quasar | hxxp://www[.]anydesk[.]com

Analysis

max time kernel
457s
max time network
457s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
20/03/2025, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.anydesk.com

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.5.0

Botnet

Office04

212.102.63.147:4782

Mutex

e8c0a3da-40e7-4a87-91d8-66ab612d6ebf

Attributes

encryption_key
BA09220274F4043E6EFA586B4F4D01F5267E9D07
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Modded Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 4 IoCs

resource	yara_rule
behavioral1/memory/4608-2150-0x000001DB223E0000-0x000001DB22814000-memory.dmp	family_quasar
behavioral1/memory/4608-2151-0x000001DB22C00000-0x000001DB22C18000-memory.dmp	family_quasar
behavioral1/memory/972-3488-0x000001F394D10000-0x000001F394DA0000-memory.dmp	family_quasar
behavioral1/memory/972-3489-0x000001F396A10000-0x000001F396A28000-memory.dmp	family_quasar

Executes dropped EXE 4 IoCs

pid	Process
972	Client-built.exe
8172	Client.exe
9004	Client-built.exe
9124	Client-built.exe

Loads dropped DLL 1 IoCs

pid	Process
3636	msedge.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
495	camo.githubusercontent.com
468	camo.githubusercontent.com
472	camo.githubusercontent.com
474	raw.githubusercontent.com
475	raw.githubusercontent.com
477	raw.githubusercontent.com
478	raw.githubusercontent.com
496	camo.githubusercontent.com
469	camo.githubusercontent.com
470	camo.githubusercontent.com
471	camo.githubusercontent.com
473	raw.githubusercontent.com
476	raw.githubusercontent.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
525	whatismyipaddress.com
526	whatismyipaddress.com
523	whatismyipaddress.com
524	whatismyipaddress.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_790627153\hyph-ml.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_728597612\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_354087592\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-notification\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-notification\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\Notification\notification_fast.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_354087592\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-notification\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-tokenized-card\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-tokenized-card\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-shared-components\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-mobile-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\Wallet-Checkout\load-ec-i18n.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\wallet-webui-101.079f5d74a18127cd9d6a.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_790627153\hyph-pa.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_354087592\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-mobile-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-notification-shared\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-shared-components\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_774633054\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1559143310\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_790627153\hyph-hu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-tokenized-card\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\wallet\wallet-checkout-eligible-sites.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_790627153\hyph-uk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-ec\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-notification-shared\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-notification-shared\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\wallet-icon.svg	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1295796053\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_790627153\hyph-es.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-ec\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-notification\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\wallet\wallet-tokenization-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\Wallet-BuyNow\wallet-buynow.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\wallet-webui-992.268aa821c3090dce03cb.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3356_1145996810\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\Notification\notification.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\wallet_checkout_autofill_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_790627153\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-ec\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-notification-shared\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-shared-components\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-shared-components\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\runtime.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-hub\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-shared-components\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\wallet\wallet-notification-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\Wallet-Checkout\wallet-drawer.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_1559143310\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_790627153\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_790627153\hyph-nb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_790627153\hyph-nn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-ec\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-mobile-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-mobile-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-notification-shared\nl\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133870122679790452"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\NodeSlot = "5"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 010000000000000002000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).right = "674"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 000000000200000001000000ffffffff	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).y = "4294967295"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 78003100000000006e5a06a41100557365727300640009000400efbe874f7748755ae1332e000000fd0100000000010000000000000000003a00000000009457670055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 50003100000000006e5a89aa100041646d696e003c0009000400efbe6e5a06a4755ae1332e000000f5050100000002000000000000000000000000000000134fd400410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0 = 7e00310000000000755a403411004465736b746f7000680009000400efbe6e5a06a4755a40342e000000ff0501000000020000000000000000003e000000000040c195004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 = 4a00310000000000755a4b34100072656100380009000400efbe755a4034755a4b342e000000ce830200000007000000000000000000000000000000c9859a00720065006100000012000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).x = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1280x720x96(1).x = "4294967295"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\NodeSlot = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "6"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 000000000100000002000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\build_output.zip:Zone.Identifier	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7432	schtasks.exe
936	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4940	explorer.exe
8172	Client.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
2212	msedge.exe
2212	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4940	explorer.exe
4608	Quasar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: 33	4192	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4192	AUDIODG.EXE
Token: SeDebugPrivilege	5868	firefox.exe
Token: SeDebugPrivilege	5868	firefox.exe
Token: SeDebugPrivilege	5868	firefox.exe
Token: SeDebugPrivilege	5868	firefox.exe
Token: SeDebugPrivilege	5868	firefox.exe
Token: SeDebugPrivilege	5868	firefox.exe
Token: SeDebugPrivilege	972	Client-built.exe
Token: SeDebugPrivilege	8172	Client.exe
Token: SeDebugPrivilege	5868	firefox.exe
Token: SeDebugPrivilege	9004	Client-built.exe
Token: SeDebugPrivilege	9124	Client-built.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe

