client.exe PID 1836 wrote to memory of 4464 1836 Uni.exe SCHTASKS.exe PID 1836 wrote to memory of 4464 1836 Uni.exe SCHTASKS.exe PID 1836 wrote to memory of 4464 1836 Uni.exe SCHTASKS.exe PID 3168 wrote to memory of 2596 3168 Client.exe schtasks.exe PID 3168 wrote to memory of 2596 3168 Client.exe schtasks.exe PID 3168 wrote to memory of 2596 3168 Client.exe schtasks.exe PID 1348 wrote to memory of 4060 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 4060 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1628 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1468 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 1468 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 3272 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 3272 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 3272 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 3272 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 3272 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 3272 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 3272 1348 msedge.exe msedge.exe PID 1348 wrote to memory of 3272 1348 msedge.exe msedge.exe -
System policy modification 1 TTPs 5 IoCs
Processes:
g0KrMbdTGQpD.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile = "1" g0KrMbdTGQpD.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" g0KrMbdTGQpD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System g0KrMbdTGQpD.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" g0KrMbdTGQpD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer g0KrMbdTGQpD.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uni.exe"C:\Users\Admin\AppData\Local\Temp\Uni.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Uni.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\g0KrMbdTGQpD.exe"C:\Users\Admin\AppData\Local\Temp\g0KrMbdTGQpD.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- System policy modification
-
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Uni.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Uni.exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffea7b13cb8,0x7ffea7b13cc8,0x7ffea7b13cd82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,4077836128147832941,15937492244154143175,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,4077836128147832941,15937492244154143175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,4077836128147832941,15937492244154143175,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,4077836128147832941,15937492244154143175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,4077836128147832941,15937492244154143175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a12055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD50c705388d79c00418e5c1751159353e3
SHA1aaeafebce5483626ef82813d286511c1f353f861
SHA256697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d
SHA512c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD50d84d1490aa9f725b68407eab8f0030e
SHA183964574467b7422e160af34ef024d1821d6d1c3
SHA25640c09bb0248add089873d1117aadefb46c1b4e23241ba4621f707312de9c829e
SHA512f84552335ff96b5b4841ec26e222c24af79b6d0271d27ad05a9dfcee254a7b9e9019e7fac0def1245a74754fae81f7126499bf1001615073284052aaa949fa00
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3824b58b-4250-462b-b693-073d2432e4c6.tmpFilesize
5KB
MD54db93097cc39704a29a75ff8b4f3f2e7
SHA15d1501aeff4c590039d96373c4cb1f414c057506
SHA256b6702fdd98ad6179c8b79aabdf268e7f9dfef9a930aeb64944d7b43d048c4fdf
