hxxps://www[.]darknet[.]org[.]uk/2020/05/quasar-rat-windows-remote-administration-tool/

Resubmissions

22-01-2025 19:57

250122-ypc7gsspdv 10

22-01-2025 19:54

250122-ymnv7ssndy 3

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.darknet.org.uk/2020/05/quasar-rat-windows-remote-administration-tool/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1328	msedge.exe
1328	msedge.exe
2140	identity_helper.exe
2140	identity_helper.exe
4960	msedge.exe
4960	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe
5872	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6060	Quasar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
6060	Quasar.exe
6060	Quasar.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
6060	Quasar.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 1948	1328	msedge.exe	84
PID 1328 wrote to memory of 1948	1328	msedge.exe	84
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 64	1328	msedge.exe	85
PID 1328 wrote to memory of 1620	1328	msedge.exe	86
PID 1328 wrote to memory of 1620	1328	msedge.exe	86
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87
PID 1328 wrote to memory of 1932	1328	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.darknet.org.uk/2020/05/quasar-rat-windows-remote-administration-tool/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffef21e46f8,0x7ffef21e4708,0x7ffef21e4718
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12910267045441491300,7068121910612609746,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5692

C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\Quasar.exe
"C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\Quasar.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
66KB

MD5
06702fdff4205590c1caa29b580e9620

SHA1
966017a8f488ddc3707f7d2c22a6c7eb51f58f29

SHA256
7586590346cdb9520dc3cf7131e5662b3c4407d2624ec22dd0e1c1eb9725ce36

SHA512
7c39333eb130eba6c9f57c50b8b6fbebf90c3cd49bbd7a967c6d31f7b997ea085770b84caf4ae2d984898a445535a20777c671e382e2da01e21e1c40248d322d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
611KB

MD5
ac17f5bfbdc14e9d9e8100d64cd9094d

SHA1
dd5b3afeb326fc02a59e3eb667abd68e2088212c

SHA256
30a4ec904324aab10b9f77127944ec98e8e1f222c893c1862f3bed4970ead8fb

SHA512
733a79e5326f6a09b5c4b4fa648bb967cbdf5ec00b389df8a12ddc0c46bd326e4ca7ad98e61b009a373ac404828444094498408b5683fec4e63251900ba3621f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ee1a254bc7d508c7de019fcc86e22254

SHA1
33bf9d1beae704ed3dbc1569bdc7d17b599a8a93

SHA256
d8d3fbaad0908af2ab77480113f55705900708d5f03d9d510db0706b1eb60716

SHA512
e0954a543a3b11296e8cfee187770eb040170d3bd8a1ee9a211d34fae452eae9b7b3bc5fc1e74c1372ac950b3a18b6b6c945fc9c692068e09b6d8c3cfdf8cd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1ed31854793c94334a877789755de4dd

SHA1
beabb70e3c48da0815bd93c8f426ce83df582529

SHA256
c784000cb0cd277b47c5a1721dc9bc98f26a9fad6b9bdaf5e2258c27f31db669

SHA512
ede43ecd407573d17bfcd484665e63292b222b37368aea8b67d47ea58a79372b112d6c9aa32c1969916f3c81efda4d8d9b1a19b884f5fccc318b2d9736aa267f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1dccada4037cd4c38a0f387ad8ba0b7f

SHA1
236d47b6480f55e9cd456a26487999e1459889d4

SHA256
2a5461870036e2a36e9c46f5f8e03e69de2a493517aa1674d052f70de0ca8ca3

SHA512
147b811f2b6bce2beec8b0e25ba201344ab58acec346a143e85b98cbe6f79e6925bd2309011fd8f9bec18ece246f3ea8edfffc06b9b8b05ef988f84c83c99885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4249dcbcfae97013429538acc94209c3

SHA1
864b5a48e64a7c42dd8a88959e713fa1a426a679

SHA256
f023835d372423a5ead67e0a57a49b6bdffcf83a9da8f445773940f772894205

SHA512
955486fff27efc0b8dfe2a8d0499bfb1581ce652b7c95edbe97b57e1a68fb798eb02ef16115fb5311ad3bb83f89b01b097132c46b82891036b0314d243ab478f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
79997af2ec01bfd26c2c752debbd3d33

SHA1
88d1a7fc07101fb557fad2ad8c3336a4deef8d88

SHA256
43e30887dec6d075413778231b89088d2f5f8fb5d9877372b96f676f04847cbd

SHA512
a717e383ac063a5196dac2b561db0e08cf001cd79e654af04987c188aa7539cf21a80c60437dc91cb9f26242f2234570fd6434ff595d8d9f3f4e4ea38808565f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
0217e8ab36c56bbceb3f607c9affce05

SHA1
d6a55646747853c81f76c498da839406f0dfbc25

SHA256
74a369a3f6fe5c9842fa7894b1e84dfc9b4caf20e9eba661ba7bda8ad6dc18c9

SHA512
6dce2be2e1243e86529f91df365db1c54d91f6c681d571421ed02b9e79c211e6ee4b96d30920903cdf521b6a9b90d742159b0fb581c3ac1cf7190d5eb1c30772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580450.TMP

Filesize
371B

MD5
1b571438b4cb543d60a3a854da86eba8

SHA1
9a4b83ac399c0297ff018cdfdbd26a8f8618eb46

SHA256
c43a1db1cbd208b8b6455de902793fb1212359fd58a394206139c7d4eb022452

SHA512
d8c43d04153091c1bf398370df83c166bc15cf9243bbec8c56042fed4d2f81920b6f7e68ab09678b8db9d82956145b060ed58d4aa5b34399c696c89529b538a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
02b7815f15ba5453d74dde3ec5437c7e

SHA1
9363f737e8f798e9cc7f2255c69bc0230dfbcca4

SHA256
04444a0daa59094e487b9fce50fd432382d51d9d58824e5884979d117c757cd4

SHA512
1d29d6a9ecbb5b9441ee27dba23e0d319c7ee942ee2be47e126467815f526c77547e19ff70814d456b8fa9619642dd6843c33d51bc8614c122708d5ac3a25e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
189e106154fb430310949c3478c7a968

SHA1
c0fd7df037bf402b4c40d62afd1681da2f73f05c

SHA256
cfb7e9299fdc364996f2ceac036e46337777484dfe3daa2bdcbdf8cecc375d34

SHA512
2b7c919081a64becaeea67bb77cdd9485473b932c5c8947c52f8232d9720769941cb411c9cf2b9a4fefb8f4dd3987f8582629e556584308e70145b0bd2db2059

Download Submit
C:\Users\Admin\Desktop\Quasar.v1.3.0.0\Quasar v1.3.0.0\settings.xml

Filesize
51B

MD5
8af01757cc429d1347430084913566d1

SHA1
e4ec570a0b1a5c99e0613da232eeff4b42ffaa75

SHA256
f1a33cd5b1c9368f73b8ff144bed026664577317df27baff774b2bd2acbd52ef

SHA512
3edbca5a661d0fbdd0f8aac994b50e3f844e1d6ee6bfeadf0d8aa89fab1b7cec69b9f687a704c7a989726bb676604e2cdb75ca30441e94a05fdd4027ec9a494a

Download Submit
memory/6060-328-0x0000000000250000-0x00000000003BC000-memory.dmp

Filesize
1.4MB

Download
memory/6060-351-0x000000001D5F0000-0x000000001D600000-memory.dmp

Filesize
64KB

Download