quasar | hxxps://www[.]youtube[.]com/redirect?event=comments&redir_token=QUFFLUhqbUFNMTZlU0pNamkydUZkVFBySWNoV2p4VWc5QXxBQ3Jtc0tuZnVWajl1TVUtdDhTTmJINVd2ZWdWb1dGUFcxUGViSHVsTGkzbnFNQ0IxMXJtT2tCQ2s2eXFHcklNZVBvVHh2bTBCcUNBMFhxVTFRZHhFQ3dLX2M4R0tOYV92Q3Fhc2N4d2FvVFMzOUFSaHFBZzI3aw&q=https%3A%2F%2Frkns[.]link%2Fxgiz1

Analysis

max time kernel
78s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbUFNMTZlU0pNamkydUZkVFBySWNoV2p4VWc5QXxBQ3Jtc0tuZnVWajl1TVUtdDhTTmJINVd2ZWdWb1dGUFcxUGViSHVsTGkzbnFNQ0IxMXJtT2tCQ2s2eXFHcklNZVBvVHh2bTBCcUNBMFhxVTFRZHhFQ3dLX2M4R0tOYV92Q3Fhc2N4d2FvVFMzOUFSaHFBZzI3aw&q=https%3A%2F%2Frkns.link%2Fxgiz1

Score

10^/10

quasar office04 discovery phishing spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.0.28:4782

Mutex

21dc5e45-8c42-4e7e-a882-b318788e9ca8

Attributes

encryption_key
C77A16FAC6C225B2DB880A8156F0D384EB290A9E
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Boostrapper
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023e19-976.dat	family_quasar
behavioral1/memory/5400-1048-0x0000000000530000-0x0000000000854000-memory.dmp	family_quasar

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: httpswww.youtube.com@mray20081subconfirmation1cbrd1
phishing

Executes dropped EXE 3 IoCs

pid	Process
5400	ripplewoofer.exe
1756	Client.exe
4268	ripplewoofer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 341205.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\SubDir\Client.exe\:SmartScreen:$DATA	ripplewoofer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1860	schtasks.exe
5456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
4352	msedge.exe
4352	msedge.exe
1492	identity_helper.exe
1492	identity_helper.exe
5080	msedge.exe
5080	msedge.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	4500	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4500	AUDIODG.EXE
Token: SeDebugPrivilege	5400	ripplewoofer.exe
Token: SeDebugPrivilege	1756	Client.exe
Token: SeDebugPrivilege	4268	ripplewoofer.exe
Token: SeDebugPrivilege	5200	taskmgr.exe
Token: SeSystemProfilePrivilege	5200	taskmgr.exe
Token: SeCreateGlobalPrivilege	5200	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
1756	Client.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
1756	Client.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1756	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 2612	4352	msedge.exe	85
PID 4352 wrote to memory of 2612	4352	msedge.exe	85
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 1432	4352	msedge.exe	86
PID 4352 wrote to memory of 5064	4352	msedge.exe	87
PID 4352 wrote to memory of 5064	4352	msedge.exe	87
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88
PID 4352 wrote to memory of 2976	4352	msedge.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbUFNMTZlU0pNamkydUZkVFBySWNoV2p4VWc5QXxBQ3Jtc0tuZnVWajl1TVUtdDhTTmJINVd2ZWdWb1dGUFcxUGViSHVsTGkzbnFNQ0IxMXJtT2tCQ2s2eXFHcklNZVBvVHh2bTBCcUNBMFhxVTFRZHhFQ3dLX2M4R0tOYV92Q3Fhc2N4d2FvVFMzOUFSaHFBZzI3aw&q=https%3A%2F%2Frkns.link%2Fxgiz1
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1a8f46f8,0x7ffe1a8f4708,0x7ffe1a8f4718
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2916 /prefetch:1
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1980,6870892970069817588,448858044310748645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- C:\Users\Admin\Downloads\ripplewoofer.exe
  "C:\Users\Admin\Downloads\ripplewoofer.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:5400
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Boostrapper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1860
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1756
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Boostrapper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3324

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a0 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2796

