Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    280s
  • max time network
    278s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/01/2025, 15:47

General

  • Target

    pack.mcmeta

  • Size

    109B

  • MD5

    43ccda95b5c701c0fcf59baee8f7e30f

  • SHA1

    0e243064e052298ebb619297c4516886712246d0

  • SHA256

    ec34f78b2ed8239bd50e0beb22c61ee72f9902f356aa964b5d83087386985c75

  • SHA512

    a5ec7e401e6fcb6d988d2801a3fe162cd2aa98d3f626a9b20493d268d6b9868f1fb236d6b3f351ebff41be4569d74e1d85e527952fd401a0640bb154af8e834f

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office042

C2

127.0.0.1:4782

Mutex

4fdba42b-1529-4894-a5f2-8af35850b68c

Attributes
  • encryption_key

    95D889B5EA350B61B463513FC30DBCFBC48B664D

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\pack.mcmeta
    1⤵
    • Modifies registry class
    PID:2764
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:408
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:860
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff917ca3cb8,0x7ff917ca3cc8,0x7ff917ca3cd8
      2⤵
        PID:3036
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
        2⤵
          PID:4380
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3928
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
          2⤵
            PID:5116
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
            2⤵
              PID:112
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
              2⤵
                PID:4676
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
                2⤵
                  PID:1468
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
                  2⤵
                    PID:4704
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3408 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1640
                  • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2972
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
                    2⤵
                      PID:1448
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
                      2⤵
                        PID:2548
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
                        2⤵
                          PID:652
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
                          2⤵
                            PID:2488
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
                            2⤵
                              PID:2588
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
                              2⤵
                                PID:4064
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:1
                                2⤵
                                  PID:2752
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
                                  2⤵
                                    PID:2768
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
                                    2⤵
                                      PID:684
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
                                      2⤵
                                        PID:1712
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
                                        2⤵
                                        • NTFS ADS
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4768
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6060 /prefetch:2
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2368
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:1712
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:2376
                                        • C:\Windows\System32\rundll32.exe
                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                          1⤵
                                            PID:2780
                                          • C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Quasar.exe
                                            "C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Quasar.exe"
                                            1⤵
                                            • Modifies registry class
                                            • Suspicious behavior: GetForegroundWindowSpam
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3996
                                            • C:\Windows\explorer.exe
                                              "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12"
                                              2⤵
                                                PID:2716
                                            • C:\Windows\explorer.exe
                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                              1⤵
                                              • Modifies Internet Explorer settings
                                              • Modifies registry class
                                              • Suspicious behavior: AddClipboardFormatListener
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1088
                                            • C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe
                                              "C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              PID:3964
                                            • C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe
                                              "C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:948
                                            • C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe
                                              "C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1080

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client-built.exe.log

                                              Filesize

                                              1KB

                                              MD5

                                              b4e91d2e5f40d5e2586a86cf3bb4df24

                                              SHA1

                                              31920b3a41aa4400d4a0230a7622848789b38672

                                              SHA256

                                              5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

                                              SHA512

                                              968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              fdee96b970080ef7f5bfa5964075575e

                                              SHA1

                                              2c821998dc2674d291bfa83a4df46814f0c29ab4

                                              SHA256

                                              a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

                                              SHA512

                                              20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              46e6ad711a84b5dc7b30b75297d64875

                                              SHA1

                                              8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

                                              SHA256

                                              77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

                                              SHA512

                                              8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                              Filesize

                                              67KB

                                              MD5

                                              69df804d05f8b29a88278b7d582dd279

                                              SHA1

                                              d9560905612cf656d5dd0e741172fb4cd9c60688

                                              SHA256

                                              b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

                                              SHA512

                                              0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                              Filesize

                                              64KB

                                              MD5

                                              d6b36c7d4b06f140f860ddc91a4c659c

                                              SHA1

                                              ccf16571637b8d3e4c9423688c5bd06167bfb9e9

                                              SHA256

                                              34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

                                              SHA512

                                              2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                              Filesize

                                              19KB

                                              MD5

                                              1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

                                              SHA1

                                              6dd8803e59949c985d6a9df2f26c833041a5178c

                                              SHA256

                                              af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

                                              SHA512

                                              b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                              Filesize