SHA512c197ad1fbf393adf170b7d44a536ae20a1b5a4c093f9572e7571ab1897c2bf13ce095098e66f65357b3ad06f45d67f39553f8f1b45822e2fde92fe6cfbd7eb23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5cc91bc2d4bb68c068308c31bf03ac4f5
SHA12a18115b1d168e58308ba6feae6b0422b55f9e81
SHA25692895dcba333b7ce2afe32b2880935195c85faee70e8566f63cac827b3f8fd0e
SHA512123f09515cdad9aa47561c360ad9da1e64d33ba08d57f92ee44e8933d7a7b990cc4c1ff4c16d28798f1d6559e818c038334b47b5b8a32bcfdd8ce36b979adf52
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD591e9b7b192b42407b80951509ead33b7
SHA15067bbe5c8eac5e61977366608172f07deb3d20c
SHA256093874ce67f8945bdf26381856502fe494107bc4b38c38d7defd01bbb36c2014
SHA512099b66876a0149be2792f8304cfa79d64fa448a196be0e8707ff284dbfb64833bed67f25c310e708bac6eddf6e4a5e824fa6c15081b9709a36aaeb20fd7621c4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Temp\g0KrMbdTGQpD.exeFilesize
319KB
MD57a1f2b993b091d9ed52fd2e94d41fe3b
SHA1c040206b382522cb45fab7d08fad6106733e6635
SHA256961238fafa291a25f551ff81737c0144ad647bd83ef1abfe60b1ce8150c8cadb
SHA512e9b2b618bc71dcdb90e99992e198aeb6c626fe331028e4fcd4843257ec9a33ebce98bb7878c3ea79dc596eee92b4e17545505ab24ef25cb9c7df6053b4682309
-
C:\Users\Admin\AppData\Local\Temp\g0KrMbdTGQpD.exeFilesize
666KB
MD5989ae3d195203b323aa2b3adf04e9833
SHA131a45521bc672abcf64e50284ca5d4e6b3687dc8
SHA256d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
SHA512e9d4e6295869f3a456c7ea2850c246d0c22afa65c2dd5161744ee5b3e29e44d9a2d758335f98001cdb348eaa51a71cd441b4ddc12c8d72509388657126e69305
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
409KB
MD54c2bb0618a6eda615c8001d5a7ccd6c0
SHA1c88d2c8bfc5906a5cfef78893d1132edcffd71f0
SHA256abcda524c02f9381d8d43f9ec0079d854db821d77f45e88f50606f46871f81d6
SHA5126abe53339656a023e2a0547f1c2249789c33091d67a21f2e689c6411dc5357e34ec3c65634b6f6955a5023d20803f7c746b13f574bcd84b008abb4a97ea61027
-
C:\Users\Public\Desktop\ᄽ⦬ⷉṔ⿑⤅⧪⎘⤸ໞك₂┡➄ਁᐎᘾހḣಹFilesize
666B
MD5e49f0a8effa6380b4518a8064f6d240b
SHA1ba62ffe370e186b7f980922067ac68613521bd51
SHA2568dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
SHA512de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4
-
\??\pipe\LOCAL\crashpad_1348_AGMUKPCNJOGBSSZYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1376-122-0x0000000000400000-0x00000000005CC000-memory.dmpFilesize
1.8MB
-
memory/1376-299-0x0000000000400000-0x00000000005CC000-memory.dmpFilesize
1.8MB
-
memory/1836-7-0x00000000063A0000-0x00000000063DC000-memory.dmpFilesize
240KB
-
memory/1836-0-0x000000007480E000-0x000000007480F000-memory.dmpFilesize
4KB
-
memory/1836-1-0x0000000000620000-0x000000000068C000-memory.dmpFilesize
432KB
-
memory/1836-2-0x0000000005720000-0x0000000005CC6000-memory.dmpFilesize
5.6MB
-
memory/1836-16-0x0000000074800000-0x0000000074FB1000-memory.dmpFilesize
7.7MB
-
memory/1836-3-0x0000000005170000-0x0000000005202000-memory.dmpFilesize
584KB
-
memory/1836-4-0x0000000074800000-0x0000000074FB1000-memory.dmpFilesize
7.7MB
-
memory/1836-5-0x0000000005210000-0x0000000005276000-memory.dmpFilesize
408KB
-
memory/1836-6-0x00000000056C0000-0x00000000056D2000-memory.dmpFilesize
72KB
-
memory/3168-20-0x0000000074800000-0x0000000074FB1000-memory.dmpFilesize
7.7MB
-
memory/3168-13-0x0000000074800000-0x0000000074FB1000-memory.dmpFilesize
7.7MB
-
memory/3168-14-0x0000000074800000-0x0000000074FB1000-memory.dmpFilesize
7.7MB
-
memory/3168-18-0x0000000006700000-0x000000000670A000-memory.dmpFilesize
40KB
-
memory/3168-19-0x0000000074800000-0x0000000074FB1000-memory.dmpFilesize
7.7MB
-
memory/3168-300-0x0000000074800000-0x0000000074FB1000-memory.dmpFilesize
7.7MB