C:\Users\Admin\Downloads\ripplewoofer.exe
"C:\Users\Admin\Downloads\ripplewoofer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ripplewoofer.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
49KB

MD5
7ca090d5f0c1a9e7d42edb60ad4ec5e8

SHA1
7278dcacb472ec8a27af7fbc6f8212b21e191042

SHA256
4039fef5575ba88350a109b2c8d9aa107f583acb6cbe2ac8e609071567c4cc76

SHA512
c4f2d23eacf74f87de8dea6e4532b120253bb9ad356341532f5e1aaf2ce90d137f46b50df7de5250bce4eca1fbfb74da088accd7c626fa853dc524abad7bfe8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
240KB

MD5
3b9c21e2248c68c89833d2f0e450e340

SHA1
e2e37635e3c4c574783c1cd582f10a437088c3ef

SHA256
5696ffb94b2b6795087573d31c4ea2a72856f29ea786af00988c08cf7d742bff

SHA512
b95cfa01308a533a461f0119b72dc292fc802aea5eb584060c8e1fde17c4355cf85b8858bc3e19595c8dc02114d314649e739fbc8a9f49744d7fc9417d4ca530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
22KB

MD5
778ca3ed38e51e5d4967cd21efbdd007

SHA1
06e62821512a5b73931e237e35501f7722f0dbf4

SHA256
b7e1bfadb8d9c061f17a7234df012df7842ab1aa8fb6f9579fa3f0a3b4a75bc0

SHA512
5f6f02099ca8079305fb7e7f43ae4344d522271fe30379c0854d6a81b7d8adf408a50a4b799b5f52e6ed162ba6ce7fe97e24a2b9719df780e75683d3aa103d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
635KB

MD5
b537ca5fec304dcf3ce3171edf1e8fa4

SHA1
52665eefc08697d21f82719269fbfef687a643d7

SHA256
50b93c8ccbf1304dde0b424bafadf2fb654597bf4a35def9f29356988dfeb2ca

SHA512
81ae8df536c60aa8eb9a687625a72de559d15018c5248e0bc12ce7ed45aa7b960e999b79a8e197c38ddde219aa942ba4534f154aa99386e5e242d18a7d76c805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
34KB

MD5
e85ac71b59dadc1488a1c888db91c5ea

SHA1
a4aa7fc9226bd867a978945a27fd78a0a82cc994

SHA256
7441da6812af01a6eb9afa5d602986b233a57700cb721343b0aa9830a15def0d

SHA512
2b4d952a258f9001c2d8a42402c98788759138669750667524df2031d3926e21836b037974ded859bebf88fd9296791a6a2de65561b8098f066f9cbb8ae719ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
34KB

MD5
6242c13ec6b35fed918ab71eb096d097

SHA1
691e6865e78afb11d9070056ba6cd99bdad7b04e

SHA256
b1c7566622f40bad557a6c5b7bc5b8ae25b4da191ac716cc7923282eef96034c

SHA512
52914b4ca7362e9ebe326ea89006f5cc096fd4d1c360cae33ca768af92fe6fdb5078d0848fb6dc092848ba0e3d3f51bfb20a292250c35e8bd2e79fd5a19dd7b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c3214d79fcab19988c2aa6749b4a0531

SHA1
62b5f14b6f1817fb7f4e9948f95a9cc141434da5

SHA256
5ff3866ab336bda0d1a0861241f50ed5eb887a46aee038c48a669de256e24630

SHA512
acd24bb7247aa3419ca66ba583c4772e66784db441bdd1c8d5cca462d682706001e089a6f6bc8ab048b1ba4228642a124cc9c5238ef466164d8a135207a8fa6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
e59f2ab2b86116bbc3ab65d7f6d74172

SHA1
6ea06ca4d1149ceeafce0e3fd84cca77993438c9

SHA256
fe1189d317e725b97644f2a41708aabf412e85de3f9f568ea9cfc727d1e1a6e3

SHA512
cacd76713c58bd5b2d7aa754bfd1815beaa71bd01a9495faebf31ae0f0e6e88ae47b847676b9c00acb31079f87ab5c5a3a7f3f1d5c1dd418ef23899ef4f8fdb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b17ab3041c1d124719b3cf1be8f51193

