quasar | 4ca77febd10fb2e3a0ebd202ffd7efb798912d80c76ebdbc76b68b7b59de115a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

348KB
MD5

1b3caea7f3034ec10eecb722a369c652
SHA1

7bf564e5695c879a823068f19b9c5b25d9c3ed53
SHA256

4ca77febd10fb2e3a0ebd202ffd7efb798912d80c76ebdbc76b68b7b59de115a
SHA512

96d59d9a0bca26121ea0643840a3c568fb5ee5fa21cb4e6278cb229ad9b34c9445c22f406daa3c8c11f84f30995064612a1e24eff3211878eae2fd5c5b81a646
SSDEEP

6144:9MNHXf500ME3EaGbbJ23fR34sZh85r+UxRXNO:ud50LNqR3nh8l+UxRXNO

Score

10^/10

quasar meedo discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Meedo

2.tcp.eu.ngrok.io:8080

2.tcp.eu.ngrok.io:13677

Mutex

QSR_MUTEX_F7GTMqsQBGCZlMGQ5p

Attributes

encryption_key
U2vyTIQERz1Bf5527M3K
install_name
win.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Runtime
subdirectory
Subdir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1920-1-0x0000000000740000-0x000000000079E000-memory.dmp	family_quasar
behavioral2/files/0x000a000000023b53-12.dat	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	win.exe

Executes dropped EXE 1 IoCs

pid	Process
5048	win.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
16	2.tcp.eu.ngrok.io

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client-built.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2836	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2836	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2128	schtasks.exe
4660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
2372	identity_helper.exe
2372	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	Client-built.exe
Token: SeDebugPrivilege	5048	win.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5048	win.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2128	1920	Client-built.exe	84
PID 1920 wrote to memory of 2128	1920	Client-built.exe	84
PID 1920 wrote to memory of 2128	1920	Client-built.exe	84
PID 1920 wrote to memory of 5048	1920	Client-built.exe	86
PID 1920 wrote to memory of 5048	1920	Client-built.exe	86
PID 1920 wrote to memory of 5048	1920	Client-built.exe	86
PID 5048 wrote to memory of 4660	5048	win.exe	88
PID 5048 wrote to memory of 4660	5048	win.exe	88
PID 5048 wrote to memory of 4660	5048	win.exe	88
PID 5048 wrote to memory of 1076	5048	win.exe	104
PID 5048 wrote to memory of 1076	5048	win.exe	104
PID 1076 wrote to memory of 1532	1076	msedge.exe	105
PID 1076 wrote to memory of 1532	1076	msedge.exe	105
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 3632	1076	msedge.exe	106
PID 1076 wrote to memory of 1344	1076	msedge.exe	107
PID 1076 wrote to memory of 1344	1076	msedge.exe	107
PID 1076 wrote to memory of 5076	1076	msedge.exe	108
PID 1076 wrote to memory of 5076	1076	msedge.exe	108
PID 1076 wrote to memory of 5076	1076	msedge.exe	108
PID 1076 wrote to memory of 5076	1076	msedge.exe	108
PID 1076 wrote to memory of 5076	1076	msedge.exe	108
PID 1076 wrote to memory of 5076	1076	msedge.exe	108
PID 1076 wrote to memory of 5076	1076	msedge.exe	108
PID 1076 wrote to memory of 5076	1076	msedge.exe	108
PID 1076 wrote to memory of 5076	1076	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "Windows Runtime" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Client-built.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2128
- C:\Users\Admin\AppData\Roaming\Subdir\win.exe
  "C:\Users\Admin\AppData\Roaming\Subdir\win.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Windows Runtime" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Subdir\win.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://roblox.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4add46f8,0x7fff4add4708,0x7fff4add4718
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,10804614254819325838,9194159791669147399,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
      4⤵
      PID:3632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,10804614254819325838,9194159791669147399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
      4⤵
      PID:1344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,10804614254819325838,9194159791669147399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10804614254819325838,9194159791669147399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10804614254819325838,9194159791669147399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10804614254819325838,9194159791669147399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,10804614254819325838,9194159791669147399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4036 /prefetch:8
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,10804614254819325838,9194159791669147399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4036 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10804614254819325838,9194159791669147399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10804614254819325838,9194159791669147399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10804614254819325838,9194159791669147399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10804614254819325838,9194159791669147399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
      4⤵
      PID:4224
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /delete /tn "Windows Runtime" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LvkX4LQc6UnD.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4744
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:5096
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
967adc1c06f255759f998b73eada6546

SHA1
87e1d0b6b3e153544b840767f30529d04340a9c6

SHA256
ffcc61c3ef05ecc7bcf51f413179b8b849d212a6f35a0b4eb147b1d671094987

SHA512
00aa0929def5207c90251f310b2b4e3ad1039211e7b8480b2d57713792ed97da701aa975e11a07d9713504da24a537a3690a1c24afad346ef9831d66c5ab3023

