quasar | hxxps://github[.]com/XZB-1248/Spark[.]git

Analysis

max time kernel
795s
max time network
694s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/XZB-1248/Spark.git

Score

10^/10

quasar discovery spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/1192-2012-0x000002A6E9C80000-0x000002A6E9DB8000-memory.dmp	family_quasar
behavioral1/memory/1192-2013-0x000002A6EA1C0000-0x000002A6EA1D6000-memory.dmp	family_quasar

Legitimate hosting services abused for malware hosting/C2 1 TTPs 16 IoCs

Web Service

T1102

flow	ioc
319	camo.githubusercontent.com
34	camo.githubusercontent.com
37	camo.githubusercontent.com
311	camo.githubusercontent.com
312	camo.githubusercontent.com
315	raw.githubusercontent.com
318	raw.githubusercontent.com
32	camo.githubusercontent.com
33	camo.githubusercontent.com
39	raw.githubusercontent.com
314	raw.githubusercontent.com
313	camo.githubusercontent.com
317	raw.githubusercontent.com
35	camo.githubusercontent.com
36	camo.githubusercontent.com
316	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 66003100000000009759ef6610005155415341527e312e3100004c0009000400efbe9759ae669759fc662e000000113e0200000007000000000000000000000000000000a65021015100750061007300610072002000760031002e0034002e00310000001a000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 66003100000000009759ae6610005155415341527e312e3100004c0009000400efbe9759ae669759ae662e000000103e020000000700000000000000000000000000000026df12005100750061007300610072002e00760031002e0034002e00310000001a000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "7"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Quasar.v1.4.1.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2508	explorer.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
2132	msedge.exe
2132	msedge.exe
2932	identity_helper.exe
2932	identity_helper.exe
4144	msedge.exe
4144	msedge.exe
704	msedge.exe
704	msedge.exe
4948	msedge.exe
4948	msedge.exe
2636	identity_helper.exe
2636	identity_helper.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1192	Quasar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	firefox.exe
Token: SeDebugPrivilege	3976	firefox.exe
Token: SeDebugPrivilege	3976	firefox.exe
Token: SeDebugPrivilege	3976	firefox.exe
Token: SeDebugPrivilege	3976	firefox.exe
Token: SeDebugPrivilege	3976	firefox.exe
Token: SeDebugPrivilege	1192	Quasar.exe
Token: SeDebugPrivilege	3976	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
1160	helppane.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3268	OpenWith.exe
3268	OpenWith.exe
3268	OpenWith.exe
1160	helppane.exe
1160	helppane.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
3976	firefox.exe
2508	explorer.exe
2508	explorer.exe
2508	explorer.exe
2508	explorer.exe
2508	explorer.exe
2508	explorer.exe
2508	explorer.exe
2508	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1580	2132	msedge.exe	84
PID 2132 wrote to memory of 1580	2132	msedge.exe	84
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 2856	2132	msedge.exe	85
PID 2132 wrote to memory of 1624	2132	msedge.exe	86
PID 2132 wrote to memory of 1624	2132	msedge.exe	86
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87
PID 2132 wrote to memory of 3812	2132	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/XZB-1248/Spark.git
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd78c46f8,0x7ffbd78c4708,0x7ffbd78c4718
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,13251926134866721672,10236624926264579431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2080

C:\Users\Admin\Downloads\server_windows_amd64\server_windows_amd64.exe
"C:\Users\Admin\Downloads\server_windows_amd64\server_windows_amd64.exe"
1⤵
PID:3656
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:1156

C:\Users\Admin\Downloads\server_windows_amd64\server_windows_amd64.exe
"C:\Users\Admin\Downloads\server_windows_amd64\server_windows_amd64.exe"
1⤵
PID:2324
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:3560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3268
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\server_windows_amd64\built\windows_i386
  2⤵
  PID:1652

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528882
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffbd78c46f8,0x7ffbd78c4708,0x7ffbd78c4718
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
    3⤵
    PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5052 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1424 /prefetch:1
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1852 /prefetch:1
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4550523102100260248,13649972575507076655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
    3⤵
    PID:4316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:812
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {850fe4ab-7601-41e8-ae04-4ea706d74ffe} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" gpu
    3⤵
    PID:4080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a57d3e8-5294-4c6d-847f-f02cbcfa78a9} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" socket
    3⤵
    - Checks processor information in registry
    PID:3296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3084 -childID 1 -isForBrowser -prefsHandle 3132 -prefMapHandle 2976 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a80b682-fe26-40ea-8fd7-04dd91d7ea68} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" tab
    3⤵
    PID:868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4196 -childID 2 -isForBrowser -prefsHandle 4180 -prefMapHandle 4188 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8b48cac-743e-418c-8074-e2e3c0a89ced} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" tab
    3⤵
    PID:668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4848 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4752 -prefMapHandle 4708 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a4a98d0-204e-432d-a2de-7c0c475623d4} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" utility
    3⤵
    - Checks processor information in registry
    PID:4376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5352 -childID 3 -isForBrowser -prefsHandle 5328 -prefMapHandle 5364 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {392bdf29-dee0-4170-9fe3-6a5116a2533a} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" tab
    3⤵
    PID:2972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 4 -isForBrowser -prefsHandle 5592 -prefMapHandle 5588 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae377635-40ec-4737-8a89-c3acb0ed2759} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" tab
    3⤵
    PID:632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5780 -childID 5 -isForBrowser -prefsHandle 5620 -prefMapHandle 5708 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff43db6f-027e-4296-8d03-d92d5cdac826} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" tab
    3⤵
    PID:3452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4336 -childID 6 -isForBrowser -prefsHandle 4344 -prefMapHandle 4340 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {656e8a9b-1790-436b-8777-9ac427b838da} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" tab
    3⤵
    PID:3564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=940 -childID 7 -isForBrowser -prefsHandle 4540 -prefMapHandle 6048 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cf4de05-e28d-4efb-bd9c-e7b420b4a39d} 3976 "\\.\pipe\gecko-crash-server-pipe.3976" tab
    3⤵
    PID:2320

C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Quasar.exe
"C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Quasar.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1192
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12"
  2⤵
  PID:4780

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2508
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtAddPFX C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12
  2⤵
  PID:616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
58ffc60f16e2cc5f57693a21a9b6bee2

SHA1
1c89779940df6c4fedbb59a99687990c45015266

SHA256
2f591b201f1603f3847d9d992c01d3e365ab99fbd4981dd9fc8b019f004a212f

SHA512
ac31dd656373abb4cb59624f1f68808ec02748a64613c82bc5b6eefe9c1b9c70a28b95174c8bed36e479dfe6c66bb7b9fbd8fa2d018645332f79c69d1895f4d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f22ac1e-507b-4356-931f-26dca2181ed6.tmp

Filesize
6KB

MD5
bf6d55f435f81fb9ac0d14752c68ecab

SHA1
39446c264be3dcbe50c0cd32b982e79413479e8c

SHA256
0a4e7561e25f9dee760bce3a2c3e1b8f96269080a30629c122a58053c85c64b4

SHA512
668bf188b56238387c1db237c7e9aa283d13a33559ea7a144e4a0266dcc477957af4e077b7dabae5748b5d3364d488400866343a6409349d1f6bcc6846ef1aa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
2e72bffbfe948e54f6444a09c61a0c09

