quasar | hxxps://github[.]com/God-spec-sniper/token-joiner

Analysis

max time kernel
71s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2025, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/God-spec-sniper/token-joiner

Score

10^/10

quasar windows discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Windows

161.129.37.116:65535

Mutex

3c3c730b-a42a-4ea5-bef9-01989b92d81f

Attributes

encryption_key
BB189C4C49893F59CDC052C41C41F6B55D578553
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Client
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/3528-218-0x0000000000A00000-0x0000000000D24000-memory.dmp	family_quasar
behavioral1/files/0x0007000000023d40-222.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
1544	Client.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\SubDir\Client.exe	main.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	main.exe
File opened for modification	C:\Program Files\SubDir	main.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000_Classes\Local Settings	OpenWith.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4216	schtasks.exe
1376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
232	msedge.exe
232	msedge.exe
4232	identity_helper.exe
4232	identity_helper.exe
5008	msedge.exe
5008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3528	main.exe
Token: SeDebugPrivilege	1544	Client.exe
Token: SeDebugPrivilege	5112	main.exe
Token: SeDebugPrivilege	4312	main.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
1544	Client.exe
3148	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe
948	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 2000	232	msedge.exe	83
PID 232 wrote to memory of 2000	232	msedge.exe	83
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2004	232	msedge.exe	84
PID 232 wrote to memory of 2148	232	msedge.exe	85
PID 232 wrote to memory of 2148	232	msedge.exe	85
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86
PID 232 wrote to memory of 3996	232	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/God-spec-sniper/token-joiner
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa3d946f8,0x7ffaa3d94708,0x7ffaa3d94718
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,8685555107729058527,13559789869768858117,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,8685555107729058527,13559789869768858117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,8685555107729058527,13559789869768858117,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8685555107729058527,13559789869768858117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8685555107729058527,13559789869768858117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8685555107729058527,13559789869768858117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8685555107729058527,13559789869768858117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8685555107729058527,13559789869768858117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8685555107729058527,13559789869768858117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,8685555107729058527,13559789869768858117,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8685555107729058527,13559789869768858117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,8685555107729058527,13559789869768858117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8685555107729058527,13559789869768858117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8685555107729058527,13559789869768858117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2324

C:\Users\Admin\Downloads\token-joiner-main\token-joiner-main\main.exe
"C:\Users\Admin\Downloads\token-joiner-main\token-joiner-main\main.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3528
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Client" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4216
- C:\Program Files\SubDir\Client.exe
  "C:\Program Files\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1544
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Client" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1376

C:\Users\Admin\Downloads\token-joiner-main\token-joiner-main\main.exe
"C:\Users\Admin\Downloads\token-joiner-main\token-joiner-main\main.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5112

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3148

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:948
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\token-joiner-main\token-joiner-main\config.json
  2⤵
  PID:4228

C:\Users\Admin\Downloads\token-joiner-main\token-joiner-main\main.exe
"C:\Users\Admin\Downloads\token-joiner-main\token-joiner-main\main.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\SubDir\Client.exe

Filesize
3.1MB

MD5
d25ea3161e833c35dd2d8218ce76f644

SHA1
977ebf1bc9a77ae60ead625812a7e7418d3382b2

SHA256
3b1902dc56cc686ff15f287a4086e595b8cab87b006e58bd4ef09b2715653cdd

SHA512
a96d356af8913bad6a6e400ddce6535f1360a5411b86d7f46c8efa033d241ea1997b3142474f2de81905e90a381af75d8c2f0a769c78d0d592221dfc79233bad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\main.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc29044ff79dd25458f32c381dc676af

SHA1
f4657c0bee9b865607ec3686b8d4f5d4c2c61cd7

SHA256
efe711204437661603d6e59765aba1654678f2093075c1eb2340dc5e80a1140f

SHA512
3d484f755d88c0485195b247230edb79c07cc0941dedbf2f34738ae4f80ba90595f5094c449b213c0c871ade6aff0a14d4acfe843186e2421ccbad221d34bf54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709e5bc1c62a5aa20abcf92d1a3ae51c

SHA1
71c8b6688cd83f8ba088d3d44d851c19ee9ccff6

SHA256
aa718e97104d2a4c68a9dad4aae806a22060702177f836403094f7ca7f0f8d4e

SHA512
b9fc809fbb95b29336e5102382295d71235b0e3a54828b40380958a7feaf27c6407461765680e1f61d88e2692e912f8ec677a66ff965854bea6afae69d99cf24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7bc1c2a3582da7c1f8055aef1bdddf3b

SHA1
008f8704cc688aaad7c5a82f93978a307be71150

SHA256
c72d155487e82a49b8af79798686ff8cbd43924489ef95c8141092193aab3577

SHA512
f5bf8d296a052b5ffd4597adf6e245fa0ffc4bb7d15a1453c3dbe3d139028e475a55ed58684f5fe153767731df062a46fd9d050feb1c165c21175a3c48c85a1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
a6d346f58cbec0a6e4015327b25f1537