                                              63KB

                                              MD5

                                              226541550a51911c375216f718493f65

                                              SHA1

                                              f6e608468401f9384cabdef45ca19e2afacc84bd

                                              SHA256

                                              caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

                                              SHA512

                                              2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              3KB

                                              MD5

                                              59fc09cb4937d9f94e76a79207ec933c

                                              SHA1

                                              76ec91a977a0d1662882ba74bfa68b665a71cd5f

                                              SHA256

                                              f1f192f0a106d6c51cab8cacc6c960566152ad887680d3747b12865ee5818ed6

                                              SHA512

                                              3a99648f1b9f1927e8721efb3ae40dbec53c4d2a38cb6cd301bf9789f82843be9336b63f9ca637158fe718a9297259186e755020dc9df67057d2f6cec11bfa48

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              941B

                                              MD5

                                              42e113c52b0721d5183875cc0f373bdf

                                              SHA1

                                              fc13e94d880d9944ee6f94c992625dcab1c02b0d

                                              SHA256

                                              d07df43362ed2338965206fe12e1a52a4b475ae74f48576bc9eab3bb40024a18

                                              SHA512

                                              a82ad14db2bdc54053295ef82f9fbc5aa9bc91c4db13b41f4a50a251436f9034b3b77736698cb7306137125df0877e0a0d67560f6d55093dc6f29a3d404f71a9

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              1d128bf7b82c8c8cff530a1cc5910b99

                                              SHA1

                                              fdfc569e9f3956174eb770ca79ee4c42539d5854

                                              SHA256

                                              4b86de8b29686154eda591e6ec017c17a302bf4b69eac2ab09f6c66c8c98f24b

                                              SHA512

                                              8b913a94000333ad188ea0f1cdd7b154605bc52ba931fd8f16406dec0976ba68eafe702602f5346f502156004267a6b997aaa6a591e19b10be6fb40754eeb1e3

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              acc6a753e15c4d71497d0c5a2c9efe49

                                              SHA1

                                              b29c022ea34c74b2fa8a08e494ecc8f7f5f198dc

                                              SHA256

                                              e0c8792d10f71cd6bc69dc86d5b7fe56827f6bca383f21ec69885ee243e27e09

                                              SHA512

                                              ff261eaf5962e601cfcd0327c8045ac90703cd2517b45144e8dd349e42e350da5d0f37218f3cf4c5476d5aec8f30f2e79917bdcb023c9dad8c13b9d546f15ffc

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              1d96fa5c136f90813ed28dabe6d8699d

                                              SHA1

                                              c689fdd0106bd6b96795cb80da1c97eb22907532

                                              SHA256

                                              fa72767978b306bc106f54abd0059cc5a49daf4521678be012c715e405131d44

                                              SHA512

                                              0c24254d21957287dc4b12721be6a8702294771f3082f45bdc4b013830be1f000c2147d620cf5cfb902fc288493cd3c7328e72e0552d56c849cf18b504ad3419

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              0c498c831553d52c87b5fc81d727d460

                                              SHA1

                                              3174a6885ed28fd41b6ba2408595be045ca373e6

                                              SHA256

                                              ef7e6e04cc6875817bda83cbdd32baeb8c791911de70a614756a14d84857cca7

                                              SHA512

                                              a44c82775fd1d7f8e2aaeea1839b02810f114fd783ee3c200b9f420c9adc4009864fcf5589f8887c28c1fce8d2a38bbb03b87c94e726753ff8d930b7fd381764

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              7b238dd7116d7390201473aba0f6b3e6

                                              SHA1

                                              05f3eb3219bac6d60f2316f1dbdc8ac3b57b05b7

                                              SHA256

                                              7e306c07eb9133bd9639067bff5add5ce67713d72cc3692272f2a26f973fd391

                                              SHA512

                                              e46106452410edd6bbef4b1def239664fb98485fdf798a661fae82f3b74d819d847500c3b6aa0aa4ff52b8999bc9a8445af9eef7c5f64d29b54826b01d45a7de

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              a9c335a4b525c81e7e9eec2eff1887c7