SHA1
11f45d49fcd49b3d89d32caeafe1d339a5f9d483

SHA256
eb96c024f4b6e06322e3519575012919b53774090dd73437b43853dbb0164879

SHA512
b4d0ff297c1087c5298cbccf8070950e8a47a805558c7ed2ea6eb24b7b5e94030474ca26b2249cbccb91718e3aaa0ed85de6fe61b63e5ad02c42c47cceb9e375

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
6a0c02876c91a2f27dc7d0e0ce47d7d7

SHA1
5dade9c40600e2529232b19e8343646b931f55ce

SHA256
2eba1a42f1d7216f4f6973b0351b3081157813f15a53e4419ba373d57fa8154f

SHA512
ef53bfdabc984a049da93bc9b4b33c72e49a0ab4951f43ca5ae9c5643173144d222ce59f802df91256ad859f72c1f904e475611d7c91efb10cd61c7d1b132433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
13ed78b665175f4d09c84d8451c0df23

SHA1
0af9748df6a3b92f4510cc4666e79f3c083cd554

SHA256
6cba7d5378736fecf7930fbdf6762a982d1c3135bb0f6ae0b21ce3ffc6bac463

SHA512
3bacd4d532342d5b9b832c23549bbbc1c1ab6e0212e4f9cc2d6e6deeff07e13d3c310821e3295798bc585e3f71ea3d5a2a90c80c5212eab1fcdcb0a27db46348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
6b7dcffa9369ac4356b01e349a89866a

SHA1
4b3ef2e4fa2f0fc7e9826a9b7c276d91717436f1

SHA256
b283b31ac536c4407dd0fca2249da0566c77bd405a35790dc86dc528c2536184

SHA512
be3e72b1447811217102633239b9b9239564356ffb17e273e15a24f2f3edae4fd4ab779a4e2649e120429f360652109ee7965dfd821abbb4ab8f41a0fe86283d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
5e36c9d7b413ef445e2b7e725a1b2216

SHA1
1272b3747be5e624115b211ac2a6b984964114a6

SHA256
8ecb3e20564a95ee0bfe6509efb54ab0d4a3fa6bee3a6cdf71d189178d8964c9

SHA512
883ab76983dc02ce6826b7d8dcb484dcffa3680753513fdba826dd53e1f6291c39a063038213e2e5c5126e0c8af01047bd2b0b4424bffbeea409d80dac187c37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
def0f1f6f6b91f64632df06a72f6918e

SHA1
ade29c7698661cdf7cf9b50b3ae4c98751c5b59b

SHA256
caf2ce5c3c23b787255a76f53e851678e280e250eb61489ff3c482eb7eade4c6

SHA512
9af9ea4ac36ad7a77bd5bb7a6fa18d9191028bff141a7bbd441cd0160d4ea0efa7e66115883795cdb75fb7904e8a162e169572be89df46b3a4501ffcf64213c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ee6de4e6487e3f6f3a942a528d26815e

SHA1
6800d36ceaa4caaa17f682d32a7c831541cd3826

SHA256
3b001022af203c7323a004d5f2868e514cd6fc4e5c57f290c3c97a0c5ec8dcac

SHA512
43c6f2bf3303866cee61356e050cca6e0c000bf7150bef504160c109d059ed6ca089e9009572b88b9c8bdba2d7a03e0f722c792a0bb39db6cf3584d56dd225f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
426876842a937cdc1d1835e8fa404f9f

SHA1
4ce0aa9b64a960f131467a789dfbde9705b06b97

SHA256
0268ef551ba48d4ca903eaf24da89b6b24710fec58e53c9ff2cc0e0bf2c293f5

SHA512
ed2398fef684599bafea6d6688b33ae874afcf1a32f5d158807d4663f1748c7f2aeb5ea3cbd4839a99b70d588f45fda5140cf7ae74e69ab28da229f24f8a1253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
b99038b51f3ea24a944b0ac4e66856d9

SHA1
6bc009d8929728d6bed713af78ff34923ac2a7e3

SHA256
9a84b392c7c4720592e1859fe0bb268cb0dd11e3c07d4ee8231870b758e86e58

SHA512
ba9f254d78c0b7d51c72a14eab571aa83da72212107a44a13124ad3151239402d395a7af899cb4796c2dc169aa43dd4ada8a747813329ff9c4e6668fea8c0a6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
7400426e2be7cdf63d6eb77bb530c4cd

SHA1
824e0bb396c8597d6066406b33b6acc757aa3e09

SHA256
219c9b6321e70022db2c3e1d9854f2b3e4b0d0313a9f0d38441f51af8b937d1e

SHA512
ef735b87a76a92d6dcc2563425bd5ddb9f563f81501befd7c15ab32afb9ba1349bf3d5c2888d42cd214b7c2118e3754ee29f61e5fff7d0a5673d71137e94e6bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
f20d8b1fde0588c9614bcc40f8374efe

SHA1
9d478e6d14bca5987ad2f579b8292f10efa82221

SHA256
da98de6a0ea7d3ea37746ae2d8edb6cfa194e2c2b9381ea5dd2f8ed916c8bda6

SHA512
1b949d640a7d7d9638323a5de13d8f0cfc967dc49fab334922be85813400689e0db8809e0d6a4b2be7b99d1a4d2a93771cc4dcabab2958fbd69be704fcbcb74b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal

Filesize
16KB

MD5
4af76cef7e4686c5388e9e13348bfb59

SHA1
700355ca68ebb0f17c06766b84b74167a005e728

SHA256
1158f31f2550d857f0d344e92868cc95498bc3199a664e7e4e34a72f0e13454f

SHA512
f424fe73145fdf91a3a6fe6793e32b578be3b2b98ed86e861303ce6900067cc8f01d1cc90181635caa418aea6da749e2ff3ad6b2e3e55f87f672b9c158f69b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
36c4b5fe77f1991740b3db1c04946960

SHA1
ad8105d4d174ab0cc895d2e5e9218bb888170c56

SHA256
d9b6eec89bb7b3d31f9f5bfa3f10fbe22158637e2b6ea616f0af896dfcb16034

SHA512
6cd12452634b290fabce3deb4080e1917e54656b7fdaf59609fe0deca0330605cf6ac0bab7ec38389e8077bf066cffef50c08776cf6711139fcdabf9f392ce2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
ae7ef64bf6442e56ea87d3d624633bb9

SHA1
ea1ea86d7b60e649b13fde9da0f9b4123dda6941

SHA256
83e8a0247f731a33c0deb145245c7b0e959f97b4ef118277779ccf4d66712146

SHA512
e0801cc3ec442aa0b59a6264bc221decf0452b4b606682e38f3a5a9e1b10ffb60e0b6eb5f84f248661642e7a5d2b9c1d7997b3c0d3dbd7305297ebcec358d1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
4KB

MD5
8f6866290c4ff1d1ca30862787bf0dc3

SHA1
8df9e8855da55189108d15e2c9bf717424578d36

SHA256
69e79275abf25fe59a3bc45bdb10d4198e69257798b1c8837621a9e9a487e98a

SHA512
966336f3281beea003cc226ecb93a207813c186a495061ca05037cfa1ca35f1634f1ae0118945db3aa18450f33790ea9c5ace485d996efd3d9e90f6c2f6271ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Filesize
44KB