Suspicious use of SendNotifyMessage 54 IoCs

pid	Process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
4608	Quasar.exe
4608	Quasar.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
4940	explorer.exe
4940	explorer.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
4608	Quasar.exe
8172	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 2620	3356	msedge.exe	81
PID 3356 wrote to memory of 2620	3356	msedge.exe	81
PID 3356 wrote to memory of 4620	3356	msedge.exe	82
PID 3356 wrote to memory of 4620	3356	msedge.exe	82
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 1140	3356	msedge.exe	83
PID 3356 wrote to memory of 5512	3356	msedge.exe	85
PID 3356 wrote to memory of 5512	3356	msedge.exe	85
PID 3356 wrote to memory of 5512	3356	msedge.exe	85
PID 3356 wrote to memory of 5512	3356	msedge.exe	85
PID 3356 wrote to memory of 5512	3356	msedge.exe	85
PID 3356 wrote to memory of 5512	3356	msedge.exe	85
PID 3356 wrote to memory of 5512	3356	msedge.exe	85
PID 3356 wrote to memory of 5512	3356	msedge.exe	85
PID 3356 wrote to memory of 5512	3356	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://www.anydesk.com
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x2c0,0x7ffa3484f208,0x7ffa3484f214,0x7ffa3484f220
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1924,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2240,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2608,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3420,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3428,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5016,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4808,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5288,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3412,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5604,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5760,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5768,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6360,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6580,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6580,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6792,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6160,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6756,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6692,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6440,i,6856572376870152323,10316027048264559438,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x288,0x7ffa3484f208,0x7ffa3484f214,0x7ffa3484f220
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1896,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2216,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2556,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:8
    3⤵
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4192,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4192,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4524,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=136,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
    3⤵
    PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4504,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:8
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4408,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4944,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5012,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4640,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5040,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4996,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2824,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3764,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
    3⤵
    PID:7392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4964,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4244,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=1072 /prefetch:8
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3496,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
    3⤵
    PID:6256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3244,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:8
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4068,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
    3⤵
    PID:8428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5080,i,7243008203791257909,13521164287648032099,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
    3⤵
    PID:9164

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3144

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x454 0x3fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5624

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4952
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27100 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {bf971f55-555e-49e0-ae13-6b56ee882b56} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27136 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2468 -initialChannelId {15f33481-139a-4b2f-98f0-3492edb82ab0} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3748 -prefsLen 27277 -prefMapHandle 3752 -prefMapSize 270279 -jsInitHandle 3756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3764 -initialChannelId {bb1f122f-bd54-4f02-a36c-708589917ae4} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3916 -prefsLen 27277 -prefMapHandle 3920 -prefMapSize 270279 -ipcHandle 3944 -initialChannelId {5fdcbc0c-2d9f-40bf-acc8-d103821f173c} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3112 -prefsLen 34776 -prefMapHandle 3140 -prefMapSize 270279 -jsInitHandle 920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1628 -initialChannelId {f3aba18f-475c-4d46-b5b5-8e4153043ba3} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5040 -prefsLen 35013 -prefMapHandle 5044 -prefMapSize 270279 -ipcHandle 5004 -initialChannelId {fcbd3ed0-a7cc-4740-b882-07d2ade78b32} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5244 -prefsLen 32900 -prefMapHandle 5248 -prefMapSize 270279 -jsInitHandle 5252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5260 -initialChannelId {471ead29-4266-4dbb-8216-7da16a3708ee} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32952 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5460 -initialChannelId {f21835be-6d6a-450a-9cfa-c36175121df7} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5612 -prefsLen 32952 -prefMapHandle 5652 -prefMapSize 270279 -jsInitHandle 5656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5664 -initialChannelId {1c48f636-b8ef-4df7-849e-508477cd4480} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6236 -prefsLen 33071 -prefMapHandle 6240 -prefMapSize 270279 -jsInitHandle 6244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6252 -initialChannelId {7514ea42-a084-4b9c-ab54-f8103d4e6619} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 448 -prefsLen 36501 -prefMapHandle 6596 -prefMapSize 270279 -jsInitHandle 2804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4732 -initialChannelId {aba0e726-537c-41db-8aa0-6cb752c3d519} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:6128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7280 -prefsLen 36541 -prefMapHandle 7284 -prefMapSize 270279 -jsInitHandle 7288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7268 -initialChannelId {11acf772-f3ba-4162-ae84-1bde256db6aa} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7696 -prefsLen 36541 -prefMapHandle 7700 -prefMapSize 270279 -jsInitHandle 7704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7708 -initialChannelId {bbd5e3d3-490c-437c-9de0-54f39044f8ca} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8452 -prefsLen 36541 -prefMapHandle 8456 -prefMapSize 270279 -jsInitHandle 8460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8468 -initialChannelId {ecbae64e-f68a-488d-9fe0-2f29ce279c69} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:4196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8268 -prefsLen 36541 -prefMapHandle 8696 -prefMapSize 270279 -jsInitHandle 8700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8708 -initialChannelId {0b04f13c-5923-4fd4-82bc-842a4fe01bcd} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:3128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8932 -prefsLen 36541 -prefMapHandle 8936 -prefMapSize 270279 -jsInitHandle 8940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8900 -initialChannelId {0da7ddd1-9826-4365-b8cc-ffe6b578a098} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:4304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8944 -prefsLen 36541 -prefMapHandle 8948 -prefMapSize 270279 -jsInitHandle 8896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8956 -initialChannelId {e3230a13-d182-447a-878f-8b52635f7777} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:2796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8992 -prefsLen 36541 -prefMapHandle 8996 -prefMapSize 270279 -jsInitHandle 9000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8964 -initialChannelId {4968b7b5-e11a-4749-a88e-d150974c3cb1} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:4444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9032 -prefsLen 36541 -prefMapHandle 9036 -prefMapSize 270279 -jsInitHandle 9040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9020 -initialChannelId {8c73a3ef-8fc5-4db6-a029-9ca472ac37b9} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:4664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9688 -prefsLen 36541 -prefMapHandle 9580 -prefMapSize 270279 -jsInitHandle 9576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9568 -initialChannelId {9feffbda-485b-41e5-a8e6-dc0b2c0a5154} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:4864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10028 -prefsLen 36541 -prefMapHandle 10032 -prefMapSize 270279 -jsInitHandle 10036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10044 -initialChannelId {9849b941-3d30-4fa3-b097-2176200e8c81} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:1280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10224 -prefsLen 36541 -prefMapHandle 10092 -prefMapSize 270279 -jsInitHandle 10268 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10280 -initialChannelId {772b5ccf-1c70-4594-928d-6adae7a9993a} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:5656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9548 -prefsLen 36541 -prefMapHandle 9544 -prefMapSize 270279 -jsInitHandle 9540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9532 -initialChannelId {c8edeec9-16b2-4c8a-9223-e0c35d903a68} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:2540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10224 -prefsLen 36541 -prefMapHandle 10092 -prefMapSize 270279 -jsInitHandle 10228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10980 -initialChannelId {f4925a4a-7a47-4838-b2ff-9c6475974f13} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:6860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8836 -prefsLen 36541 -prefMapHandle 8832 -prefMapSize 270279 -jsInitHandle 8696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8856 -initialChannelId {f2b8fd8c-8862-4e95-a65b-d81348fec6a5} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    - Checks processor information in registry
    PID:6912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8860 -prefsLen 36541 -prefMapHandle 8864 -prefMapSize 270279 -jsInitHandle 8868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8880 -initialChannelId {6d545eb0-6711-4d1c-aada-9cae37957c3c} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    - Checks processor information in registry
    PID:6920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3060 -prefsLen 36541 -prefMapHandle 6816 -prefMapSize 270279 -jsInitHandle 8212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4680 -initialChannelId {de513f2e-b633-454b-b458-81a2459e2b9e} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    - Checks processor information in registry
    PID:5824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4836 -prefsLen 36541 -prefMapHandle 2736 -prefMapSize 270279 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6776 -initialChannelId {029b47f0-8405-4a37-8e51-1e271f7e2d42} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
    3⤵
    - Checks processor information in registry
    PID:4556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11416 -prefsLen 36541 -prefMapHandle 11412 -prefMapSize 270279 -jsInitHandle 11408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8208 -initialChannelId {89e58d3f-c84a-446b-a01d-0b8c06637b64} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
    3⤵
    - Checks processor information in registry
    PID:7552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11228 -prefsLen 36541 -prefMapHandle 11240 -prefMapSize 270279 -jsInitHandle 8836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7436 -initialChannelId {43d0e1bd-93fe-45c7-8e30-e02c9408ccaa} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
    3⤵
    - Checks processor information in registry
    PID:7564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11084 -prefsLen 36541 -prefMapHandle 11080 -prefMapSize 270279 -jsInitHandle 10936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12180 -initialChannelId {93f49c3f-de4f-41c2-ba75-35ec95fce203} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
    3⤵
    - Checks processor information in registry
    PID:7576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 12104 -prefsLen 39427 -prefMapHandle 7312 -prefMapSize 270279 -ipcHandle 12036 -initialChannelId {43151a28-84e6-4f65-8f8f-a9e74e186abb} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 utility
    3⤵
    - Checks processor information in registry
    PID:7916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12772 -prefsLen 36541 -prefMapHandle 12768 -prefMapSize 270279 -jsInitHandle 12764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12800 -initialChannelId {222461b3-b098-4f55-8ce7-1d7bfe90b24f} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
    3⤵
    - Checks processor information in registry
    PID:7972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4888

