Analysis

  • max time kernel
    292s
  • max time network
    299s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 19:57

General

  • Target

    http://sd

Malware Config

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://sd
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfb9946f8,0x7ffbfb994708,0x7ffbfb994718
      2⤵
        PID:2300
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
        2⤵
          PID:1660
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:8
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
          2⤵
            PID:5108
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
            2⤵
              PID:2596
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
              2⤵
                PID:4020
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
                2⤵
                  PID:3620
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
                  2⤵
                    PID:968
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
                    2⤵
                      PID:1164
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
                      2⤵
                        PID:4836
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
                        2⤵
                          PID:1464
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
                          2⤵
                            PID:2968
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3764
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
                            2⤵
                              PID:3412
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
                              2⤵
                                PID:4876
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
                                2⤵
                                  PID:3948
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
                                  2⤵
                                    PID:4464
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
                                    2⤵
                                      PID:1892
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
                                      2⤵
                                        PID:3052
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1712 /prefetch:8
                                        2⤵
                                          PID:2828
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
                                          2⤵
                                            PID:4688
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5344
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7138008362390249038,10323263555897922017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3568
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:3644
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:4544
                                            • C:\Windows\System32\rundll32.exe
                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                              1⤵
                                                PID:5448
                                              • C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe
                                                "C:\Users\Admin\Desktop\Quasar v1.4.1\Quasar.exe"
                                                1⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                PID:3820

                                              Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      d7cb450b1315c63b1d5d89d98ba22da5

                                                      SHA1

                                                      694005cd9e1a4c54e0b83d0598a8a0c089df1556

                                                      SHA256

                                                      38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

                                                      SHA512

                                                      df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      37f660dd4b6ddf23bc37f5c823d1c33a

                                                      SHA1

                                                      1c35538aa307a3e09d15519df6ace99674ae428b

                                                      SHA256

                                                      4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

                                                      SHA512

                                                      807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                      Filesize

                                                      64KB

                                                      MD5

                                                      d6b36c7d4b06f140f860ddc91a4c659c

                                                      SHA1

                                                      ccf16571637b8d3e4c9423688c5bd06167bfb9e9

                                                      SHA256

                                                      34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

                                                      SHA512

                                                      2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                      Filesize

                                                      67KB

                                                      MD5

                                                      fb2f02c107cee2b4f2286d528d23b94e

                                                      SHA1

                                                      d76d6b684b7cfbe340e61734a7c197cc672b1af3

                                                      SHA256

                                                      925dd883d5a2eb44cf1f75e8d71346b98f14c4412a0ea0c350672384a0e83e7a

                                                      SHA512

                                                      be51d371b79f4cc1f860706207d5978d18660bf1dc0ca6706d43ca0375843ec924aa4a8ed44867661a77e3ec85e278c559ab6f6946cba4f43daf3854b838bb82

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                      Filesize

                                                      33KB

                                                      MD5

                                                      e4fb9b839186660b1f729b8df8c994b4

                                                      SHA1

                                                      931792cd70ced4ad586f6329c30c294ebea1548e

                                                      SHA256

                                                      6838611c8ab6539005e11c84ca308158f89a51db57a62caf21faab48bf576177

                                                      SHA512

                                                      625436bb52cbd7df7ed03be05fea52c5d54b6cc15037d70c268d9598e648a22246db902b9c6f097ba8b18bd924f6ab17120736285d54dce13773237f1669853a

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                                      Filesize

                                                      63KB

                                                      MD5

                                                      710d7637cc7e21b62fd3efe6aba1fd27

                                                      SHA1

                                                      8645d6b137064c7b38e10c736724e17787db6cf3

                                                      SHA256

                                                      c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

                                                      SHA512

                                                      19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                                                      Filesize

                                                      19KB

                                                      MD5

                                                      76a3f1e9a452564e0f8dce6c0ee111e8

                                                      SHA1

                                                      11c3d925cbc1a52d53584fd8606f8f713aa59114

                                                      SHA256

                                                      381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

                                                      SHA512

                                                      a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      3KB

                                                      MD5

                                                      86b601651528bb1a0715992cc6742549

                                                      SHA1

                                                      a2563600e218188172bc96cffff215d1d0c92e94

                                                      SHA256

                                                      1603903689bfb847727b4c8e79ba2895c2bf851d8fef2a3b1fee6a37c840bdfb

                                                      SHA512

                                                      784b421b29ee7d54cbb6a6c56cc8e0a9ff227a72971cdbdbfddc86eeeb2294393d60a8bfa4ca6717ed6de390e5c1676bd8ea10e2fe5e8022bd1979c0da36a920

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      941B

                                                      MD5

                                                      466679f4eb169c8ab2dd32ed817f7821

                                                      SHA1

                                                      2736335ee56990dab3edf33a037b853ef76267fc

                                                      SHA256

                                                      a29e76f1d091f3b4f6f3c6931ef71f3385fafa5cc813d556fb9c79d43b1cf77b

                                                      SHA512

                                                      71d44b38a897c6ed904ba0e07a3fb08ebfe0a3131782a6b09af436ef0a243e0008e5a1f2d88015666fcfc722db8a32b5dc8fac8e9b4cdac93a4b914d166d4975

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      9af6c4b0efb5029e4174e23ca1f31e25

                                                      SHA1

                                                      573922758338a0e1b9ed153d2bcfe52a9f9123bc

                                                      SHA256

                                                      0b10dc50ed3693bf4bea5bdbca04a1c2094e6a3e74c28cd4820fbdb11f8b17a2

                                                      SHA512

                                                      20c454474277c6951a5a9a5f9bfa78023c29f83fa320e84e793155a8e1862c5100fea535f99fe9105e40542b1ea83296890fe445524d947d07524aab7a06fbf1