MD5
6a0921775a079c4e644386fd4f0392a5

SHA1
eb24384121a944fcfe7b9b479d7f1fe346f06db1

SHA256
7658251598ad48a245e924d21fc0655670bcc2437fc948a3056bfce7e589025a

SHA512
ae86bf0a540b68976ad9ee6a5c8ec7d6d9893addb8365fa81b301fd7e6746118bbfb7f0d9368ed28e92af887c82bce20b1bf6640af8122b16b61e135b959eea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
11KB

MD5
c0ad1e62a951b9f9ba9aee8a6218acf2

SHA1
66a4067efea0e79dd2419dc2017311f82a3b72f3

SHA256
e12a0c9f6f40ab02b7c9262e942aa4b7bbb6d38bd4f2418998a8316562029d9c

SHA512
279b374dabb0f409b3201658af504be825519a5209dc54004af3777010a926ca492ff1c5527d26d1e9d90ac44e89a010abf4de763d7fafa70eff1d6eff783230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
8e6960bef148df0fcddf0f18d98979c1

SHA1
89999a8a31546d673bc3388cfde5efd8d4d18000

SHA256
efecd176e7d89b1562744d5bb47dd09becc2b7d889387435ac00713ae9d2f585

SHA512
4bb57e23d6d6f7c0ff9dbc52975155c98109440793cd6c4368601e340cd7a1cfef501dd6762c9ec22fe257422a091fc96bed82099d618946812df4e4d9ef41ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
580B

MD5
cf858e2ba66937a4f7f3abc6bfc5addf

SHA1
9a1dc4527709740569ba2e07d8f924f78b276c33

SHA256
d508dc5fc11333e1cd9b478d9baf5b987097790a2348582d6edb571477c38241

SHA512
60cc7736f18a89eff33c217f5e3a6a02c040c4fe1504463548047650f8e4665190a5523b236d7f3d50a83e97b03530cb74733d03a1129f354adc78b17dce3e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e2f53f70f450f0ef45dc3b7d8acf2b4d

SHA1
c5b090778115c3a75bebf7b3726de28475801000

SHA256
d645f3fea6afc231b5f130e86746994295c9286608ec2f63ed37054ad0319f35

SHA512
677fc76e95aaacdf83624dfa9192a086dad956c568f3c765d0256dcbec0cb552461adb68c4c9225fd4bc0c0b7e53df17c67c8633bcc42b9532ba1fbff0cd6eaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
313ee5d0a32bec79e466202824785004

SHA1
d15fa8b7891056d93eeabbb12b3dc9b2a0a42e6d

SHA256
972aee0715ebdd8743c920bfa6f804cb9d054e5c348488d1808011792bfc8604

SHA512
48291270e83cb83f6ae249bda3995228b6609ff49a53183ec71e1f56c133fdc75f20500f44af4ef3b7322947656d329c7c78af063fd91fb8535090c793b7ecde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7ec85a9bbddbb538bb4c4799e22a2f88

SHA1
5a88486eb63d240444e22658a57c569378f2873c

SHA256
e07fec21f82ece0dc5dac1dcf0a9bc46bdd3fe8c02399297820437914d891498

SHA512
410a70e2dd35895f896497d5f18ec00b205826b9ff0787db6ab2a98c56c38041009093ba122f7576319645aed2769c74f1e33aa5c3c138c3e17b0df25e2febb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
336dc105005a406e7c634cd3de1ca7d2

SHA1
c8a83247341d1891d8e1d3edd3af87535d45d8f5

SHA256
b871dfa1157a4dde1d2995aafd99cbe32377fece3f83f4419b9e8d43543ad058

SHA512
c3bff4aa0fbaba823d563fbf21ba508da5d4ed0ab1de016ea160217e7b9dd7c1c15de00ed65742ed1e200a8f6ca8ddf0b92680e6b3041e76c6363297b8d4a941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ec22276fecb02e9a590d6fc6d44d8609

SHA1
d3377872b1f85402a05249891bb9ce639ebc126b

SHA256
8762090320cfce78f5df32cd5faac12ff2dd27b78fd1fe18b038dae0a59600b4

SHA512
771cf5bfa2d2fdb83d1fc2d09a834485b11017cb09331d6bc122d960ced4674f1723606ddc06c6c40a62469b84ae06c30cfba96e607ae0b5df173cf35a519845

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fd8aa118f8570c59e22c86088efa8925

SHA1
b12017c6ceeb680042f24350149357503be261f1

SHA256
52bc4d373bbeddab9f9ac9154326c79fed7d3383a6d86e82b1aaeacbe8a1825a

SHA512
bafb55daf11f67dd89c6e0d5221fcee246a0e8c77dbb2aa3d7f4c465b06dd7a04cd57bafc5a17cf0190550a48272c0cb1d32d59ee7d2631a4f99a21e0151cace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29262911e049ea135161d1a0f2046341

SHA1
7a2927ff6dedb3501fc83812b0e6a1a28502244f

SHA256
91b3c6d51f415f647c75ab6777dc9c9b0b38e5b3eaeec9e8bc0da4e8c9f25694

SHA512
15e41f6f0b727d6439e3dc45fa2fd1969f4d92d4ba2410dc780b3c2436a7fa327d2e9208b5212e7826e85ba972fec47a4207c7e1405a63a721eacf3ea46abaa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
340c8531ecad14e1d29be9f9572fdde1

SHA1
c0d659142fc078b27ae3e7df3681665ae3335f26

SHA256
47beef2311065b4bc6490c44dedd19ab913671dfc12b585a572891bdfb49f6b5

SHA512
9a83bba7a112e0fe0a062b97155fd0950d1e059fdc5ffc02c89cbd26e04ae2117bd6b4ac6f37e1f0e4e47b8db8ae80d406ed37d7c4ffbcc75033390ab941e0db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3041b36f38823cf5b994e9d703a0157d

SHA1
e47cf73d4c6f75e78aeff321514b0a413ad3fcdb

SHA256
4ec8980d2c4239b49d09c878488e765ee82d6ec9a183b00fd05144fc2ebd56ed

SHA512
b55dc558e8e6962bca1170fc0e5ae426615d334f7aa5e8482cfe2a88afbac24f11f0002b74c4ffacf56d2b0995c05c9ce68b5508681179de6a886721419b63b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b877331ea0c7262a6a5bd790b3b454c4

SHA1
115bebca457ef3150733a713f9009f90180532dc

SHA256
d4d42818022add5d099465f8c5d3ac7ca0886caaf13385b58f6b1e34c33134fc

SHA512
4ac1ba93a9d87e23e54cb48c094cbeb532928ddcc58c6fde7ee3893a6f6619a1e501f41c69a81519c1e41de05a52679832ecacb7cdfc8772f79b99d1bd8506b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
44f5e404f1eca0f4468b823854e93b94

SHA1
1078d95fa8dbf44de13d6ef8180be50adaed4224

SHA256
cd07bf802e81a4b818852d16436e1d1dc08159096988755ba68aee5dfe03dce3

SHA512
d8352219d99cfcde6fc06c7d6bee0a7dd021ca0a8c13413700e69b19e208fbcc61a62f1564357c0c39b1dc49fea26e5eb9c065fd11e42030017a39a2da0a2c2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Filesize
33B