C:\Users\Admin\Desktop\rea\Quasar.exe
"C:\Users\Admin\Desktop\rea\Quasar.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4608
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Desktop\rea\quasar.p12"
  2⤵
  PID:4888

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4940
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:972
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Modded Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7432
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:8172
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Modded Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:936
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:9004
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:9124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
aa9afd16e8041e8c80250b50ea6899e4

SHA1
a3a698d431952253255c343f2b35f74e73e63088

SHA256
2bd7f856d73f78bc3a4de32b447b21babad42c009b19fcebe2f8cdeca2380926

SHA512
344de0888df8851d957ca6fab055eb9e2f1aa6d958022c2c30442cd6aad4d158d0a99f8908184abc60fb1e0ccdd3d9395d8c0d37fc317d3700974c3348d4a5ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
5479ce72eb26b5bdf12826277a54f509

SHA1
dfcc2bd35c31a44ecbeeee79106fc1f5d7d19607

SHA256
8bb38f325706661847ae9ac4ac2be6baa62cfc5cc4ff7200e8bf63822d37d85e

SHA512
263564765267ede4f7f5889a14caf4e8a180aae0cd8442ff0e4ee849f127434f7fa30b7bf027d1415bf4c939313a0b2442439b45381e375beba503caf3d09347

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
3c5b56acefb80163358e653688327d1c

SHA1
f672e36cedb550b231e043292cf43cf6d0c77e9d

SHA256
f2d595cd6bd5fe92b63200d39df7ea396266809ce17fc41d2bc9cbd87172e223

SHA512
e12f0e5dbffbb1627bb4e3ad92ecfec02ef43e0ffa35989d52e2fd5e92d21feac2b00c8ff93be823b6de81e0a8cbd12db57d541edb45ddaab1c9eb51e9bbc7e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
a0f74d612b0a4b7ed36b4cfba569e5cd

SHA1
d1cf8d5a6e8a59cc58ac2cfd11e1006e83358a84

SHA256
ff9abd7676013613f1859c678ab446b99bbcb85e6f49f559d3c0246fd426391e

SHA512
33800288982149fe71e3a674e70ab9c537f815f03a1cd83375003b7408d84b3d9c2288552d1074664e5c7d7c2e75d9754c827d9af8f3b5da4174697d570687f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
445acdfc7c7e8aa2cb3140caff927e70