SHA1
750056e65a8b1c20b1a6051f5adcdf35821a6ac1

SHA256
1a715b1b5b62ef83ca8c62a18eddb3b5b6b738be2c654ab7a38cf22fdc8bea56

SHA512
74e563217a28cd6427739731f51ba2e35ee060c8ae6959d458d06a0416e17ffc6a49f8d0bbcb8d17cef144a45c36eb9f3b92305389ab0cfc5043f530d9f28d89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
67f635372ef17873a871cb8f5c7f5b1d

SHA1
11ef399df44f68ef558df6d49e8a89e5e326d04f

SHA256
e49230f8521438b0cd776ea3084d4b2485b59827d53ccd97744f6f3b8285af27

SHA512
65234e5b9fd788fa9f5827fa33ed274b31220c910f9d977caf6aebb52765d240d3275a61164a3db3c4462e0a7de9b49ff77d5314a287950731047777130ef7a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa606af52decc8bfd55b830c9ce93ab3

SHA1
222cbc093631739fdef1bb99872303aa4cea64e2

SHA256
5b91deac3e4de5030bcf4ed7198a59556fa020536f21b6d27e168a8867eea617

SHA512
12632ce446b0b6fad56ad6e14499419f263d9700363e4002e67f2ddf26abe066304d7ac282f61191256be932da3ff5fdddd8f3a6c18014479894075039bc219a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d44ab4ebec5871b3846a972e47922cd5

SHA1
eddf584d647435caa4df5a334437baff2634fa28

SHA256
dfed86b0c115128640e41d04865bc958e77bfd44ff87b8dde2e2aa6357e6d356

SHA512
2d778a7a1cf698f17bf395b958ea13e5e32fcac37c46c4f05949b0145f77d323ec078d6b14c0e3f07e7680dda40323210a39ea4138a149d6340fea0d41b03107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1f5c73abeab3fe4e08fbe4be15cfd253

SHA1
ad9fbe64c0f11e525d969baebae884f7016f8be0

SHA256
9d6fccb2cf086dfad94e9201d9b69dc88226b793bc70a124f189b293b15705eb

SHA512
1c879f3dbfa95a58426ba542c208add9cbb65af2c55a36a7a421be8885e8e1ab77ba8c8cab142c96ec31dcb82c122c726b235c0d601a93ebe56c6484ff4a46b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581da5.TMP

Filesize
1KB

MD5
7ef0c3da8c58e973fe0d3ef4337599c2

SHA1
040a0fbf41635f50c9090fcdbdd2c31b84c8f746

SHA256
92baa721a1a68737c91e264d9cf5447b8335ee7b209726b124445edad4a8f34d

SHA512
eb9067aba907bed7e297a32ee8c56d4bd3c4a03dd4e196551e9e23c82f27397f2c19545a227df9c3a6c6a5b65f5be206944ae1714e38e1bf1af2372de06be4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
98cfdc29fdc2542c61172e3efee5a303

SHA1
939e12498b3eeef27e70b272a6ee1837be01f55f

SHA256
4c13b8fd477f39323da9a45eddcb583b110fb60142ca2c5b052136a34d6971f5

SHA512
525e1f7e7de655ef7693151c1a34bb277904c77acc507bd7bf28c373469ecb0a2ff0ec1dafc970d808aa3e5c9cdda66dc430f42ac7cfffe9733d54ccbf10ccee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ba6bdadfbf022f451c52cec8597e55c1

SHA1
965806d14b75e6519deaa6ef7a629827fe0b885d

SHA256
cb0bdd5db071fb7aa6b5f955868b79b0bfee2560d6652dbf156576e9f94fc7ac

SHA512
8fcfd12fc38f00662e67aa5842ad23512dd63e3835e4a2ed8ba8287f0c6eac77d48c23f20024ccc3f110891f577b096c01f0bae5878135633c7536145dd3d941

Download Submit
C:\Users\Admin\Downloads\token-joiner-main.zip

Filesize
1.2MB

MD5
175bc3a11b668c654a7538a9f5ef13d3

SHA1
1b4283d246a41b8f9272cc4828f39d41d0f28389

SHA256
c5a68326de50622070e0079cb976ae0fb33257735951b102e03af45219a8b7fb

SHA512
623ed31e1fb9ee5ecee088bfa655270217dcf1ac9c51ae149fdb047186066bed307cd2dd98d7c6c03b94494b28099fdf36b634b219511c2957c0c5c85cbbcae4

Download Submit
memory/1544-226-0x000000001C6D0000-0x000000001C782000-memory.dmp

Filesize
712KB

Download
memory/1544-227-0x00000000032C0000-0x00000000032D2000-memory.dmp

Filesize
72KB

Download
memory/1544-228-0x000000001C690000-0x000000001C6CC000-memory.dmp

Filesize
240KB

Download
memory/1544-225-0x000000001C5C0000-0x000000001C610000-memory.dmp

Filesize
320KB

Download
memory/3528-218-0x0000000000A00000-0x0000000000D24000-memory.dmp

Filesize
3.1MB

Download