SHA1
08a4ae5d04095474362a6ba97f983d0c0d943e02

SHA256
bc4b561684f5c10cd83661b9ad91ceb3ea44a4b3519c4d04094e5c6ab11b6243

SHA512
c1890a3b1d006a8b8cb825c399521e607a18e63737024912fdca4d9d697eec48bbd3b7ff24dc5e1b770d0d12c2303296a1abe8d386e6db13f1d8307e77b4cbb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1b2cff2292a9beb1ef66b036b7b8dc13

SHA1
32464fac9c81a47ba7bc2b176ef9fa8410c6944b

SHA256
cd373ad7ab7bbc04a049726ca1ea617f3a93271b8c18a2efaf29bd693c934958

SHA512
15532473bbc2de6d450694573572e2d2b9bbcb3406a727bab6eee944e3041defa1baec436a17dc7ec6c55d16b2d6e4ffee186e9badb5d0bd322afa95f0285c0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
806b59fba54a9fab02356e83f688184d

SHA1
7c7bc01e4e0afebb33578bcc7f829249ab27f058

SHA256
35bca19e8b826f42594e258d1b9d91e7f0d45824a623c96b026f4404e7031925

SHA512
2cbd935240740a382effd8288675ac4124500aee41dd5a943e988338090a644a7ec99de73e79c154caf6105c7bae9002b22e109424c3bdf856059ea85c9ada20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5ba3cc227d486a6adbd001397fcb5d11

SHA1
2bc4539c8398e6e65fab8272ef82e69ed834428a

SHA256
f0829be947369df044469fd27d96e3818be7b12295e516bc123d1d4dc10f0cec

SHA512
60b2f97ab04a1d021ad4beaf4f04d94c4fc37ef1794624e339acb906410551e7405fc1066f9b10436532b560b27e317b5d5eb653a19fc4a68b81440d879688b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\853365f8-1eb3-4f4a-83b8-97aead5f505c\index-dir\the-real-index

Filesize
624B

MD5
9adf8e7709f45d68a1d507b86ef82ac5

SHA1
c7de4f40f6310678b4d0da3dce98f4ff1f7013ff

SHA256
bebf4cf62b7ca6d3fece97be8822feb99763881afe8d8ec7ee65d4409b5416d4

SHA512
2b48bfc90e15e0c34f3c55844eb4f71b3cc634643c84e0436adc150f9f213fc26fb6f0558678b6c8a032c770a4643238867787368d5a48c42d70c6eeb4c3ea8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\853365f8-1eb3-4f4a-83b8-97aead5f505c\index-dir\the-real-index~RFe585213.TMP

Filesize
48B

MD5
2b13f72536b7819b8fd3802b2663e694

SHA1
237ff9f53dff4bfa5c06a817c452831b2fcac4ab

SHA256
fca149d5be82e7a7d0aed95ff793f44e6c5d107f7e5d11343fc9d0f5b14e3638

SHA512
0a3571941d6d6f0fed240abee506d16f6f67c908ddeb0085fe6abee056622cdc166649c10617852d402f3583cb71af611402c9d84425eb728d91b88aa95cbb98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\cbbb59b8-c285-410f-acac-d68f2b8003e6\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\cbbb59b8-c285-410f-acac-d68f2b8003e6\index-dir\the-real-index

Filesize
2KB

MD5
06d5f187d9167a4db113924978b4ac94

SHA1
ce7d5f5d56db2201917c9c1ee349324c25b60cb9

SHA256
e4cd62c907be07c11436ba1c4c4b5f0b0323d855cbf04c68f73b134e297f2f20

SHA512
78b56014d7ee48e1ce42f7ec1af8c28ce8cbb339fb10f11423187c2c56d3afa62688083d7a43115da831144276c5cff0ff1cccfc184155a6c1023d24f881d6ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\cbbb59b8-c285-410f-acac-d68f2b8003e6\index-dir\the-real-index~RFe584c85.TMP