SHA1
52f7d45332d4357cde99fb22b59bcf529cc48310

SHA256
b0927752d2c9313ee0a1799ad4f890311861da9ecad62546bd759c3933af7658

SHA512
23567ab46f6d6571ac61667efee43624c8ebadf72170bd62efa9108dc1c8080391de018001d749d58022fd6932625165f2b3f0a6509a6cf295d4021e8537173c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
361228ffc96031bbb10cdd3f8b3c897e

SHA1
a374275d11f50403f9aad12fb41e0392290569b1

SHA256
b6c9f49f7f4aeb73d411c39437eb202860e8cdc96deddcbe7c326d250d50bd7d

SHA512
8a7fc32053413fb83934e79cb335c31d080fece3a60a4440087e58fe20353402c8c17dba6fe6119b32d4ddae58de16b604cda07ecadf5b6f6d0f7bd873d45fff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061

Filesize
17KB

MD5
d2bcb5f6cf820b788f233572e71fffa7

SHA1
f709bcd98f6e7c5fc945372fb4d701dcc1532d9b

SHA256
b78d918ca60c321018daad4d974185537b7eb66a262de9efc8b9fa8af5e1dafd

SHA512
0d907c10f693fa8b036c7154f36e60b73748094597b4b1c50319e0d0e2332a8aa5c7d7474798d48c53a2883b06110f5d47e0edf2e9a2f8287d73cd52b95247af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062

Filesize
44KB

MD5
b9c90258b12b4d2c3c6a2427740b85be

SHA1
fff8fb60371c2b0554e4e065ab08bd96e2f1e7ad

SHA256
2eabf3214fb7bc01a936ff06fd6a92bb3db9c989600ceec6162bee7a93b45393

SHA512
5b5059c130e1f8bb3c9a3db0e9990a5af04a4a921395e493c47f3e0de88d3ad3f3395f35e59fc38be97b331c345f38f7738abe3e7e8c2610050fac3a8dc66cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063

Filesize
30KB

MD5
a1c57bce2ae0c95e394c3f6d40031ed8

SHA1
99c2723f0a2f33737c84181243c5386f836ef99c

SHA256
863d1b43942f5e8628997d29cc3e260b10aa0fda4b12a07aabe1757798e068c5

SHA512
b7e70da0e8c9e346b6fdc4ac5df302cda70f4fb9d5326a55c20d480c29bf1148c0c5dde78d11d5e3e178c3560d803b89e5e61c81224846e84fcdf424717d7374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064

Filesize
124KB

MD5
16eff4bcaad7dff6555d6e42ab588a1a

SHA1
75ae0036d92da343488048ce096d4c3f818d6451

SHA256
7efc71c3678f92aeeccbaf78154890af253124c99c0163c683c66e0100a5c685

SHA512
75d039687a163878a20fbbcf3dde5c003925ef65a9a5d7ba77539d77ce080000f1b0cca70dce6e60cb5088349247891b456d213e7ef5de61a76b4e58482aec99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065

Filesize
144KB

MD5
15ab553ff40dd9447ba7b71c7425923b

SHA1
9859134eda391cb4c5da08a0644d89772b06abcc

SHA256
17759687f255b00c4c69cd1cb7cc33ed92e5e3a6cca56cfe9fb6c2aba2be0b07

SHA512
ae6560ef1774e9ab584811093b08b56638c7f40ad8f506eecce2534014eb19940205f51760b198918a2da95f8d4e0f7e7a42be1df197dc185b0a86d951489903

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066

Filesize
19KB

MD5
f3a0b554ad79c6db64fa789bff589460

SHA1
8cb8909e599928a95842d783d1b06250bb5d435d

SHA256
5eb58d79bee441d5b11e27fa54cd351d5b190fcf37d1cfb0019fb7faf7e557be

SHA512
f4e81de02152044a9b5aa6050f1af0a7da217536fa35ab2cb012a71678d31a716161f4aeeae17469fe2ddeada421d5b2245de832843b5915fbec624b900e1526

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067

Filesize
40KB

MD5
55e0129e41b0b49cb809d92555296f7d

SHA1
c5912e0a7e4447bbacc2e0e5607670774e7c26e7

SHA256
f04489dc61a05185b8a9088897829451c9f83496bd0b53f04ee604063ac3037c

SHA512
5c46dfeaf21705d234ad636cf75b401bf8d6ca6d000688703591aa1a47e87859559ae4bbf0000e34a0e3e9d5ec4f29bf77e464e890699c0621c9a3c91cae3fb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068

Filesize
59KB

MD5
89d521e65942e2528653b6e37b8a053a

SHA1
d134c69100042a37783b3905d25aa63e607f63e0

SHA256
b22399d75417abd383fa80bc06bae76c59f8bd6d0b476bba1024fb4008d21dbb

SHA512
2c4f3f6cf9d6a8b43f35aa7360199caf3e1e2c0e4e50fd5105b20fc12ce7d6130853740b4668ef0b683c8745f84adc9fd1fdea7e359b09c693088c5822a2a653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069

Filesize
62KB

MD5
cc331fc5e5a0c06582b59a970dac63cd

SHA1
451121b236e55b284f2962c0b2157f01c728eb03

SHA256
a6f82b5b4ca0ef8c6807bf8788aea17fce10982f82a136b8d1cbccbf4a1efe3c

SHA512
6c94d5d173d5f93688ff6d6c0bec30831cdab50be574a4d9c9a801bd952aea52ae621b6dc3fd2a76606ba80e82bd515d4ed4e2245094597d652b679163ea4b49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a

Filesize
87KB

MD5
19355e4375bd0f26295bdab33b36fa00

SHA1
805d7fa91e6928d7f880c225ddecc23e437da506

SHA256
c55207ea1f7e8cdf2be0f257fdc9458a278282f4930037866774702e17c1e2b2

SHA512
6dd9676f30e6988ace882ed6c78d0ae8948f09f91f1af13beba8c0401466d94cac879ac2898f54ff503e48aeb46164959ee7cfda721a3a888fd4571d606d987c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b

