quasar | hxxps://github[.]com/youvegotpwned/RedEngineCrack/releases/download/fivem/RedEngine[.]zip

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2025 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/youvegotpwned/RedEngineCrack/releases/download/fivem/RedEngine.zip

Score

10^/10

quasar training discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

TRAINING

185.241.208.185:16145

Mutex

22073971-8d9a-4364-9916-abbb09ac9d8b

Attributes

encryption_key
7A9A8376440E3257DB2B54403642F366A5FBE14A
install_name
Starter Module.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Starter Module
subdirectory
Modules

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/3140-94-0x0000000000380000-0x0000000000404000-memory.dmp	family_quasar
behavioral1/files/0x0008000000023d2e-97.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
4328	Starter Module.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Modules	RedEngine.exe
File opened for modification	C:\Windows\system32\Modules\Starter Module.exe	Starter Module.exe
File opened for modification	C:\Windows\system32\Modules	Starter Module.exe
File created	C:\Windows\system32\Modules\Starter Module.exe	RedEngine.exe
File created	C:\Windows\system32\Modules\Starter Module.exe	RedEngine.exe
File opened for modification	C:\Windows\system32\Modules\Starter Module.exe	RedEngine.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4452	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2868	schtasks.exe
1084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
3264	msedge.exe
3264	msedge.exe
2200	identity_helper.exe
2200	identity_helper.exe
4452	msedge.exe
4452	msedge.exe
1708	RedEngine.exe
1708	RedEngine.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3140	RedEngine.exe
Token: SeDebugPrivilege	4328	Starter Module.exe
Token: SeDebugPrivilege	1708	RedEngine.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
4328	Starter Module.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
4328	Starter Module.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4328	Starter Module.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 3916	3264	msedge.exe	82
PID 3264 wrote to memory of 3916	3264	msedge.exe	82
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 1304	3264	msedge.exe	83
PID 3264 wrote to memory of 4000	3264	msedge.exe	84
PID 3264 wrote to memory of 4000	3264	msedge.exe	84
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85
PID 3264 wrote to memory of 4252	3264	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/youvegotpwned/RedEngineCrack/releases/download/fivem/RedEngine.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb55646f8,0x7ffcb5564708,0x7ffcb5564718
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1972,10212086155554014563,5907250065383178698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3092

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\RedEngine\Tutorial.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4452

C:\Users\Admin\Downloads\RedEngine\RedEngine.exe
"C:\Users\Admin\Downloads\RedEngine\RedEngine.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3140
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Starter Module" /sc ONLOGON /tr "C:\Users\Admin\Downloads\RedEngine\RedEngine.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2868
- C:\Windows\system32\Modules\Starter Module.exe
  "C:\Windows\system32\Modules\Starter Module.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4328
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Starter Module" /sc ONLOGON /tr "C:\Windows\system32\Modules\Starter Module.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1084

C:\Users\Admin\Downloads\RedEngine\RedEngine.exe
"C:\Users\Admin\Downloads\RedEngine\RedEngine.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RedEngine.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de42a5d441e034fc9ae037794d699716

SHA1
e2a95a814848e6d95722d630b405af9f90bc5fd5

SHA256
2c7366a4af1678f4c9f5239b3fd274b62b0cdded027b0d14d409fd81f84c7d74

SHA512
a774e7f0204e16c9e3695129fe8864582f583a5e88bf380cdd6408ab6391f6280cd837f85ae1524fcf5dc3d74fa1fe9dfbbea056624989938257de28f5d7335f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b91eb0b4b0091e0848c162b12dbbac66

SHA1
73c34299b2efb59a0ddbf0c3b71935b8ffc0c2c9

SHA256
f21c7fd1e82314d39085ae4d168838476bfd0cf8eb19c2f284c8034a88646496

SHA512
93896592c741f43f075006bb019afe99c3686cb487f0b0e70d05c0f1b4212bb7a9bca4035684ed08fb8ccee9d7a6e5e5d885c545f4cfd73ad27a7f9529739c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d480daf11dca995a828828eab795371d

SHA1
6bf0b8c5e2dab3a907f847493de4eaecf75d2d09

SHA256
b26965f8cf3738d6affdf92853b65791d4fc772572448c37a1a178c8865e8982

SHA512
92af85fce1737cd61bcdc5a60ee636cfa73fa2358211ab7efc4aae182e78e4c10ac123bba48c436542700e16eeae77f9e0c9367e11ea7f1a0d3a400b5e06b358

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aeab8cdc474ca67fe1c1503a94135792

SHA1
437981a401d5eeee2314beb8c69289eb0b423bad

SHA256
3c50d900def421f6bb42497a6f8a11552337c34099c5968ee468fbadbbc45a86

SHA512
1957e333ac06c95ebaf03b7bac71cf61c4c91d88c30e4ebecd936e0d1307ad0b7e01fe61017991fc7400134b2bafe1d66025458dc87c476e741c7630098dbd11

Download Submit
C:\Users\Admin\Downloads\RedEngine.zip

Filesize
773KB

MD5
e0bc13d8be65d524a6e7f23a0764b2ae

SHA1
451127b271d4b6e40010b90eb74dd8b9bf531d39

SHA256
fc767ffc7f989455ce6aa641b29c14510d8de441cb423c211421e41d92febc10

SHA512
a70ab7673c006d4ab1fd88b1a44460604fcca765340eb919c77b3ccaec39f85f562a6490ec9b46cd3957335b9a421f68ed710ed9ed3d2e14776f8410c1edb66a

Download Submit
C:\Windows\System32\Modules\Starter Module.exe

Filesize
502KB

MD5
7178d81c9afdabb202f31315f7eed7e2

SHA1
527a063588b3e4d3acc04cf211d9b0df33f5ade2

SHA256
67e35ca53e1ee18113207c2edf4b165ae9158cfed151e08bac627327f9c60f21

SHA512
80b770bd2d3541400386c4aa446da8840823864a62d73554dd62ea08d5e9596f2b737fa8046eb6fb892690d115eb928022cdb1d24f4f8d9cf2e449adfd0809a5

Download Submit
memory/3140-94-0x0000000000380000-0x0000000000404000-memory.dmp

Filesize
528KB

Download
memory/4328-100-0x000000001C680000-0x000000001C6D0000-memory.dmp

Filesize
320KB

Download
memory/4328-101-0x000000001C790000-0x000000001C842000-memory.dmp

Filesize
712KB

Download