MD5
2b432fef211c69c745aca86de4f8e4ab

SHA1
4b92da8d4c0188cf2409500adcd2200444a82fcc

SHA256
42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de

SHA512
948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
802B

MD5
3136b1386439bd2d09fb14fdbb0b1d52

SHA1
b847df67c55988cc119d467d25f22647eb296198

SHA256
11b3df319f2fe7253846092169687a8481b071900504c79cf7db1bd27e0b03fa

SHA512
5f01bb70e07c05a6ae3ef8a3ff9e2bbaa119f2f0dbd383dacb40fe0a9b3510c1a5b77fc5213c37068df6cbef97f653ee81519b6dea1be63fc77ba77b3958ff29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
322B

MD5
0d5edd2e44af2ad9768571efafbeafd1

SHA1
d77d13815791ce0e1038b0ca0878cea0235b2211

SHA256
41a99c23652e1d98d81eb9acc3a760a91b14464ca6723aa0c68ff1be4c20467d

SHA512
de6b85390df27b4ce5e157a125168e4fe7c03656600c2cf3038c5ce5d90b3e6825a5e769ff15fc2fa50cba565021d2e511b998ab8b1db7de95ce24c7036871df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13379431428061941

Filesize
25KB

MD5
03ad8decb826bee1430aa39bcb3a387c

SHA1
5af482155b7e82e1e70278291e730335e0d72a26

SHA256
9842ff91eb16eef088574aaa383805e17c0d5ccc9f4373ca48b1b6d55fa172d8

SHA512
7479cf4c6bdddd0a2b1adec1c10524823f59dd982c46544cf3c217e4ad7f6f019b5e1324de4302678991e7898e06c4fc9406640ce98ab609ddcb42dc4f9d9471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13379431428280941

Filesize
6KB

MD5
a21a8ba3d25a19eca69ae98548f2dc71

SHA1
4d7ab08fc6d942963c0aef162d75ca34e80d0a1a

SHA256
872b12e3b14860822b07802530254c35812c6b8a0ff14371b46181bc78653901

SHA512
b9d2a1d964045a8038d061ae48451ce534074126f4283af7438aca0790afe90e0ff17a52c432964f89f2e4f2bb70203983fa685a2badc3aa98bc83f347670684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
212a9eaa0e28eab335aab71d8b82ea5d

SHA1
f29b0adf74eb37233b1e40fb5f6cf49d2c7648a1

SHA256
b7470594632b82dc0fb8f701d685c426eaf5a81aead9cbf0eb9d85a7875f856d

SHA512
88bc18abc887543a8d4b945b3ceb13bacc134886b65780e4bd7d2b244839f348ee3804c7200b8f3eebdb13d2ed1db49627b6ee1ad7c3138cd46e0714b65c9680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
69477a71ca57ac3d7f1172bc5a0f2621

SHA1
fa84052dff79415b51efeb3dd064d964beca27c2

SHA256
883311876d6ca54868894c220a0f760c6e88adffba7e14e08250408cb8dacb02

SHA512
1990f39442f44a78e1cca754298ba7902d536b809960a43407577858f5ca182f01fb86eec32548feec619b7710128c26dc3b968eee3f8b636994616584ab23f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
d924f2dfc3679df9fd8cf4ed52355728

SHA1
fbad34c484c63058ec20480e14f05b521e408fed

SHA256
a090004e516edce89d72461a446238a4561f33a33126ebd21f778b372877aa0d

SHA512
60441f8597ffefbd07fe0e37c1e25d2f013c6b5402f41f84dbdba0e7ce0b8adc624c87d7d2650ac376bf8bc124145f781eb1792987b2be214e79e7e149989d5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e4563faab93115cac2141f9dcacfe8c6

SHA1
89106845f6ee11d6a98b9c6fb442df03fb88ac54

SHA256
5ca6874f7b8f8a298012df1558e6ebfc1a40b82030b1ab6bd6d98e8fa77245ba

SHA512
53d5f1938811a90116873cf7d91e0a779b7ba71c7113aca1e28f109478681db4fdb50fde2b7a0fa930a60188295c1047c0beea1f0cdabf1f7644ba3e5eaa2ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
501ca86cfdce285dafe46f13ab958352

SHA1
eb428d5c388c8a2b1ecf023451aa432b46edce90

SHA256
f507077bf9ea0ba8470f45eba949e24d1a28183d41aa70ae23f9de3ab92175ab

SHA512
462b6194eb00fffa229b515b80ebe34e3e2bb9646fe4b2decb54dd984624bee7a7d07ff9eed7e7c46e71a78e2de117012d9c93b094a177216cf716b3c2e3ab97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
63b7472b86be66b0518e0bcf3c4828ba

SHA1
a259b4beca32f486f3a01588dccf219c8cf28f81

SHA256
f93ca63acaa4280ec81cf1c7a606c247cddeb9c6b3e779fcf4dc1918c7c486f3

SHA512
6d808e0d21f910f8f1265716f467579b77c7018ef899ce466cc3ff40d4cc6c580affb12c6f708ad076a76f6623d70ea90a4d2c98070edac1782f061db2997db9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f0058819bb01b8a8137eee05cbf81cc1

SHA1
3438dde2244a26d6ac0fd51e1bbc9a82b2e66809

SHA256
fcd0679f080e6ace1da9c5102ebc7aef68a4ddcab7862692c28d6847de8b38d9

SHA512
f581489d93bb3b33db91b86b4a2f4a7f5c2c3fa7606dd956b28ab2811afeb798a2e9caf81accb34170424763ee916caab5ee3caaf20d6a2a82ee264dee60b364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5822a6.TMP

Filesize
1KB

MD5
9e0df49df581d934e43bdfcd19070e1e

SHA1
a308d394a9970c5040a105ad8a3759c12e394203

SHA256
2605b0109334ae690b2b64e2a65cb3bd75fe7068fe4b416a67d9464037b64db8

SHA512
8c20fc4818da60687f990979c8a87a3e9d2037ee1da6e0404a00a524467fa7e2624f8d432460b47bf4f1f767077d7bc4ff8e2aad7568dc0af58b951c55aee444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
c6f3f0c28fc6d343ba333b7438c293b7

SHA1
e17ab934244836e8e6b45ede04096afb09c461f6

SHA256
cf9f8e32fc6fad275b7f294059e31a6b82fb150fd155767396b98fe3450b11ca

SHA512
b30cc5654e54d9c0ed3ccf43025f7bdf26a05a0ec48cee4690cdf80c3949c5491007404902b59bab7ea29d643c3da7d178687ebdf4ab3c4962622d26cbefff7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d6f45e6a-dfb1-4027-b13f-ba8ad7f02c79.tmp

Filesize
5KB

MD5
b7305569edbedd199b423be19451cccc

SHA1
900969a52e3401d8ab0e0932b8f955a9a0984b72

SHA256
e889fa30ce3d04caab96cf38bc0c393cfd39cc612f1e4a800d03e2fa680e04a4

SHA512
0550b8a936b8ae9407d2957a7375b0b68c8b51b8f5867848caf8cfae45a52a939d82a66fa22eb58e4e93f05aa55bc3f97a894637f1060839106b2a3a3ce0d1bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG

Filesize
198B

MD5
dd4f03efa63d977c1bb98e9b61c8f4f0

SHA1
7448b1539882e8a31e4fa4b575007fd0713310a0

SHA256
fad452c9503a149c02c92e3328626fea5f77b08a9e693f0da213024bfd9ead3d

SHA512
8e07c57d459ea774171c3f40c3715deea2f6448f8810b4960e03421055c02883c34b9f7ed237d293ac3b31986ebe46272c08bb27e4755066a3271fede7c3fd8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
72KB

MD5
ad3e4edbc8f8426f580ec14e7e811727

SHA1
60ec975932e7346cfbb807ccbba3d45cb80651b1

SHA256
735527fdb6c24cc06b58a138e4929b5df15d29915087044a98e584d09284b90e

SHA512
a6b191a7f106eeac533f8439241012ae45c33ec35f5073a457da3cbd604e80563f567921d6eb6391f177cd5a38a324442f3bb31d353d860e77dea228d2c2f594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
24KB

MD5
ea32e0ff11d6761f410e029bc98b438d

SHA1
24cf85c374703edb875b58a8a3741857cc983ba4

SHA256
aea5f2cec964921b07f0889c9c51d45b4ecca9e1be21bfbcb13eabb37f9a610e

SHA512
d413ef47a05e40007f5d16067961e71b5a04506267cfdb6fe2d21da6beb777c9b3928b481568ac203842c557d8857e266220ebb6a33078eb79657198a9c2008c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
ee97e2ae46e405587c80936a03b2d13d

SHA1
deafa25a5ec2024700d1db59b353418ad3bd54f4

SHA256
6ec2ade51a75c0b1b539c54bb249ea85abe9921a992af7d23ca87a68a8d642a5

SHA512
56afe6eaf25b439f6498ffff3938d3f1bf3e2dfbeb9e73191d42372b59d50cb124857ad9f52adfe922206cc96fed878d86481646e7463ff188ea7624e56774a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
594B

MD5
d52c82a5a2054b92dd288394b17d7b12

SHA1
b78d60a0786903b2ab5840064f9b7b78bdc2c1a8

SHA256
4160266a07b3fe61f71517246ae47c41e72f6541b97b4d6f9533fd8871a800ba

SHA512
9b7f7e61672d3c1566c0e56bd8622f89c51048d2974622e58c2c27824cfd9e6ae9a4f3c707c19b4988339293a33b1e4dab71b5547a395b98e83815452d0fb1a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
78c5b95e280bc0b3a4aedec9ba20a3cc

SHA1
bab84311418db0b185a58a76a327a2ddd99680e0

SHA256
fab1b1fd3eba6d978c8bda836699c64e98f6cc81e343f198bd466e3b9731bafd

SHA512
1de03313274afc05efdd48469d24b7ce30c10ee104c4574c276592e39a183efff6972ef661924d5084df3d08739f42e27a0ece2fed5529f72ff04971c8c3805b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
8501bcd5bdf0c20c6298a0d6475fb2d3

SHA1
ccf37649383e11a194a7ed05fa5ed4c413c6a841

SHA256
3ad81fd86ac88c0021f9d468171489c68ea598b09382c8c1fb77cb69c7d53d64

SHA512
39e3a9d7f123cb963fc6a904a80806d03ff5b3452c8aaa58939e8cfed6f51b487e0588e958b2b55032efcf1f6d645ea8f63f29e274eb1c9dfdcdec0dee3807b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
b8fec790d265332e1f4619b76f174a6a

SHA1
48e344c91ff8b619d127d07e2450f578d8bf6009

SHA256
3bd5d5352ee43db0c92826f713070f2018dd1bbf693882e68641a30b79238af3

SHA512
8742628004f1a8914f242b7d8d01a70752d6f75a4dc35e6a59b44cf3b74b496b03b24d4105ad9d8d28c6066cea0f04f2c9fb26e0c4df260cd1cebaf5d7d2210f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
4131c5dd311db5676ea1b24ecdf7303a

SHA1
7f7371f9843becbe2456f734f87de573a792873d

SHA256
2e1d24f0792abd41f1b5283c2405be9d5444deb5c0b0d78af408138d70536142

SHA512
e440b4c7ab1407f6e7aef2c37abe58cdd117f23dbf4165bf3734fa66615f636f633ecb81bfc21887df0708db3615b38ad08ff47c5bc8575cdfefbdddcd079b5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
afcef0bbec99d139d009013037624b4d

SHA1
0c25f3b77455cc16b96b048d3d8189d27968d8f1

SHA256
5eae7f64a57b390ccf836b1e2728b84f5204d9cbdbc3d9ca7878349c94a74995

SHA512
0e44a917934412ab5f9eb09f311a9840f509a2af8c7ccea8a692df52eb19738248292c3d01045871ef6e1c90d8e5a7984d2f53a6b426405f09ee47e852b6710d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f04493a19e51bce3661c376f780c965b

SHA1
537227f7e5490c0b7a2011d74a61f57e71073fe7

SHA256
3cbe545f98896d1704b4175738034f6a4dc433e459640a89ed32651e5531ecf3

SHA512
9dfba794bf37e405dfae920ff2e746bdffdbb37d056d583dda38fec8b5b45fd42fde021a751b7f515ef50a2e1f5c299a99ebb946e232e65165fef273174acaba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
8248739a62b0949ea9cf2abaa98602ce

SHA1
7efdda1a1f622fe2be0e47a9668d804d1c2f9075

SHA256
fd8b3f498154ffb14de743dbd90e53a7dfaecaefee0e9f9fc987a737278ae967

SHA512
a2a3e1fbd1294fa677834aca971b514c3ef7ea1b78923bc09ad96e1f03ad550763117c52fbf7686f863191c56646d8fe38b6707597e3a16ba26e65450efc7bd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
6ddef3181235e0ecefb3a9ff41d46e9f

SHA1
42dcc7c713e9e62fbfc3e8ddbe449de6e4e92a59

SHA256
f17789883cd20e2edebd3970df0ddc896cbcac1e0ca33fe64266206e1d382f10

SHA512
d7ea0a222411a4de46c157880e1a954708606866215c6c88d91f8056801c92d4add16b45b768c1a60bff43ecea5b2599b8098d1b06784ac9035032dd68765f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dcbd002b-c00f-4ae2-8b9f-6e50c4fcd4ef.tmp

Filesize
11KB

MD5
bce7e0274fdcad567f36fe9b570e74bd

SHA1
b0568289f37fea7839a81a4e5ef2986e8e173f80

SHA256
87a40dcc9ba548a15d62f551383103412218a6533fbb48e9a7e1bbb387f6188a

SHA512
476ce2bdd114d73fe59e6139611a19fad614fd3e91ee5f4230f5151785af7d76d3167f36477c9be2d416f119f78535aa9a82fdae0b00e3ee23313d5a4584f720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
9406efb8585f4c68700426f94887d39b

SHA1
8a01aae3938096d1a680e96f9a3cfb73ef99b03c

SHA256
1abb8f9f07198cf1adda116de68a2fa1ef1c136bf0a38d25d0d9289264a51106

SHA512
5701f0a0065e87325136c9d90fdc21324dbde27a49d434acc2bf09141eb54ca79fad60dfb79889e5a13dd935ae1b8ce8e2fb9f4396c27a8840e1e0416769addf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
3a29e79517defea5abafa5202583cab9