Filesize
81KB

MD5
2212af7e1a30051115d9171eaa525598

SHA1
b2c3a42ba259ba07984404c3c2b52e4650ca80e0

SHA256
1d6b12a43f9556c9ac4356fdf9422a5c432c6ff3ce6b9b93ffa6786b22f9b327

SHA512
5efaa6d3f4573427a02a2433bfe336d1fde6a2889b8ee61eccbf8ca92ca7418584a378f1ad1fdecd4da3f2cc0c8c6b2983e42f5a60d1f61844894482557263fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c

Filesize
98KB

MD5
8b13bc8d04f3e34ae31ab7d2e53b36f0

SHA1
8ab55bc3b2c69a1494c6b852581fda9e99617ccd

SHA256
e23d1f6f0be097828b7a9a67cf8fe3404c2e1f35d5312fb7c98a733944714240

SHA512
47d920e60c6133620ff8fda0546366f3cac3f6336aaf5ac03e67011e5b2b37dc6f8b73d4698446ebf752052eb17b06c62f396c9b60059d59accf477669686c3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d

Filesize
126KB

MD5
63d13fa7b8c95017e4f95009cdb9197b

SHA1
ad398b4ee1f7f1ec3413a63469961f52562ac9d0

SHA256
b00ee71ec10c715f6c57704f2f79df8256a64fe591023f53c064991aa8126f3f

SHA512
f6d67edfa62ba017055462fe255ed7724e8f43e9894cde8feaf694e20519f66b9f5f5922735cbe8bca700d7542f3c881a8cc60f1d99561dd85e174535ba95fe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e

Filesize
110KB

MD5
06a397e6e5b383a19aa8909556aaa22e

SHA1
c152f1b4f229584639cc4b4bf4f49aa9d7f50090

SHA256
1d235ad338f3827bca416e4b9953904de05636bb8fdb2ac254f890b73e9776dd

SHA512
a8c6eaf3485703fc2d7f43a5030a74eccbf2cdf4ce50f6fc61e37795dfd4fe2156693b5e7fbf82f04072f2747a87601e40b3ff419fd4cc4a746fb01dd6aeb873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f

Filesize
132KB

MD5
27efbef15099f031f7bba2cfe01d05bf

SHA1
2195538feb96e7025c64fa7bac8a0597cb702cf1

SHA256
9b35e1e8a8b7842bb4346a4d31d511f7bf4e47045f1bdc3db6067170bddc761e

SHA512
f570b0f50c05023286dbf7ed3f4416bb1144e7d24bd6adbcbb7f5287705bdfce8766f83969b864252b119c43d0bc206b5ce097dd73185efaa8a84de68326030a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070

Filesize
112KB

MD5
bad795b9b6e78350df28c25f99260902

SHA1
22ff955a2cc649ac4ef9336b141348bcc9fbae91

SHA256
d72d6a4ae3c5567d7aa236166ed59aa05c3d577b949fcc5fb87c3f9777ee8bc5

SHA512
38ab8c34822317bb614594dd43092f3d8fe433fd5db3e541816453705779e10f9529b32d0318ede29ce053bac792bcbe26c51a4c35b91ab1582845367200bdd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071

Filesize
663KB

MD5
d236d43e18f4a71efce33cc3662ab14e

SHA1
dbf8bba12872e11c78c22b0a94941ac241d5e364

SHA256
8796b6a6f9a9ef087e4abb3170724e9cbd7c027a0e1c4cd72feea98f4893bb11

SHA512
4e0575f306169ce0f3351fbe765469153d706371227133d1f9dd73e820e2e20b77338361bcec1d3c513de54179c27f6b0c40a3fbd1e235a913a5cef128683bc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072

Filesize
102KB

MD5
11cb5de056974d6a3737cc1e14c10ea2

SHA1
ca100310b3dda1873fa87ff6e6ad35d1ea7f81e1

SHA256
2e2c5875a98a954b6b0c48d2b59d6f2c8d9e05c818c741eb4631f5e30207cc3b

SHA512
c6ec03a6ba0ede39d9016124d6ed93256f17d5ceab37593888691d0665208c958c7cc3197911971abddabcdcb38c88342ed30ed1642c3784632ebb6c39e8c18b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073

Filesize
176KB

MD5
bca8d5bb53a20e4d3cce85ddcac5e4c1

SHA1
c44aadd92d12b2dd8b16e742211bbef7904b7235

SHA256
d39e8dada1113e0810375464975669b612673d95d6ded939a0f29924257dc53a

SHA512
8c0b53f9982cac9e92fd7b8d6ce26a342119fba1dcaf0e6452dd7baf7e445df82ac9fe7c6985730ff3899d540c1c10c82a561a6b9bbf97602e571a73154d00b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074

Filesize
189KB

MD5
5bfffb25a8df55cb5e8b034877c177e0

SHA1
48bf6c53b726a757cf7926e88b072f005ef06bf5

SHA256
ae30443a92408fb249cf20daa11154bf2160d7cb891f5092a31dc3bdf7df94d4

SHA512
aa46e9580163d68b4c9c95e67a76d28c72ea8e13dcf73dfc7ddd3ebbed65b03a381f8cd282ce67bfb4a7110be109a9db603daf88ebb9d10ba92bbbe6dfb89a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075

