quasar | de51a9e30c97ce174b36d20b3dcadd6f5b3ed330491413373244813d36e6d3d5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-es
resource tags

arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15/09/2024, 05:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

0e7400b7962021524550a5736d4c568d
SHA1

517654e75ee5ac6581efdebf7ac55ffb4961452f
SHA256

de51a9e30c97ce174b36d20b3dcadd6f5b3ed330491413373244813d36e6d3d5
SHA512

f7ba6f8ee3b4ba0b119691876c1c8db8064dbe72e7dc8225192d6d70ce7f35837a8fed25d168a8d0cb23f53c1034de3eb1e6d3eab5d60b66b40ff10739cebe8d
SSDEEP

49152:CvilL26AaNeWgPhlmVqvMQ7XSKi1RJ6JbR3LoGdM4THHB72eh2NT:CvaL26AaNeWgPhlmVqkQ7XSKi1RJ6L

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

23.84.85.170:3389

23.84.85.170:2032

Mutex

91e4434c-ab59-4a1a-931f-bd0739545abc

Attributes

encryption_key
043DA72868D75E77D6E7D6B34CDE151E7FD08F30
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/2996-1-0x00000000009F0000-0x0000000000D14000-memory.dmp	family_quasar

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{E2F7B01F-983E-4F3A-8F61-60070DF798B7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
1196	msedge.exe
1196	msedge.exe
4088	identity_helper.exe
4088	identity_helper.exe
1016	msedge.exe
1016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	Client-built.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4196	1196	msedge.exe	99
PID 1196 wrote to memory of 4196	1196	msedge.exe	99
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 4352	1196	msedge.exe	100
PID 1196 wrote to memory of 2884	1196	msedge.exe	101
PID 1196 wrote to memory of 2884	1196	msedge.exe	101
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102
PID 1196 wrote to memory of 2940	1196	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\LimitUnblock.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8cb1b46f8,0x7ff8cb1b4708,0x7ff8cb1b4718
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --service-sandbox-type=video_capture --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,542697916055335621,1715360925291472317,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2236

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x320 0x468
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
526a935033fa422439f9793fc689b5b8

SHA1
2908b172b4c8eebfac0b7d5d4cc452b3bad99688

SHA256
d16ae4e1c8ae8710a83333f5c7fc2ed8d16b60cda3c372a91c3afa41ea827772

SHA512
801e343a3fde211976d6594176b860a79460f5cdd740339273e2235e71e2c92a992b3ae400774c601a11c595b69919195096d91d79019421551c7ed23a9976b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
555B

MD5
2040abffbe6f0c54f29b40c00778db02

SHA1
9d18911967e1d704fe9aaca4ca0eb7ba39ae5898

SHA256
f59f0ad260df64ac190c35ea24ce28f5e33329a7db792486b3f7162fea0f9e3d

SHA512
6cd7aa55b504dd166ab5a030e8a51257403640e9ba65e164392585e0dc9fc479c2a1c2313f4eb9d51a4d7672a2006270406482e936047152dfdb77052ac5f6c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
07f7c755ec4810fdee6112a9ccc3af07

SHA1
a33b3c72d5ef5397418b3e35f93234cd5cca327c

SHA256
b782040090f67a1959674eb6148fe0d988f70c6213e93d1597d55324a3ec4745

SHA512
7052d0c8206fcc01178c2f79f7b9c875e0a5c2adf5d08fac4ed3e00622583ed1e947a50ef20f301dafb495aec47a4c5e203dc8daeda8ea6b0a94ba6f386e44d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88ee67b9ca540f7f29dfcc71083dc74c

SHA1
66568caed8a63518e7a6026a5e1f67089c1a6b04

SHA256
4cb3852e307ee2f28ff146076ae5e49a038046190540feaa0298eb5d355b8c18

SHA512
3c3fc3c33b519774a9685cef475cdd6d079e43978b10347d662861692ef89b660e2eaa88779b551e709132e156527c5ddeb353650886d2b9087ff39507e5dc6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d6228963da6e68d5e66f91044b1bf67

SHA1
7f14aa11ddd5f5fc1b971ea059659537fefe5e38

SHA256
414f193aed9354ef149242e02760a3078e18867828dc8d1aab3aac2682835f66

SHA512
1a3e514ba0e0cbaebfa8d4c881d949fac6353757b9a0d3a657cff363f1086613fe73cbd2a4277ac6a94db9a540eef842978d560ee1bcbbc734ef2540d0012857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d033fb91d3f70e33d2656694d906b877

SHA1
40e3799e59979fcce840e6f24164dab088c03d2d

SHA256
e9398877629c57eadca1bf67f01fa86dac65803734283f6d193a17be59287503

SHA512
ffabb5ff983ae443215816370acbb78b166c90df566261f79495a96dd1406822c316aca6668519af03edf664cb3135486150e40faa2e3cf7507f7cd308cabc2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dc08676544d05443584bc82283c547d7

SHA1
4a9e72b30c52e46cd47d69515f094862e46ad1de

SHA256
003606917fcba3be788a93fa25c9dbe9ccc2b3d75190ebaff8cf4088e89603e0

SHA512
d2193c30ff400a0d5ac708c2de367de29b3d9d6693d8d66a7b0e41059939397b5087095380ecfe2b11e82317e20d5d798273e2f6b33e198f9d276a33e1b58521

Download Submit
memory/2996-5-0x00007FF8D01D3000-0x00007FF8D01D5000-memory.dmp

Filesize
8KB

Download
memory/2996-12-0x000000001C960000-0x000000001CA62000-memory.dmp

Filesize
1.0MB

Download
memory/2996-11-0x000000001C800000-0x000000001C84A000-memory.dmp

Filesize
296KB

Download
memory/2996-10-0x000000001C6C0000-0x000000001C6FC000-memory.dmp

Filesize
240KB

Download
memory/2996-9-0x000000001BD10000-0x000000001BD22000-memory.dmp

Filesize
72KB

Download
memory/2996-6-0x00007FF8D01D0000-0x00007FF8D0C91000-memory.dmp

Filesize
10.8MB

Download
memory/2996-0-0x00007FF8D01D3000-0x00007FF8D01D5000-memory.dmp

Filesize
8KB

Download
memory/2996-4-0x000000001BD90000-0x000000001BE42000-memory.dmp

Filesize
712KB

Download
memory/2996-3-0x000000001BC80000-0x000000001BCD0000-memory.dmp

Filesize
320KB

Download
memory/2996-2-0x00007FF8D01D0000-0x00007FF8D0C91000-memory.dmp

Filesize
10.8MB

Download
memory/2996-1-0x00000000009F0000-0x0000000000D14000-memory.dmp

Filesize
3.1MB

Download