SHA1
20dd8c12fa3cc5b14e1f8434283b611a4f0a7d31

SHA256
6b184c4339c806d6ca1f5e7c5f9b16277ed254bc463c679ec77f6f1319908030

SHA512
5d32cae8fabd1f11c49f7c4c1a5940f4764f5b1019c2272d567fbafda388c0de08cd231cdc1fa32146eee626023117ca4e34d2f7a1cab75d9967db2c36ae8ff6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
603f006904cec3a12b2f0697b13074a0

SHA1
61196e53d1a712825c7ce414b62730de3f4224f3

SHA256
1dd5be3bfd762ada17524d5f2cfacf3ebab4f082396777e29f7f32837c1366d3

SHA512
0197cb0260c690e17c6357549931821d62269f7968c0862419951946004015ee068c32074538ec02c9945969e0d310e56926bdb9d38a5503ca428fec6ad1a8a3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\35E25671471609E16A4B568035D2BAA3C9640044

Filesize
50KB

MD5
159b37ee4a4e1bba69de89dab120316b

SHA1
011a9785efe862407ad5f8826600d87b71a3db75

SHA256
8b0f9a61d4eb58d6e691e342cd3c692cce6f0ca36d13053e16415ed15a232629

SHA512
ed390da47456ab35c67abe7ac473e568d21db2ad46b746c8049f30a8bf1fedb314de833ffb5e590692324f897831eede88b562cc4f8131dff69d977b09cc1306

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\549C94847E35BE89DCE95DF86EA39378F22E5078

Filesize
99KB

MD5
a471a20829e0e1e674690f7b7ae670d4

SHA1
6a5c2afaad0428f3b376e42778aff9eb54592388

SHA256
bbb5e7eece4d382585739ec081eaf324b6a7e63651302711b75a2cc8158ab585

SHA512
200a7cf121fbb9e6f3b9e3b597cc0947a4398fdaa5ef2ae12cf7e19ebf9a232bda01aa80920d6d5ec7ae4991fc9a4cd1b4d4e6b37baa0f80748b524df9da0045

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\5D9B93E3823729AAC6832E3AC8763733C9BEF7DA

Filesize
28KB

MD5
e583698f340e265e0a3ea0bcfbfbeeaf

SHA1
1e6f2766083f43a6a22cbd369866dd65a813a376

SHA256
46780110ceeef5663834b6664db8ba2d89a9017b0bfb2b16baf78236ad0f2065

SHA512
65ed07b65ff04f5c1942096613434e8b505ce0615c095f4724843535dd37ae8471ac5e14a099f75f0924e42c7eda5c4f2e9889617fffd5047bce9fca811ccc1d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\643973A72CB665816E627CECAEEAC7166A356FB8

Filesize
114KB

MD5
d93f29876f59f53b21a22d103e0a1eae

SHA1
672490eaded38b4a3a127e89028e2d40469af5ff

SHA256
2d493682109605afce8d5da850b7a291cc642f6eb9ea0ec6e9209c879f6a8f25

SHA512
e0277b35761937a6c4bcdddfad0d1352617521d858a526e88e2f5c24ece697226ddacc4af051d07e86a1e5fff28950d51b00dcf179620c165d5d6442d931cd17

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\6CB8DA195B83F1EE369C11A33C63581DBAD64D6E

Filesize
96KB

MD5
9f889cffe66ba2959d7babf1c39aff5a

SHA1
9276d7d58cddec21761ca56e10fb248e1339aafb

SHA256
67f1bd05a22a858469d0f45fd40b6e7f11da968f528458897b44913a3b95baab

SHA512
7199230cf5dfba2026e3416719768c94e72452bd80b4adadd4cae21de83832faf4a5d06e7cec8a8746a4b0c1d79e48306f89b41b8fcf6bbb14dc4f61b5fb8a8b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\D94A678A2549B8A6C46FD1D1E3BF56749C7D416E

Filesize
28KB

MD5
68696384f2344b1e9f0cd1aef76e1676

SHA1
24c569a588d5e7b3c02dc7eece2acc5954d93fe5

SHA256
a0bb3b0691f0ea29c2fcd3be178140f20a585ea71b02dfe2d8631486fd69cb5a

SHA512
68d767b3570533dc42590d4b68e0e0321992689b20d691eb275311ce71645b44d0292e7e7022d7503bd4ad9cb819bedadb1cdf5a8ca193bb57ab55029d7f73b7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\DF456E58304C9DAD83ED69C2CA536AC36867EEA1

Filesize
116KB

MD5
9cafc97d06da780329900bd540b7f063

SHA1
78e2a1d5feefe39811f4af3e9d892905b2e28f80

SHA256
8b0cef65383893571ea4e980c0fd68b5373830086c60230688f0e0cc5c7c7259

SHA512
e3132969e861c807b0f73ed297898467652db5ae085501ee940272af7e3025da89d4b861deb17c0daf9445f7861584c604df7dc2ddf29f925c86b76b99dd2099

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\EAF17210F28F22D6EBC808C2C1515A0B71A3E8BA

Filesize
163KB

MD5
dfdfe10cf476d6221c5343db99852147

SHA1
04a24483b62bf82318c7b0ea585be052c3689bee

SHA256
99c989f2b83cccecdaf9fbb00573686a5524478a149ac8d08a5e56a9c816c827

SHA512
32335e85f3bc5cf4d81e50ffc47c262958c382baa9b3055254dbf0cc9e5fea469faf970f616c92944ac59775c514f8982603113b6a163c1b0647e638bc176c04

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\F7238E2D6FD33D777BA92C46B87D7C03780BB3E7

Filesize
63KB

MD5
712f294512c9a74e52dd12fa6cca4314

SHA1
22d91d926f90f40f60ab529b96ceffdc28ca6013

SHA256
dc3db18f22455e824bd364ed15637f77654ff7faaecdf32a141131eca6c72a9c

SHA512
ef32697607b5a4fb934267bb51797713659bac32752bcef78b739dcf15e7e5540fc80dc53072583656c81fa7c3fe3a2a3d9cddd6c970a2949efba1fbcced6e2b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ARPVRYTVOVTOWAS06GDQ.temp

Filesize
20KB

MD5
d93db47d35106415e807d66fad269507

SHA1
3eefa0312fec4255b9fae18f3b85e0b6466a4073

SHA256
559176a0306a63f2425b8be372efae7d50fc6a65cd5dc0710571e6715630f20b

SHA512
7942bd5b7bb2d3571d489cb1236fe7bf7d06351ddea3c7f45a6de2367653ec5f7fb9d8d0f94bacf300f7c58601dea88feeb6a3d1cecb2c282ddb2737b7c0cf69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin

Filesize
6KB

MD5
b1eca959eded60a9141a89cf69f50988

SHA1
cb234354cbe0e349f6eadcf937cae9a1a42f4279

SHA256
eaf70d7597358af24872b9040a92d3540f9e77011c2e1a26c58b661f0df621bd

SHA512
57df9eb1b194ef2f17beea5b7b511db08c36d5e0d19cba77b3970b034d7cbced5e749b4a3702102e80db3824cc6cb00235670ffd202ea6ffbf52be7ac22cb4df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin

Filesize
11KB

MD5
22afce6040d3a573372cadfaa06a04b5

SHA1
0edd35771b0dcfdf9a17ce552de0136a3d7e2cb4

SHA256
6aba56caefe2b0bd2da196351ac293ffc086552675a4bec8bbca2a32133bbbef

SHA512
5076f07bd93edf8da5e0607760b44e2e3840eb934eb48fd33681b53133d848ef9e1b5ecb22ac471f87496de205b5a6d88068f4e6bfd8abc53310b0cde3cb0216

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
3KB

MD5
7a1b2ef8a4bda93466ad4baa4d6cbd5c

SHA1
5b34b2b35979eaf1d7018605ea658aa75f4ea2b7

SHA256
9965d69ec09281d8f6db39c3f0a073c9c3364744c3aa95a682b69b45c93315b4

SHA512
407f86de9b4f3d81c636f21786beed39a3804dcd7a23ecc2bb95f5a003a7b086d500d6ec29848b041571902a874d5f0279abd4a1613361aa1be9cf8581c0e2ed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
f96c90d067f2f6a42816f3b57ba0c4b5

SHA1
34ea8dc4493763534f82a3fe6edaf1d9a0bfa065

SHA256
132fb4a1c1b2e6f2733a4aaaedac6023e0d6465bc880d4b5a713adcd570de238

SHA512
474bde949c8960fa64fef3bcb3795a91279f47d232790e80465b8d0cbd6d83a7796c762d4c594da8ca1db8e556c7378bb8c6d52f35916394c64f725f37c6e21a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
a336a849d56db149cddfb6509a611dc5

SHA1
e317bcada2c70e9363ed0d611908debe5322508a

SHA256
5385f83237503d9823638fb170b392547ff2546dfb2a6ade75dd163ea0011bc9

SHA512
b1f5b28cd373ac4301a0ad0c4325a8c4d0324fd55f4877454818491d23902febe48a4c2f29f35f43083cb5529a950c54285264ba7b8b2f6ee5adc65446d74271

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
54KB

MD5
90cce18f8202ee07b1cf9dd0a21f2a92

SHA1
ec4547cef3d07315cb032a47527b2610211c8792

SHA256
db6ab0ab1efe400fb7ab1ea347fdc26efc3655f42101ebb9ae4103390eb96e1b

SHA512
e2a8fc160effc68c95ace240e0fa0618af3df41ea30981d953b808f010584be7c5e0f6477e98fa0cc1835794aa02df2a98b77799ae59278eb6887544de03f42a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
38KB

MD5
0c515085c5bc8277fbcd02d7c697b76a

SHA1
eaf64da9f81b19d02482c6460f07734a5f8ed1ea

SHA256
e0a942b8231eb92b6741a0e5f7e85f6ee7032ef75ea645e7b46fcb1b43de683c

SHA512
a3a7094a261f502d932ef15148d505bbbc7dfd89e1baaab395eebcf668e78f46cb5eb39aa09880ce4e606bbe19249c8d547db24399d24dee1814c5d1e48396d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
5068302530484fdb6d91634140e659d8

SHA1
bda72f230fdf109bb9a1d58158f58413f23e38e2

SHA256
b0fb42cbdc38d90f32ac330502d3458f10c39175caac2d8a09880133310dcff5

SHA512
8b2a97d58c78d08a4dfad9e39593e9a7c338509502233f94bd3fb32f9a218e72f577341e6db4c9a12ac83dd0db28ee7f19de2ca0a0c790d4f93f30104d55ee3b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\246b6ba5-c20d-4331-826e-0352695436d2

Filesize
671B

MD5
d062afebde7daa0c09db3c87aaa24927

SHA1
b533c7dd54ff9ce8077d8e216b13fa5edc569d4f

SHA256
ca23886ce33c96ab7c83e7c4df2520c5a4b5799db4ae1404c82b0e8ccf20c6a7

SHA512
7c883cf2fd15be38b9f9df863d1d654bd073b901a8c4ccb39e7d81101d2f8fab6cc4aecb1ba16868fd5054652eaa33a4ebd053368d730e76fbdb50f48674cba4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\596c2163-1644-4bfc-af77-7c8e962f1fd9

Filesize
24KB

MD5
2ae8a04fec5958d06b9b56da743e026c

SHA1
190646c561bf82bcc4875e14092defe83d59fe4f

SHA256
1cbbda74ce870aba32ef1bf8a7b718a071aa8003c2dad7274020ce8304492fff

SHA512
8995263c88d6ec0839338828ab78d818d489ec4069273a8681fafa3beee1e3b37694dc8b262882b0f23549bc3788e9bcacc124637fbb33d9f069802f655e152c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\7416fc45-1756-4d2b-b731-3c75c11eaf6f

Filesize
982B

MD5
5a143ec8990bb93cd006721cd44642bd

SHA1
a84f9fc5c62992e626e9dbfe63c5cb9c28496f8b

SHA256
306891244ce9afa44229fdc7dd1ba3b1c95215519c63b8aef958a3226bf55bce

SHA512
b11dfa79685308a5bd10cd1edd737f4cbe3db8a3b10ad9341fb272f67d2563cb314730edaf9c4ba4df5fd2735160fbe237d75e1433888b70790e1c7e1905c084

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js

Filesize
10KB

MD5
a900014bf93fe123b168d190342fe6ec

SHA1
ce3e6ec5a5fd5d9058eba60d49b4cb03e8662473

SHA256
97667c13f773ace868ed27902e51c92e745c44895c73796f5ffc4db355ee4ecf

SHA512
2a9e63d8d14ccc620c03a0c157413b974e0bf6348f9e4bc96c51c83e322c04962ce82e1b069d7a015c6d18dd050ec464a817f29f7ac8e32212eed8e924e3e3ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js

Filesize
11KB

MD5
3dd145ff95551c7340c532cb53355250

SHA1
785e5549bae3ec7d1569109c2ebaf6f15eba9978

SHA256
f0f4bd2df5786dce1a00593151eec45d83e2956ec49a38cda4674a3cfb24f08a

SHA512
5dbb49ba37a401cef5d06ae121187fc012a0ce52979895513b856dd8b2238eac75d60911af2fd83ef41208550f7bb6216347d9f8be6726291df5c2c3445e20d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js

Filesize
12KB

MD5
f60b3b9b309cbafe32fd6c6a98a25037

SHA1
fe0da5e5fafa6ab29b0879e581fac6563143c7b3

SHA256
3bc53afb8b0f726d4d5b3450d88ab96d3e056e504366c3a7cb035f89988533e6

SHA512
155e9bff65d141fba5c1b17b8796df16bdb9130a33ae9fb025307be68330d11aabf4fbd786b0f91c9f97bf67663adbb4fe539c85c8eb203fa9862de9c1875bae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
464d8759d30b25b6202d87e4b20e8ec6

SHA1
427763df32be2e502f44106f1a735d214568548e

SHA256
084408a3f169089be9578abe19c59be685b690d53f26c6daff95ffb8086e91cb

SHA512
088791f3db5a3e04aa77dd75dd6c9cd9fc665ebf7b6260aa82ef50fdda38bd66415514c25518061f8c75e53457299f55bb58012fed3c11603a5ee286f7d92079

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
a50c329929e9aaafd2a7ac8a3af2e992

SHA1
d99210d789a75e3108d86d06db3739f1fa0275f7

SHA256
4b45864c02230ccbc5d6508aab867a20a06c117ce7112909d347578efd29d4f4

SHA512
327a150fa18cc810380c70b55873b315fdefb33e00f31e16a3ca374593b170b8d7db4bb2b44b8be07047c79d881ccaca5027bce1964b880fa9d9a28952ec7e11