Filesize
155KB

MD5
f24c04c70860931d4ef7634bcb354054

SHA1
17921c7546fe72cb568ecd4751c4d3823f83d012

SHA256
0480fd61cad5cf14cda2382866a29b16a1d7a320d03cb543964af7a442b0c826

SHA512
15d71228beae53356b0b3327e28a4e4e359dabe590cc7beb9417825641090c5dd1cf1ddb2afdd97903b3f4f77c070dfab65fd3e9811df2036febd23d41119f40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076

Filesize
332KB

MD5
ebe336ecab4ecf0019e990b6feb6fc13

SHA1
73cd97055bf148a74083207d682a891e48ddac9f

SHA256
0d6986c84a2887520db9bc5fcf481115fbb4a7fd22bfae25bb16e29471dfddc3

SHA512
95425b33e8f8d4c2158f93e9e0fe96c706f5a9ff5f6418e019c1f35b0bc9024a1bad53f1aebe1d5d562c66fafe3e172eb87089e77e6daa99241b249f6d07f6f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077

Filesize
19KB

MD5
ffd2da17414b38dcd396a9ad0ad29b84

SHA1
66363fba1cb3c4834302e4041b39485ff4207e0a

SHA256
bc27fd1ed984e3fc1017ecf22657a62173d5bad2b3543fa8906f714b69e0ed15

SHA512
32977d29f10c5fb51da08f38f772764a7c999b06ca530258536724aaad8bbc38d92c7a0d26866dde0a888a06ddd2c11809bd9cac5b6d606d1bf9c937206977a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078

Filesize
76KB

MD5
8e247cd107fba180242bc6cf6507700a

SHA1
85720d869f3c18a7b5a49784878025eedaafe4d4

SHA256
409195e82374ed583e25524785c2e0110a54823a8658e476e6a2735b7686d331

SHA512
d9930a9bd92a2b9433ee146359336d103f798c1ef43f0e0746d62cca91d480f02442106923d46fd7170a94a8d83c12ad5cb4cf22103a09950195a417fbf3c1e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e

Filesize
215KB

MD5
e8518e1e0da2abd8a5d7f28760858c87

SHA1
d29d89b8a11ed64e67cbf726e2207f58bc87eead

SHA256
8b2c561b597399246b97f4f8d602f0354a979cbe4eea435d9dc65539f49cea64

SHA512
1c15b65bd6b998254cc6f3cbef179c266663f7b1c842229f79ff31ba30043837c398d85296fb20d3a576d9331fee9483ca0cbd06270da2d6db009bc454aee0c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3e54f90b7880c6bf55de380986c6e731

SHA1
422fc81c0e4d400392f66d811b998d79177ad8a4

SHA256
aee18157fe71e7a5d9a5984f292c4af7112ea8e56c5591873624e3b8691856cb

SHA512
ddbc591dc7e82ddd70d53cdf3df76d4ae0da45c1376ccc2991f06b917f2f0d4f784aff0e28bc1aa568765bd6a81c7f558d44a3803a413944454960bf73bd32b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582a09.TMP

Filesize
3KB

MD5
ab4273a4931d878dd7cfa760ee86b302

SHA1
79ae4f41aab1d43a104b90889eb1b86df19c48d1

SHA256
aab87386893c8329301c11fa3ef943d0c9f8ead7fcad88da125b02c893d12605

SHA512
8ee19db3a7c51b6ca9375ec870e49667cf5538ffd5e5c475a464d1741f6c726e8f5a049a188bf9ac81ce5c678b7e6fe5a97bb068cabdf7a49e813b7f2fb9d7f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1

Filesize
264KB

MD5
17f90a907a4e4fd6b8d7d2c74a54e5ae

SHA1
0e586d234d291d003f3703db5ac47e76367ff39d

SHA256
c19d4e53915057b60df1f73194c3da90ca16378468f21798444040edc69513ad

SHA512
879feba61e9459bed69f438488f11e32040ed75af38619f44d1c270ba38282863b0eae45128218478bc26b3e058f20d4ff008f3f9fa162bb15e862308c163578

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
57781e7a5a546a1a071352367b712118

SHA1
9ae14fcbc40adff6b1cde0bfbc1a2f8b9f266ef4

SHA256
8135264970f9555b9e0c259ce02f2f800eb69c6945aab902027c865ba77d1bff

SHA512
b580c9ecccaf7acc03ed770d40a5a56db8aa69c51cf24ecc2f487a307e5a32bb2124040fa02e8ca9f93162a321dbc85c768c48371b4a091fa26067525d2c1cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
77dab301b2568a55c9832b3b367e21a4

SHA1
f1292318542c820c91d22d7dcbedb502cfac3ea9

SHA256
9f5469476b7676350a571afbd7150d1dfbc55a8d3013b3c952880637b3d47809

SHA512
56beb979a0708a911c4f887244e90f1d812229a4833d0ad9517552db4764a15c8103e5d8c6c30c391361f534d44197e0f022f75ad4f7a8bf17a5372a1226906f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
7211a61fd14958b37eeb005ed2e3def3

SHA1
d0caafd98cf06ff30ab1a7b446257efe27d1ca18

SHA256
02023ecab349d3e45ad8dd5d581a2f0fa4fbcf9a3050a197f122e69377bf726d

SHA512
341ec1175453bdadc21693b0537d36f031c3b2f1d7924a518e2f5b84910239ffbad8a0d54ee80c4fe77d1b531b06dbba7aba5e506b993d96a4a8283c8085b6d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
a8d45486195c3c47cf13fe9dcdccacdf

SHA1
655e2a5ff9c9d7506cdaf98e1cb13bedecc89a94

SHA256
1774c9714b73d1d4853301a44b8078bebc008dcea4773998c247450e3167cfaf

SHA512
ba94d823dfe71c98db3c3b362392d99ce3c31ca56d0671bf241395677a07d2a6dfc13087a9b392717d91c057b590d88aeaaef76df39356a2158517ca675a1144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
7714e3605d82e4f52e73381921a2f2b4