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
10b0b3447e575d596e8bc0203c739c9b

SHA1
44f605213974731e7e4d6854c9687840d7cb7e80

SHA256
64e66fa3661d85822e5629a5d4393943687eed35e522121389339fbd2e98bd25

SHA512
b2ba3e28c1be15678284d5cbaea7743eb5ac2f27497949b08d69643c8bb9210a27189dabdc049525f24f2a7c70d38f8272ee3e11c1c598b46df6ad36bacbda4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e58ea3f83460950bf27ee5e3d9f94dc

SHA1
759e487f74349ae861c6f330734c41e9d58a3e1a

SHA256
322d955f0182a18f9cfa48f80860d8c93caaf5a657f33ee34af475d77950dc92

SHA512
5c7dee2c53144e4014b81f2ff4432a0f1498e833a59923a9d66c57ea413828dde334000b26f9f29dd2d7679dafc808c86e2010a3ce8a17f731e0470461d87748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0c0c2e2b6b1b320fcbb59cbc378bc7f7

SHA1
ac14abfcc81913d6e0c8ad59807da2391bd5315c

SHA256
cf4e5830cfb78c1aeb6ce385b95a83a8a97fdb630fc617187a50ad129a64d973

SHA512
da50d29c08aa2617a6fda760fcb1f39e03c0db82c65d89395f0e748cc1ecc8e9de35c63ab08823ecacfcfdc787ecc74946c597bbadfa8f134ed5d5fda2860c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\LvkX4LQc6UnD.bat

Filesize
259B

MD5
ec90a3136d456ae9dc5a4e6053e9c4d6

SHA1
abc806cd87e5c8a3e096ab35e2aa74aff8c1a794

SHA256
9bb146265b84e13fdc6c6419df1d4cc80104180441adc75003c5c086d0ae419a

SHA512
7fa6e95eed009229ff58f18c31fa06d6af66648d8bdfec39565b967439a0381720aefd4570d5326366c7aa95dac6a5ab9a356a0425a7c7baf5cfa89561a9cb7e

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\12-16-~1

Filesize
224B

MD5
418bf365c73a34b5816a49801bddd211

SHA1
a8202fdce60cc9aaf3cb339554c805747104fa09

SHA256
b7913ca247415201d91e87fc2c99141497b386c780c7f069e4d3c9a920efd7e0

SHA512
28c7c41b3aed3b4f1b619ba0e8147cfbf65618b7b6077fc5a270d3d7d185fa5de566211ca0a503c2b8cb4b3acc47a8c2fbdf8f25771ccb765df21f2453625898

Download Submit
C:\Users\Admin\AppData\Roaming\Subdir\win.exe

Filesize
348KB

MD5
1b3caea7f3034ec10eecb722a369c652

SHA1
7bf564e5695c879a823068f19b9c5b25d9c3ed53

SHA256
4ca77febd10fb2e3a0ebd202ffd7efb798912d80c76ebdbc76b68b7b59de115a

SHA512
96d59d9a0bca26121ea0643840a3c568fb5ee5fa21cb4e6278cb229ad9b34c9445c22f406daa3c8c11f84f30995064612a1e24eff3211878eae2fd5c5b81a646

Download Submit
memory/1920-6-0x0000000005EB0000-0x0000000005EC2000-memory.dmp

Filesize
72KB

Download
memory/1920-0-0x000000007541E000-0x000000007541F000-memory.dmp

Filesize
4KB

Download
memory/1920-1-0x0000000000740000-0x000000000079E000-memory.dmp

Filesize
376KB

Download
memory/1920-2-0x0000000005640000-0x0000000005BE4000-memory.dmp

Filesize
5.6MB

Download
memory/1920-14-0x0000000075410000-0x0000000075BC0000-memory.dmp

Filesize
7.7MB

Download
memory/1920-3-0x0000000005090000-0x0000000005122000-memory.dmp

Filesize
584KB

Download
memory/1920-7-0x00000000063F0000-0x000000000642C000-memory.dmp

Filesize
240KB

Download
memory/1920-4-0x0000000075410000-0x0000000075BC0000-memory.dmp

Filesize
7.7MB

Download
memory/1920-5-0x00000000052C0000-0x0000000005326000-memory.dmp

Filesize
408KB

Download
memory/5048-156-0x0000000075410000-0x0000000075BC0000-memory.dmp

Filesize
7.7MB

Download
memory/5048-18-0x0000000006710000-0x000000000671A000-memory.dmp

Filesize
40KB

Download
memory/5048-15-0x0000000075410000-0x0000000075BC0000-memory.dmp

Filesize
7.7MB

Download
memory/5048-16-0x0000000075410000-0x0000000075BC0000-memory.dmp

Filesize
7.7MB

Download
memory/5048-19-0x0000000075410000-0x0000000075BC0000-memory.dmp

Filesize
7.7MB

Download