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
836126f610c2ad67976495a16d2c808d

SHA1
1eca5ff9a093e63a2fa16ed83f0415e718e135a2

SHA256
de4e9d9e26d2966dabe2630bd6d47005b3711ad4a9881c39de5ffee5a4f89da3

SHA512
14d64ca3b7a5e85f91b286f13c6995727b39150b252c63cd2e807fb205a321990ff61714d27dde5388a3eaf61fe1508fa34cd2ba5eaa50342eb5fc09549bf51e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
21d1c77ead3738b91c16582fa747cdb8

SHA1
030d20ae3c075f1907f2482018d774d116612968

SHA256
656909849250e687299d3596a9d4b696f083ff778740ce6c613866d077d48630

SHA512
a612dc249e9f289ea0b465d6d775d82dcb84082dc69f9f1d3fab2e3ed94fe4e0448ae586cb1835f5edf5c2dcf4505aa6e30f257f436af7a6bde2812315264bff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
60a90f528f9bbbe02a6d898960dd81ed

SHA1
fe0be0ec1984e6bae08897a76299c5f175ca51cc

SHA256
b9eeb850dd6c13c2a30c5eabb4cab57734bacb19e9f7bcf161efa97d8568f955

SHA512
13ed7dafcf97013380be380f800071d905fede1c4e2ec65b9ccd1f43d637476c2e7afb6e7a352ddf51e2708b1b5980f7e05bf03882a4b6aa1f01e16237cf466a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
458fe8719fadc8f81a4a2f52ba81e56a

SHA1
79c7e51ae80954406821411d0a92eaf296c94b3a

SHA256
007651819aac45a703a18f48744000a233ddf6829cee0c8ceda4889f0b283d55

SHA512
b4d403df5844acc328959331e81dd58a60197326066718547793fa84d5c90a2afc787e1aa79b1b1986d734fa270a839abe6a673e1ad3360ac4879e13b6bb4835

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
4657580d887e636300e5c76fca75c9fd

SHA1
32b0bd411d98f653da6ae8299543f18a28ea0f51

SHA256
3cf4a1c631bd20d841f6c72d9a8b3d58881117c29766f2ba3fd988c8b3263cbe

SHA512
ef69c8804d65adcb4048117c3c8dfa552ec6732ab96aeda1623a8c6e43d8361d0c4f462510a00f72ef1ed2764b627779fcd24f6c9fb3ec3c44840d46ef22d24f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
162fc6650a1b2961cc2adc1016a364f4

SHA1
7658d4767364b72f57fdd246b129b342100f2817

SHA256
4ab40b6c82fafc95f6540c78b38df4d02d41b4ec0e0509d42a351089ee18bc14

SHA512
57be1a5047eb6b98fcaff4bd937e5dd4c59cf20f703a3c83a8aaae354517ffa3c61619148496fc46c6c2fb085ae490c879c43c91e113ddaccdcc3a5920ef5696

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
8a578a4c5f9e8e6f6cce348bbb1ca32f

SHA1
fba41715f78517614040e2543fbca340d6613b14

SHA256
3bef309a399ab92c141f872cc935ebb7ece5f7ed7f6396adf7875ac0698fc5a0

SHA512
409aa74c1a458448b53160cfe119ce0e043c5952b44a4bd39e9f5089059c1c48395edff8da41df76fc7757c929f282a8b9c8cfdbb45c8e93a56e05d1447fa03e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
870aee17f55d38c7abe50adfec739040

SHA1
7650764caba134263280dfa422f76b98555ba1e5

SHA256
2026bd6cc1c5852183391e257cf6e8f02d306d6f3a0fc70fd0be3245617975d4

SHA512
7987c78ff358ffd96511f22c48be9e129662fb2f1f5aa898323f4127b510b9938db43346cfb7f51ca0fe7db55f7ee334f4657ba122b2b5bfd7d90650b62ef9bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
71593e8cb858e5fb27c7626e2df8cf2c

SHA1
5e523290d9bf409a93a6f2f3ac4b05b3b73f65a4

SHA256
8b5f1161ec7b871a8cb0df00827310ab6863140133655160d2158a4bd3eeea8b

SHA512
55aa86ce70d0856434165daf4d933feb78e67b5a62d561ad949ed6d1e3e935778147bcd72c635dcbc74cd6e7906891fcd33e0ede2a91b2bb70f3c346d14e90a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
384KB

MD5
1726eabccbb40bb062002ab7d3dd21bc

SHA1
33474adfa14a18ab71c61e0c458720aac1f9504b

SHA256
78f0fccee34083643e00ea5d44acfcf922e356bd6446330109eca684d523ad22

SHA512
abd16cfa4a48e72e4b05c3650b23a4c3f51344c283d43a7add4761eff2e76d4b1bb62c9a2a9d6afdc39456711cf222a777578016da843141f8e5815f1296329a

Download Submit
C:\Users\Admin\Downloads\Quasar.XN31CewY.v1.4.1.zip.part

Filesize
3.3MB

MD5
13aa4bf4f5ed1ac503c69470b1ede5c1

SHA1
c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00

SHA256
4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

SHA512
767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Profiles\Default.xml

Filesize
1012B

MD5
0ac11c90ff43d7b8335214b467619b9c

SHA1
7291550e1f5da3608ce0f23f1bc2c0c41bddd168

SHA256
9e36ed23da576c0fdf84130c528e43ab0045e5ed38fc799cf8835ee1e290f4a7

SHA512
d878217a8c2e5e30eace9ba1ab45d3f6799ae528f23bcf25577b55e43306e6239cbcbbb1cb9fc28c50e1332eaf6ea1f06efc93d0032af9d3bf71448d86fe4f72

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12

Filesize
4KB

MD5
3a2b88f749f2b54f628d173b5e409e8a

SHA1
15819ea8b2ab8466b43a690a74c82a3cafb29618

SHA256
7d7fb8edb399900facbc22ee5326ab46d0ee19f1f721799ea3782b5ecaa2a388

SHA512
07a9bf0081b9e639d6971ea91797c2bdca91bcac76e5ed900464ee9014d137935f1de334b00f49adaf9a9db180447b19a22b8568265afeb9e92e2e6ca0824f30

Download Submit
memory/1192-2014-0x000002A6EF1F0000-0x000002A6EF51E000-memory.dmp

Filesize
3.2MB

Download
memory/1192-2013-0x000002A6EA1C0000-0x000002A6EA1D6000-memory.dmp

Filesize
88KB

Download
memory/1192-2012-0x000002A6E9C80000-0x000002A6E9DB8000-memory.dmp

Filesize
1.2MB

Download
memory/1192-2220-0x000002A6EE6E0000-0x000002A6EE6F8000-memory.dmp

Filesize
96KB

Download
memory/1192-2221-0x000002A6EE960000-0x000002A6EE9B0000-memory.dmp

Filesize
320KB

Download
memory/1192-2222-0x000002A6F0D20000-0x000002A6F0DD2000-memory.dmp

Filesize
712KB

Download
memory/1192-2223-0x000002A6F0C60000-0x000002A6F0CAC000-memory.dmp

Filesize
304KB

Download