SHA1
a6048f7fb6b88a357048297550590207cd7cf859

SHA256
0abeae1e680c9829454b63b35c42c5537aae56c1c55cc85d76734f130e51ce35

SHA512
00c25988acc0a8bd916a6e92aa821712cae686371cbe9b629f3383feda3e848d69520825f633df664827b7092adda82af5a0239fcc17ccc7ca9e811c9a2c7b18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
4aa406228951694f095f00259a0a9f9b

SHA1
efcb1473fa6893d704229312c5434ec535b1f6b1

SHA256
bd9c2b701b02b3e30bddb21fa73f897779371a7dff412d077c8c4a6d34bcbfe1

SHA512
184c5c47928acffca3a10ddac28d7885f2e468194222aaa492dd3431ae8860731e4334dddbebd00ae794fcfad2ecf74e38bf155cc210f8e3fefd345537504af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ae689a2144e9e24bc49282f4757ca91c0bf7f5f1\index.txt

Filesize
105B

MD5
44718ee22580d0b8fe325eab351f5442

SHA1
b55769a736960a29757bf0af777d8a7f469c1255

SHA256
b03b1b270a853f762d875c626805b51c8f18323b346bd7b86015dad8c2d0aa4d

SHA512
74602a48d399f0b0f3098af5ddcd5627fd660fb3e0f485908cd56410db9c6ce193e3213d90bb11f560dc14648d4d8082262535cec976a9037106a85392520731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\ae689a2144e9e24bc49282f4757ca91c0bf7f5f1\index.txt~RFe581623.TMP

Filesize
112B

MD5
90d1b4ea2a6390c4dbd752dc985f0540

SHA1
6635ee15052d94846a9b8b5cfb3d5d6986ccbd52

SHA256
84ee17669280fa1866853e6b6d9fc1f40f8fb98d7bc6737f262fb568e7abcd75

SHA512
ada8dcc7a7cf890ea8415a0286b4fe3b871ea28fbf7bb893bd9376e1aa8b137d987cc2653370633c8fb1e75e672668d433d83556ee531cf0c8561a6a23c2bdee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Filesize
1KB

MD5
4c338ce240db03914fc3593843f318dc

SHA1
10d46457ac422372515ef79f73f1bf44f791fe7c

SHA256
b410dc6a48bb094b34800205a18d46326f9382af8e2c8e8a8fe4b68ca711b155

SHA512
fdde60e070aa3855171bfc8c1c96fe9d3206495f43fd1ade4e1383006a9cc1fc5c69814a74023e372a37aa80dcc46690837ea3d21c04a7b71127a8a61fbea38e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
335B

MD5
e71eb82eb002ef49c4a7888cabc6815b

SHA1
2ad3150a16c7e2475e20d6dfa11c3ea1aba70049

SHA256
d470d0f648cb22e389a2f3ebdf9dcbfeea6d5f71341a8a6a72ca7ee1c37569f9

SHA512
7583034821b96d93b3a556145f5c4eed3bc4f2964d0bfc7b4cbfa6c7e7236307473fbe649ff9016d1a4210e5d77a4a6c04dc7571a0f585f79644decd90107996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Filesize
72B

MD5
529f17daea5d25f3ceaa71cd5b34537b

SHA1
3009c32cf6a1dce74a1e2008fb12854dee9e7b1b

SHA256
e977bc476942d3025cdce031be4e1d24f7bf0ed2d8c2c1272c390ba9e4e54639

SHA512
c7ba08f5331d61e8a5f1680b7e92c4ccc6f404dfbeb30e9c8ca32b3ba751b6f3a7c3e9a029e88e8bf6d4268c33e2f758e069cdcb221edd54987021bb492f9df2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581a0b.TMP

Filesize
48B

MD5
2d4b2f548019edc1f9f03efb58ebffe0

SHA1
aeaa6b4b644b76d11ae55da4b353922c040bd042

SHA256
4ca1c550130bb61595a5aad71ae2a9bc5712cd2f06cd3176a576989cfe3f85ac

SHA512
5b66eead202ef99266cb1f98427b5e11ca22d85e4c7000d84da488c8c024157ee312e44a06687df1496d3a68763d751991a0d7649defeb73fdecedca94567150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
e2dc515ffcddbad2b4af66454efb73ad

SHA1
f4493af471df68fe089540280cbe650d1d39f9af

SHA256
79b92b088d9b81a45fc605acfc469c4fdc832954c085ed12f2002694fbd8863d

SHA512
a7e050f2bcec9fe02d8ec1e2516ce35cf2681315cd1ba1d2ffaf331b7acb711373a98db458f7317fd0b59f19ba3051062e8c5db38e8f5a56d13be4799eeb991d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
481cbd1d7d089a1b785d728072922d40

SHA1
9c762105ac6bf2461f7ed84eb52ba8944eb8c198

SHA256
9ef9bc86e4a00a476f40d9703490d33369b547bce01be84ff04f15767c9fb86a

SHA512
09469a023d2efc651d3c582e5448495db3723fc6191f3f8c6cfa31e1e8ec6a0661ee12ae66441a07bb9317807d6275aa4d758ef6a6cf183780eb5a26a8dfeea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
0033a26755ad06207d3ee19203d8e132

SHA1
5035f84299805d3e09b5d715b6983f9ab3edb06d

SHA256
914b76b1d9e2229187aa4d05612f840c15fc1fde54880fee92c493c7db4bb590

SHA512
0940b493cdb5b1c1b3d3482f0b373e969b29bebc8476ece680f24a4487bbd1e244157d8f60fb6a7dfc1fbe8ca34ae30264609581e818898e3de0e339ceb73b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
636a769381a4719ccabb349cd2ad2c31

