quasar | hxxps://gofile[.]io/d/d2baoM

Analysis

max time kernel
68s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2025 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/d2baoM

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

199.247.26.119:4782

Mutex

1f656d72-36d5-43b5-bb69-1c993e7832b7

Attributes

encryption_key
BFF4F4E7A5D888B3F7BA2E3883E0AD4B65B291D0
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft BasicV
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00040000000223df-56.dat	family_quasar
behavioral1/memory/3320-91-0x0000000000130000-0x0000000000454000-memory.dmp	family_quasar

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3320	Client-built.exe
5368	Client-built.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 605626.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
4480	msedge.exe
4480	msedge.exe
320	identity_helper.exe
320	identity_helper.exe
920	msedge.exe
920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	Client-built.exe
Token: SeDebugPrivilege	5368	Client-built.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
3320	Client-built.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
3320	Client-built.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 4960	4480	msedge.exe	82
PID 4480 wrote to memory of 4960	4480	msedge.exe	82
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 3092	4480	msedge.exe	83
PID 4480 wrote to memory of 2696	4480	msedge.exe	84
PID 4480 wrote to memory of 2696	4480	msedge.exe	84
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85
PID 4480 wrote to memory of 4748	4480	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/d2baoM
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa99af46f8,0x7ffa99af4708,0x7ffa99af4718
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3320
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Microsoft BasicV" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18042191049435223179,6037051524066371679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3112
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
613e68f330b3f41a9d6aacd25c7df97c

SHA1
95ca6e6f05e0fa17397e16cfe22ea2dd040032e3

SHA256
4249f4a2448096cc5cd3ceda20e59541671bee2305923563a5e29b48dc355da1

SHA512
155ded337c66e4ef58088f07cf14a09721ad1c8ac658f3ccc87acf1d93e6721424de741360ddb7f7b36e863975d04d5c2a91bd9498934bef76db8a2914f5fc28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
58c5dc7085403116673b6c40ce8e74bf

SHA1
49825c4c9671a34955b9283e57b5db5ce81710c1

SHA256
1b2f83a0b97256675023b6514814fad6eef5f737d410674c08ed505da04b46a2

SHA512
7236440f051cdef05f403ba8020b645d77abc798b577cf05eb1c97c4e024c820cfe8b868b870720274919af4edff9e878ec7fe8ee1b690fdb32186f1d2353ade

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f420c8aab2e96aa7459e9e4dfabf22f4

SHA1
a1b57698ba96cd7846a08078c20fe83b0a32c499

SHA256
af2c9857c4542c46b917d3e1adbc5bcd576976bf72c74382ae71b092271f234e

SHA512
674ef34b42b105ab78768feb9154faecb2be7894ccc7782bdfa1812f862b85f07e1264b3c9fccfd20e017d233b76dec4f92e04cd35ad17be8df576333a1f8824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3ea18a8e2f0275dcd696e95537ba5daa

SHA1
6240dd2735b7c23d618186b8cebfd769a2c3e494

SHA256
80a19339f16026cf1fe47c0764cf80a210585b4062c8963f81d010e37d7ca1fb

SHA512
f89f984b143c3e2cf569ac46e66704f1eb7c53c503c949c7a2e4b63e920dc1961e7986e302c18d3082cbfbb207ba565024924cee12ae57b00f4ef47bf73bcf19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ddcf790a50ab26a86f1cbc5b591d061b

SHA1
123feedd9b4c477d4a50cd1a96ce1e9ec7e2561b

SHA256
d424307fcb20192f5f42e54ec3f43bb6c4c86ba1934e7066394c4261cc113599

SHA512
a32ac4894b2bebc7725345d4f346ef684c5646c20725d7a51fad0486e77d5e75939c78db5d5c4b278a7e8acd09991352413429d2c116fdc7b3c0f4369e4dd3da

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 605626.crdownload

Filesize
3.1MB

MD5
0670fe38d80fb742ed759edf4b8d9541

SHA1
d196451439ba042623e5d0efac4a9d90c988bf07

SHA256
b5ade1f655cde924ebfb24b2ea29e28787123262eae2dbb7a9c805e379ce4199

SHA512
f544f31ead8cfa074bccfafaa0b3b7603a3d1a74c1151a9703fa22f13ca80d576559df330cace392c7bada84a666113681e0e8005bf7015a3f43bbf52d758622

Download Submit
memory/3320-91-0x0000000000130000-0x0000000000454000-memory.dmp

Filesize
3.1MB

Download
memory/3320-92-0x000000001BB60000-0x000000001BBB0000-memory.dmp

Filesize
320KB

Download
memory/3320-93-0x000000001BC70000-0x000000001BD22000-memory.dmp

Filesize
712KB

Download