Filesize
48B

MD5
f237f814294a22d69ad99ab2a768f15d

SHA1
c95efb040c64c797f0301b47d8a4191e57d0e0b4

SHA256
4d00c130dce7974da151de8759b8a59be3d88f9a9b1bdd050c67e2f45e935d22

SHA512
309733f0f6dcc0dee5517a2d6c64c6680a56afb8eec1e502fcda44957b09cae102bb352226cd6ed5e8d7f981fafc8da1e2e421f2ea7341099dfa01cd875b7993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\df5e1c4b-110e-4b55-b9e2-acb10fb01c8c\index-dir\the-real-index

Filesize
2KB

MD5
bafcccc8b9af5a297fc1e5cc462af6ef

SHA1
38b681dbcba95b503f9368bce922ef9be5aac865

SHA256
7a549f737983e75fe37c126fa8925f31a4aac9de83d9a149f295315a27686cd3

SHA512
9b58a8bec4edb3173c5f36ea7fe5cbb38c9ed60eee9e7aa69332d79f3ef266e1ac3b7d8bc054835dc73777d031b8016ab500a69652b7c16d008f91c91ce061d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\df5e1c4b-110e-4b55-b9e2-acb10fb01c8c\index-dir\the-real-index~RFe57dd7f.TMP

Filesize
48B

MD5
159f83c14190e8ae534e7601a39766bd

SHA1
c0bd7655426975c8c4abf5f704e97c69ad070f59

SHA256
8284e08a4adda7ae105302af6280b63fd192e3eea5fffecc86c4be8819beadb9

SHA512
ea8cf76c5a5b5c22f4100433a60a0cb364c01463449d6a8629ee537e912ce830fd6dff9217e826c3e0eeeb80c6e6353540c066a3b61677946342318006ad8e9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
c1e73ac2f1747b73c92d7fc17ee4ba29

SHA1
be65d035ea610dab8885ef8056496468e2323f3f

SHA256
2cac0a59e65632e2b14613574076ec57ca4c3f17a436d009e4bd4f8c90e7e0df

SHA512
7d426ab2d74a024088cf1197dd170bce79f35f6294c88c0de5e30fde1a3e6967e2efc3351db06400dd4a3ba6ec8b2a9a8a5fd5b4a3bb2f341d24d18355487be6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
0f8be113ade873cb3f9527d94e44a374

SHA1
4857719de0299e1537593ad3ff31a45f4a1a0930

SHA256
4ee907bd38fd7bfd52c862df2dc91a7aa8d7eaf4c6f2609c7cb392e67e0c9a44

SHA512
ab481b35b4492c2c6300a6691234c3f7c8928792f88f289a503fecac1d347e5fb1cdb51494c76dcf59ebaa1d2e4370831becb8bc13440c30ac2015146b092a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
599656e9ff90723b0a8cc8bc1208186e

SHA1
59a1d01762c37a9caf38cf34e0ebce68fe19ec75

SHA256
2b9a80be06bbdd7d7b917aee5cba2881f81c8ac0623dacd055e3ead514c7061c

SHA512
f53fb9e3c9612c7a2a480cdaa03d5f155325ce14f7117d5ea051f297035427ab44d6a742e74a51801fc28f2a2b5d8fa480fd795d95dbdc4dead95c1fa47b605f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
932b44333a41de4437ea8d94d66aca05

SHA1
31c118fff2e6d60012981b916a34d2f1530fab31

SHA256
49744c7cfcfdef2f2c787d6a238e2594081bef4c8393b3711b4883048069ddff

SHA512
5b874edbf93290f265f0c871a9ebca9ebcbf6d3aff073fd4bcdd560c8725b6edd3bde89ee837643934ed276b2efa75a2219c96e8b9c6c8a7daa78fd1d99c45a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
155B

MD5
40a9ccdf5906b120aeab738fa9dac876

SHA1
d9d62a296fbd11de7e75e73871abde6cb1f908bd

SHA256
363ef70b171481b9f6de7c578d99e8512ed4d446f771d4ade1b50996c28e55ff

SHA512
13a93748bf7be46a492e0d0c28476bec17021b0fd1a19aff6ad9919498018509241aa88814d4003a78808c846c76d9d72e6a0c26f4c888fac92979c3139199ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
2b87240e3013c27bf834ce8cea108b12