                                              SHA1

                                              d3e461f69f3dc6fe95eec4cc697edec5837112c3

                                              SHA256

                                              2f9fca2dd5f8963a67adf23b52148fdfd85e71c13d40e50a3355f3dd6a3db9e4

                                              SHA512

                                              48f5b43da7298b7643b1567be0e5bbea82eab4233ae4e082b9639ba4cce82363f08c61bd1c8ef5a81319483746c26f9117c09d9542918ff09a5336165903d7c2

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              3212a71b13f5eab343164f2f42830579

                                              SHA1

                                              5538616a148575916c30e307bb6e3fa9427301b4

                                              SHA256

                                              2a8f87517d735c1cb1715097dca4aab125804f2eea54601bf79c0700cf3b9ba3

                                              SHA512

                                              a0cfc9af45176d21b7cb690654e908cc7aadd9c4e88d45147f11adfca0cda2643eb75d7a7124e95a1cfa668f826422b7518bf034c8103c2147a1cc73b0dc1161

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              04fb354965848a0833d89e9e2c259a10

                                              SHA1

                                              44a36622277f70c9416e359ae92a431de818db46

                                              SHA256

                                              3fbecd35b82685733fcee466a84715fb82532197549bd35e9b991e9a353dc5d2

                                              SHA512

                                              a3e317ab1e760bfa296797aed73d8f5391399b912b7d59b88a04269b4d5482fea05fc87b1d0e1eb1d4d932976bb32a74d5d5751a1f2445c6158330d51553088e

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5857a1.TMP

                                              Filesize

                                              538B

                                              MD5

                                              fd1a8941f714474a04acc10e5f5f9e63

                                              SHA1

                                              f90588c3cb38c39d3c3eeacb4b64f58ba98f27de

                                              SHA256

                                              50c8d805468a61e796aa5725b2b9ad78bd6b0779be2f8019563084f6e52f0133

                                              SHA512

                                              5d7d4afe9ee65afbec94a3e0297bf5fac2db81fc0833519aa75feee986645c90c05e8663cd552214561a42c843cd5305c681688ee77b00812ebc9678ca6ce36c

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              46295cac801e5d4857d09837238a6394

                                              SHA1

                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                              SHA256

                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                              SHA512

                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              206702161f94c5cd39fadd03f4014d98

                                              SHA1

                                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                              SHA256

                                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                              SHA512

                                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              11KB

                                              MD5

                                              bcead8bdc1a63d386aa6c7220f3cbe4a

                                              SHA1

                                              d01ff327c81c2f8e488964117e1c4d47a0b3cdde

                                              SHA256

                                              eb29e0841a4a516e4926e39d701e0cbd418068c711ec868059647f4f7a05dc01

                                              SHA512

                                              726936c66f9e6ef7120768b1734eb6cf3469d2544f07313669a866124fbfcf11e7534b298bbc05715a0b6f758e0f81af734f334737a1311fe4fbd8de6582056f

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              10KB

                                              MD5

                                              2762bc758fff1a371889e63f81e633e6

                                              SHA1

                                              f4298e4426cb33400280d10a5aae5bef91543072

                                              SHA256

                                              613919bb1e33d1711e3da13cb620ba1daa61a316d8e574429805a3564df7ba6b

                                              SHA512

                                              1bf9c55f9ebf3aa8ee829e0e14f8c31ffa606e9cb4ea88f1c85c8d8c321280b5e307ad35cb89f47cb40f14b1029b66c493f2c077a967490bc25a5129223a0656

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              10KB

                                              MD5

                                              d9046239ae5f4235c5a40b8a7a9e32eb

                                              SHA1

                                              0c3731d4ff6dcbc664268a4fcb82882cd2d0e18c

                                              SHA256

                                              00b95a236703e5093a52a3dc955f1f0f43538729fd89f485e5339192f24e0ed9

                                              SHA512

                                              6b104d4dae0a047c17e90c9b92e694cc368d55d745ea01df47325251f980d63fe7483ec294c4653ad74e257acd090699f846c0046dabb2eb7abbbb9475560937