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      52a753d7b2d781656d9fdfe085ef09b9

                                                      SHA1

                                                      ec9884b00246c45a08e7fbb738cc5f2b674144ac

                                                      SHA256

                                                      323d6526402b0571a129feb72bf8b8ae90da3a60f966ca75b838b58db76297a5

                                                      SHA512

                                                      9abfa7cb958cf1044482e9003d2ca08733948e446bb259c6f82f7f4e96947c7141112301e50aa5d25ba7f2d6718e30de24f4799dbbd9bbaa8e8344134926cf4f

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      2234d179f376cbef4e991c7f09a6dccd

                                                      SHA1

                                                      2c226bc535d1ede97088b5f3b8cd3788c41d9a7c

                                                      SHA256

                                                      65311bffcd84ddff258f1d37df1d96cfc091961a7a95c3af645c3617a390ce4c

                                                      SHA512

                                                      dfe8fed80b2595c02dc053052847e55e8d3c1fa71c4a73bb8f25518ed47b07dfd994053090ae8b42652713b393d09bf647f008522ffb1c40b8f51744d2996e37

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      9587238f41ba2c3283aef44c848b13da

                                                      SHA1

                                                      692f5060f184012721b8f531d6ab1226dd4099e4

                                                      SHA256

                                                      06459a4f95efb1616910874ea9246a92bfb330753e51426b1e67e775a05f832e

                                                      SHA512

                                                      65ee2fb03faf919427bca3bad191f6b1af94cb08a774be5248abfe67dadc1effe88161f98f6bd37c86711903861415fc797299e4bd5d430b858a76866d31556a

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      144191159d4116d4c959741701921a8b

                                                      SHA1

                                                      7033c7b4606bfd1d705726c818c7879ff2f6dacc

                                                      SHA256

                                                      023bcbce2146d8f1121c6da6b994c396f4b798ceed56bc15c087d6e93d4be21d

                                                      SHA512

                                                      93b56ff2039b88690aea25fbaaeae2c0301f77f8c9d9f864ba205bd0baded905f190d56fd04296964f0a8ca013bcafb44f11a1927aff7050698ba6b7878868c9

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      ad56433639e6950b454b364f0d889a43

                                                      SHA1

                                                      f56466104e72b260a3c576e86b8ae07f8d6814c2

                                                      SHA256

                                                      5c32cf1e6384bda847fbbf3ec4ded4c86f63b0095d0a31b40a8af42e35ddea8b

                                                      SHA512

                                                      35ab0fbf221c29f20077b7162cedf6e8877167209fdeb0cf6ff2e13f7658a60ef7419113fbd94f886c6b196e1f686c44518ec4760ca873d8209885f318a71c21

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      2168e63e531063f5120557f65e536756

                                                      SHA1

                                                      20597af0f881ed0bf857df30415d8745148da5f1

                                                      SHA256

                                                      743403ecdf88322f16db0310fe499243b85d47c23b027cd8e61c88a9a9597eb4

                                                      SHA512

                                                      13f2c54dbf63cf094e079de52128050b65d0545da0e3c7d4d7432d6ba70c27f52271a4b4bdc4d07009357d71f8e4c029bc0d5da7365672465954b00efaa8bc70

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5843ca.TMP

                                                      Filesize

                                                      538B

                                                      MD5

                                                      0a632137e581b6437dd76f7a9b32f0cc

                                                      SHA1

                                                      3087b840227ad227adb96eab1569c9e89c534dc1

                                                      SHA256

                                                      638fdc0c15080056a5b8ec7bb3810eadef7859b7ea0b01eaade311cf155505c1

                                                      SHA512

                                                      d663766f8c502ffaaea3334126cf221eb50cb74d1809c97010d808038da0df78356138199b48b8cfaf08f6005ca1021581d56139c5045cf95d474e44a20a5d7e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      31ce433bb0b7100413faad0da2854c44

                                                      SHA1

                                                      293612344db72d71e7eb901489f82341ca9f7e3a

                                                      SHA256

                                                      31fdb85d5960ec27a6dd9e0ef1cfb5860538a6299be15c3dd07757af35846bc5

                                                      SHA512

                                                      cd1af86927526b41948397f1792b96b0e8c5e6d6f20d11c1b86bd83a6b9feb00e3eb0caf766bd18d8efc2ed6c0062a3167657c3c1110fbdc2071baadfc98c957

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      7a3e02149f22e9dc62ed4b2e7c1b6b37

                                                      SHA1

                                                      0b33d56357fa8a220ddc0a35ff6e017871b3bbf4

                                                      SHA256

                                                      312f9ebd09666082e2a352e26bb890ea32ecf4f8c53927432438cb3fdec15677

                                                      SHA512

                                                      e444f0ecfa046ca08ee25ab373d51479bce46cda0df75a63ef14d4abf1ef45e3e21e029a89dae7fb37bb50ffab92aae9d9e6718ec907d603a42d8f1433ce4560

                                                    • C:\Users\Admin\Downloads\Unconfirmed 219787.crdownload

                                                      Filesize

                                                      3.3MB

                                                      MD5

                                                      13aa4bf4f5ed1ac503c69470b1ede5c1

                                                      SHA1

                                                      c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00

                                                      SHA256

                                                      4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

                                                      SHA512

                                                      767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d

                                                    • memory/3820-592-0x00000192DE910000-0x00000192DEA48000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/3820-593-0x00000192DEE40000-0x00000192DEE56000-memory.dmp

                                                      Filesize

                                                      88KB

                                                    • memory/3820-594-0x00000192FC1D0000-0x00000192FC4FE000-memory.dmp

                                                      Filesize

                                                      3.2MB