SHA1
7823b5b1e147bbaac05f18382a0a3ab7d9cdf2b3

SHA256
99aecc20e9f407d4b8a6412fa89058a629696276f1d9a44c12b91e19d0ae2c61

SHA512
3c0c4c89f6c28d39563e99d749aec89ceddbd0bb9a863e89a808174c2e91711e376f9d5db681f60059123af805dd2de1fc4c150d57be3587c2d239b840f1f207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
3b635b1a64d58e28a0b56abf8df222ce

SHA1
0c5d96f7ff98f59ea3460a63bde9c09623c5a0c3

SHA256
5e920f8f644ab3193ae4377a3ec9b9f19c0b139bb586a5e8bd1d448d9e7df866

SHA512
33664cd0e8fe3ccb91943babf9f553d99fb24ee21ef2896afb5822af6fb2ed4ade5c7bd7e054d857fefd0e96016b380401117f6858007f2eeba4ca0aaa97a041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57cab2.TMP

Filesize
89B

MD5
8fe6c2b47f5a137cc5106fe8fc9eb741

SHA1
e2b5624b4139fb8cd2b0857cc6546c071e04d0de

SHA256
9d06d489eae56c115330923f9711a9f44f474ec089a98f2772f4b493283a03c5

SHA512
9a589b7bc60050b4c970dafcd83132a88ece9d624541d21a518e880444c94c70558a629460c5e301018baf3de6af6f22a5283399affb404aec968c9a6260e0e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
185b06a4abc735a754833554c7d7944d

SHA1
47a1b3676b353ef1487755956e1d964069207ce3

SHA256
e69850fd3b9454ef66b0fbcc39a5d06188b4e95902135f52bf46221c40a4f75b

SHA512
e11032eeea2978289b8abc7cce539a49d4d5c3522b79674a5fba9be4b1b81ff5fc414d8ca6c08e4b6251cd32c365e93366ec42464342e166f2f2fabd2662a5cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584707.TMP

Filesize
48B

MD5
a91fbdb197275921dbc519492789195f

SHA1
528298e36b71cc10d91bb9504e7b736bf5498cf5

SHA256
93bb912a177e37159073b122642cfb27403cc232a729f0710809cc6a21585c67

SHA512
b91199fe68a26c1440d0fa2403b975b7c338a112e9c81a720483f0d37de51a040a6d1b4eac1b2e4e42840d8a98eaaf457537653a1751327f708178c256911807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9a82cba279f09c4d673bcf5094635892

SHA1
58e1382f2a6a5b7ba2b22845f32c6a61ac12e941

SHA256
5bfc381ea7be43c414cbf2eeaeee516abc9aed55de72c8604fe1212a213e8c1d

SHA512
ce235df00a8fad9d072eb83c667a7b354ba1ffddd257f594f7b55d548b57de7caf9b05945e0cf21de3f2fb151c17c6854ca1481475a42f3c3c825acbe67ec71a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2302ec3643ac65e76d98c3130c25cea1

SHA1
2e1fc9bf617fd7b354d70c967064659326d82fdf

SHA256
7097968a7346bdf16fe0f99f712ca1f2694330a7c9e769a8a75601b38abbd900

SHA512
3e53c906ab2e2a033b0093ba9093c5f34e05dd23ec32b76df83a5ce90bf3abd9e5aedc91f8f72f86c5317fa7f64f7959156ee9f6203d77931cbd95696a198683

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
154991a4f2f28ce2f6ef2b16aefa3dac

SHA1
9a2b22e5026aa1617247ba87d4c657d4d8a05954

SHA256
a9b176fbe5126e8dedc2321fc31c14d546aaedcdc3bc2e713b76ded430111712

SHA512
dcabbe229e4228fa798f669dc01ac2d21bc0a5115e2e118e63fbf9b9dae890ffd69c5b7af3ed2d8a1abb3475a72edbabc7a4d426b7a8b8df9c18c8ff96de7a88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f77f.TMP

