quasar | hxxps://github[.]com/robloxopensrc/robIox-cdn/blob/main/OneDrive[.]exe

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/01/2025, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/robloxopensrc/robIox-cdn/blob/main/OneDrive.exe

Score

10^/10

quasar test discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Test

147.185.221.22:54755

Mutex

9cabbafb-503b-49f1-ab22-adc756455c10

Attributes

encryption_key
8B93C77AC1C58EA80A3327E9FD26246A79EF3B8E
install_name
Onedrive.exe
log_directory
Logs
reconnect_delay
100
startup_key
Microsoft OneDrive
subdirectory
Onedrive

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023ce7-143.dat	family_quasar
behavioral1/memory/5336-184-0x00000000003C0000-0x00000000006FC000-memory.dmp	family_quasar

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
5336	OneDrive.exe
5540	Onedrive.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
48	raw.githubusercontent.com
49	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 939687.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe\:SmartScreen:$DATA	OneDrive.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5480	schtasks.exe
5600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe
892	msedge.exe
892	msedge.exe
3980	identity_helper.exe
3980	identity_helper.exe
5196	msedge.exe
5196	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5336	OneDrive.exe
Token: SeDebugPrivilege	5540	Onedrive.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 712	892	msedge.exe	84
PID 892 wrote to memory of 712	892	msedge.exe	84
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 3948	892	msedge.exe	85
PID 892 wrote to memory of 1764	892	msedge.exe	86
PID 892 wrote to memory of 1764	892	msedge.exe	86
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87
PID 892 wrote to memory of 3612	892	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/robloxopensrc/robIox-cdn/blob/main/OneDrive.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc53746f8,0x7ffbc5374708,0x7ffbc5374718
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1396 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5196
- C:\Users\Admin\Downloads\OneDrive.exe
  "C:\Users\Admin\Downloads\OneDrive.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:5336
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Microsoft OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5480
- - C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe
    "C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5540
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Microsoft OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Onedrive\Onedrive.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5220008547464056567,2505954600508765833,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Onedrive.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b03d774ab509be9142c61929890b1c3a

SHA1
24292b61b021e5ab4579fd6626ec72d022eab766

SHA256
f5c682d4f2029b5bf136b78e9b6e3a00261ec07844d1fab4cee136d7ead87166

SHA512
8fa575bc80ea95507eb26963a4b489deca0a245c3bcf898a03c0889d833cf9849734a6ece0cbcf4f1259e42f8087d1f03ad78e4335ef8e461d79094afad48f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
0a8a7c3dafeb4ad3d8cb846fc95b8f1c

SHA1
69e2b994e6882e1e783410dae53181984050fa13

SHA256
a88495f2c1c26c6c1d5690a29289467c8bb8a94bf6f4801d2c14da1456773f90

SHA512
2e59b4cd4cf6f86537aae4ae88e56e21abcff5070c5c1d1d2105a8e863523c80740438cc36b2b57672bc7bb7fb9387896135afcce534edfd4697fecf61031a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a4b57e906bcd0a42895ce556b50a0a0e

SHA1
a0f7b298b8723619b59c6f5effb3c5cec635154d

SHA256
6ef99089b6216d11a77d42b547eefd7991d2cdb542c9d02ea926873c6dabe8fc

SHA512
a68cf7cb06fdc3e0572f0b5edede2280e46658fc28d8571302eb5e85c64393aa0f5acb07eca873024feeadcc3d7840f0f6ee3ae5443ddf5f5058619ea65ea636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53a64aa149546dd71cc81fa7b60e6eca

SHA1
085e09be0f9da901676b874d40da882531a824f6

SHA256
1a9359f9face5af47d2f7cc0c7f89e161579f7b09323eafdc2b27f964ecfb981

SHA512
6b1149f92f930d366112562ff6483a2a6a1691e4803659eaa912f9dfb0470e1043c0a04dc9aa45c1b03c335a5a43117b9d949e1615a2429a4c98ec706982cdec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6283a4bb6fc8b9194f708da680dd2413

SHA1
234ac453441a35ae7d2a6f0051d16b5fb98d8f14

SHA256
7d28fef63a7813e4ea21e97bd8f5857e2a5a7cc494e95d1d75c8899bfb5b8d44

SHA512
266b7da3bd8e81ddb9955da1d1bdc90d8716c2755bfbd7cc19b77d44d43e0a5d87816cda9358bce863fa79264dbb6a6c22e954d5786664f5d36ee654b23057dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0f0820a5bd0fba65375d1470919333cd

SHA1
ccee82c829ffb69abfd451b43af7eef54400ef16

SHA256
abc8e03ef6eea4b82e6432bfd0cce0d9458d8a97faf1b4385f4b7895f1b53f18

SHA512
942dec0b54e1128fe5889d94804a2723678d25f051e66446f5d0dbbe8c1f46581845f1f57787cb4e95f37da3fbae9ef97be160422f8848d13d6692ce494c6f0c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 939687.crdownload

Filesize
3.2MB

MD5
7056e050ebbfca6ae325797d51eb2d0a

SHA1
055cd6e4bde3449d72f7061620647ecb73d6b9cd

SHA256
c316b0b818125541a90d7110af8c0908a8d6c73d3b846a27aed647fab6b38e00

SHA512
0c54802ad35f5a00c5db1195df2d566bc18a384f486cc3ca00dc63bb86e3fc5d105192cfe5efe9ed62bdedb441877486ec7aedbd7a6bf59fcda2f772308b150e

Download Submit
memory/5336-184-0x00000000003C0000-0x00000000006FC000-memory.dmp

Filesize
3.2MB

Download
memory/5540-192-0x000000001B770000-0x000000001B7C0000-memory.dmp

Filesize
320KB

Download
memory/5540-193-0x000000001B880000-0x000000001B932000-memory.dmp

Filesize
712KB

Download