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3587106988-279496464-3440778474-1000\aa0aab2dc2e3b274f6205167f7e28c65_605430f4-93cf-4c59-84cd-e6cd51bd2585

                                              Filesize

                                              3KB

                                              MD5

                                              dd06f492fc91f213593a064cf44fce23

                                              SHA1

                                              7c0ad154aeb3fd27e33bf1ce7500766dc9a5193f

                                              SHA256

                                              aea1cfa7fba8260419f470479fb1bb8d76d44497feee14d1fb3cf87f07ebea5e

                                              SHA512

                                              9f2020331b907c517dbefd1aadaad1026bfdea2ab39e2ba93689d232e03d5dd4bcf70bf7170fe0b6a63272463bffffacd6ecb270e83542003febf216e731c27d

                                            • C:\Users\Admin\Downloads\Quasar.v1.4.1.zip

                                              Filesize

                                              3.3MB

                                              MD5

                                              13aa4bf4f5ed1ac503c69470b1ede5c1

                                              SHA1

                                              c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00

                                              SHA256

                                              4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

                                              SHA512

                                              767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d

                                            • C:\Users\Admin\Downloads\Quasar.v1.4.1.zip:Zone.Identifier

                                              Filesize

                                              26B

                                              MD5

                                              fbccf14d504b7b2dbcb5a5bda75bd93b

                                              SHA1

                                              d59fc84cdd5217c6cf74785703655f78da6b582b

                                              SHA256

                                              eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                              SHA512

                                              aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                            • C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe

                                              Filesize

                                              3.1MB

                                              MD5

                                              5fae6e71664e29cfc1ed843509449402

                                              SHA1

                                              4591d9257774274dc220c0b86bc2e1c421194c1b

                                              SHA256

                                              3876d854cc3252cb5e90e3aed711d80323a4456c4ae06a88b989a60f873b544c

                                              SHA512

                                              b40cb99d352af9edea53a7ebaa88992e8df4ff585d4b78c5ecf1ab16da8a752d1fddca1305ca88003e3c063a56f7260026f564d9ed681e50f8041f79f7e34fb6

                                            • C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12

                                              Filesize

                                              4KB

                                              MD5

                                              ce1f1e0121104b3b9388e7579515f459

                                              SHA1

                                              65893b04b7a2ef04f226d6f19787275a5d53f88b

                                              SHA256

                                              6412d90c2fafc1fdbea00617096712f778c06a537b7c2764a259cc7798915dbe

                                              SHA512

                                              2dfefde23eb454cebdd3ad4f53050661ae2fb9ab8f5117d8856ebb9817f7de560a60cb9e3e162c8d7b00e0eafc0d9439c5dbcde4dbdcea31b658ac75a4a5d41f

                                            • memory/3964-645-0x0000000000370000-0x0000000000694000-memory.dmp

                                              Filesize

                                              3.1MB

                                            • memory/3996-602-0x0000020952400000-0x00000209524B2000-memory.dmp

                                              Filesize

                                              712KB

                                            • memory/3996-566-0x00000209357C0000-0x00000209358F8000-memory.dmp

                                              Filesize

                                              1.2MB

                                            • memory/3996-603-0x0000020950B20000-0x0000020950B6C000-memory.dmp

                                              Filesize

                                              304KB

                                            • memory/3996-604-0x00000209509C0000-0x0000020950A0B000-memory.dmp

                                              Filesize

                                              300KB

                                            • memory/3996-623-0x0000020952240000-0x000002095225A000-memory.dmp

                                              Filesize

                                              104KB

                                            • memory/3996-622-0x0000020956320000-0x000002095637E000-memory.dmp

                                              Filesize

                                              376KB

                                            • memory/3996-601-0x0000020950A80000-0x0000020950AD0000-memory.dmp

                                              Filesize

                                              320KB

                                            • memory/3996-600-0x0000020950A10000-0x0000020950A28000-memory.dmp

                                              Filesize

                                              96KB

                                            • memory/3996-568-0x0000020952810000-0x0000020952B3E000-memory.dmp

                                              Filesize

                                              3.2MB

                                            • memory/3996-567-0x0000020935D80000-0x0000020935D96000-memory.dmp

                                              Filesize

                                              88KB