Filesize
874B

MD5
bda82ac3b484fb1d8213336a691a08a7

SHA1
7652c34b405ab020da5a4713ffcae9c6b641e7cc

SHA256
8967a20a491599596df22aa9f1ce1097359b25d7c2d9b43f313401f18e7104bc

SHA512
b865a63d0f785db136fd9aed4d12920f65ea70db2d263e5774192f36543ec2516a8c4f8f1b37cd6d2ed0dc875a5f27da5f8fa745ae71397d7d728927f5b60411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7436d26fb6a8cd6c308fa7525da122a1

SHA1
4647fffac22d538869c605e4ac7a86bed2cf3ce3

SHA256
224263500cec9eb4698d30bc9bd6e8d8dac467c2cd3cddb6bd59909b460391e1

SHA512
85e540142b6ea8973d02ad0f79697098e9e46a60dfd01b48e9577d0575e5770a5dd54959f8d6e9c010cfdf1f5a94411e2215f01910dd233d7db21747265f0b79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eb6cdeb9e4663c84930e4d7aa04a8f9d

SHA1
faf052a49c6f21a93a3954cff28514879f3020b2

SHA256
654d45b665210cfb0ea0350535d06be513dcb2184629e47745a74ce9aa725fb1

SHA512
f3de50bc259a41a6f020be6992fd6217d9ece435aed03d7632dcc34a746720ea7715a5918ff40d55b97b8cc94f7799da97e3d419dc8e7a84d4863b79d665ddef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
412597da750fb38a95c3e48e93929222

SHA1
7cf3b019eb8b6aa3d7ec64acb53b1e051545fbe6

SHA256
7d8eaea300a1a4a1be973aed62912a0e28fe979ffb6016dc5b038fd664f4be1d

SHA512
8e64d01f3304acf0809caf3f591626d5f77e298edf5df6f8397019cf366b50032d89c74b651f492da832c44aa97c6255a8e757dc0d04f150a30fd2730583943d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 341205.crdownload

Filesize
3.1MB

MD5
aefac3053fe23e06c3cd4c123a69ca37

SHA1
3971e70e42e0148deb5b879da32bdcf6e3702197

SHA256
af6a17197ef3da87971496daf39475598053e250d58c82c610d55ce4267102e2

SHA512
2d611803fabd368214d61ef345eea20e41090a4db196e300782fb06d6fada2c548f909e3362a7c40852b3aab239b60e1acd613e523508be18f5e370375f40242

Download Submit
memory/1756-1056-0x000000001BBB0000-0x000000001BC00000-memory.dmp

Filesize
320KB

Download
memory/1756-1057-0x000000001BCC0000-0x000000001BD72000-memory.dmp

Filesize
712KB

Download
memory/5200-1101-0x00000194A9B00000-0x00000194A9B01000-memory.dmp

Filesize
4KB

Download
memory/5200-1100-0x00000194A9B00000-0x00000194A9B01000-memory.dmp

Filesize
4KB

Download
memory/5200-1102-0x00000194A9B00000-0x00000194A9B01000-memory.dmp

Filesize
4KB

Download
memory/5200-1112-0x00000194A9B00000-0x00000194A9B01000-memory.dmp

Filesize
4KB

Download
memory/5200-1111-0x00000194A9B00000-0x00000194A9B01000-memory.dmp

Filesize
4KB

Download
memory/5200-1110-0x00000194A9B00000-0x00000194A9B01000-memory.dmp

Filesize
4KB

Download
memory/5200-1109-0x00000194A9B00000-0x00000194A9B01000-memory.dmp

Filesize
4KB

Download
memory/5200-1108-0x00000194A9B00000-0x00000194A9B01000-memory.dmp

Filesize
4KB

Download
memory/5200-1107-0x00000194A9B00000-0x00000194A9B01000-memory.dmp

Filesize
4KB

Download
memory/5200-1106-0x00000194A9B00000-0x00000194A9B01000-memory.dmp

Filesize
4KB

Download
memory/5400-1048-0x0000000000530000-0x0000000000854000-memory.dmp

Filesize
3.1MB

Download