SHA1
e0320b668af5dcfaafb9765b1aa8c804fd34758d

SHA256
2c4d9b406f5daa0844acd20ab9442ee16c0adf755672543ccb7131c558d0f9c8

SHA512
138597f1d3bdcab9afed82c752faea058dd5bd68e147cf200687e1e8067f3e70c2599e3038a76b5560a44464680afcbb0d1f26651b4b4fc4bc935d8c4dcfcdc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
df56889bfc9c6ca879b2409c26886b2c

SHA1
055e9625a52728ee0898ba65674371eb04ccad96

SHA256
b899788b308cf5b965c42eb6661879f440a1ac8793e20199238076833c4a3e53

SHA512
531b3b4b0f4c06a4047e66774b34177ee1ac12cc6b69551269ebdd8b5c8176d60eb48de5ab89f8c3428070419ec03e7fcc4abf40e75d6f6e4b5d4bf2235cf51c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
460B

MD5
67a1fa258d912624ce8690065e6ddd48

SHA1
f4f3f30d499939cbaa0f2f548c388d92f8f283f0

SHA256
ba7c2a40991a0db95978427aa2d8340d5c39eaadc8ab7669e6278ae2e427988f

SHA512
78106f55bb6241fa37d5a90c85c5dbd770dbba618e83a6810fc5ee7fe462c4e93f4b92561ef68c5db01f2fc9adaa4bd35114b41e9c5bff8920ce309878438707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
df2b62101e6b9ddeca2c2a0ddbd6620e

SHA1
e7cde27a51bec1915efd8b2f46edb50f59f08c6d

SHA256
2f6d87dea79b1e551f46fde161c47b8229b1139b1754a76c563c5ca834db7f62

SHA512
dd8c3dacc8d494db3d8291ac81b3e4423594bef59780a5d33c44f3c8b23653d223359b31de34f649636fa9ef170ee1210ef55d8eb08c9b0568ad3c6e1daeea40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
fbc96efa817f74078293b5ed34915149

SHA1
e51de68aefeef027238a792c4354635a4494450f

SHA256
0928e12665723a4d3d4d98ea29e20fa98a1bfcb4cc6dba6caf73a9b94b1ae140

SHA512
114bbd684ff3a978f8a3d505e7bf6dc1a6076654a16246f146d43a6706fab24a3c65c2226fa04f32af2b33677040fa6cc89d0316f9942840beaf87fb39aafbeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
804e417910e8917e6b674ecead9cb138

SHA1
9cdde9d3e3d367bf54df096c9f8cebfd1b534afd

SHA256
4622aca2ddb705bddf5b868e2d651ffb3e8926acb334056ddfc55b67c5822556

SHA512
9ae44b8ed7f26c943820b9ddcb4fd6edd572dff60ca0f8656f2fcd0cdaa6d37339a5ac3b706fad628c9b33028fa9a2e2339aad74276a4b1b3cdcf6769f1f46b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
61KB

MD5
677e54a8c2539ac80825e9632e689e44

SHA1
198b0dd9d233f1739cfd94bc4daafd0f0be383ca

SHA256
25e53f5e9c9d63b1afd6eca1ce385d8e5e135b2034b50a86e870306e1b3c7afd

SHA512
faef7d04e4f35d313478f2c4dc089c3e58a6f86d24a669f1eaba0f03439f3e69f8128b04f49641f80b385d7d92b97a8a18e34cf2a71bad9d900ba038fb3df9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
5bc99c512bcb54248aaca62b3c736c98

SHA1
3796739d9606ba1f97ed23e4477b2572f69d715a

SHA256
9a05f98dacc58d7584596d2170f39fb6f80ae1bcc307d8167d2017c867fc2065

SHA512
881e035f53c64907cfd2a950f4d7cef0dbfca456f5c63d8947617fd07514c45cf020f135e6993668a0763aa5e2156378542874fa4f367f1841d22006f9ed7e16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
e4bb82b588b566b6d4e13980dd5809cc

SHA1
d5057527dfc1bc69ca9b84c3ee7ff9382524bbbc

SHA256
24642f88669fa0402720020f8acf306c9e27f65d281978b3def884ef1f1a9944

SHA512
13d5a4793be9e2ba3be905417199d167819df7d6fb5fd3a00262ea6ad971ac95ca82d10cd6906380210c05e273a67e7aca40148de038850a7128ac1de8e28997

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
d2f90d3615f0c48811deae9b82cee731

SHA1
cc0352fbb43411fd5fb61d30ed83d9fb180d80a5

SHA256
ff044f5ded1fc4bba2938f1823533b1a3c7cdc04585971bd9b3d24c7ce9fddd4

SHA512
4fbc88607b07bdb0a6262083aff00fc8648ae68b62b9ab8d507a79c2b77588293242fc3893b618c5530ef28559ee7cb1a664a1750caef3e5d29288550c87fb3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
44283674807994669844b4676d5eaf1d

SHA1
e46f0266d61c181fba58b0948434501c367a9266

SHA256
9051d6079e1a977c9ea980494039f5017b61ca8a87df2201dcd88e76b95961dc

SHA512
9cd287f0fe81e43463ba5211a0f5b597295402c1cf68185c193ec4db90c156473cf6e0fa746af4252666e143ff68de6d42e836eeb6cadc49f552be8279c9d9fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
61KB

MD5
49ee5af5a2c59d17f000b9171318170d

SHA1
20b22b4c660229692b468c2c9a103bf08b474e6e

SHA256
997308824102fb7d4159e7579b5e9dfc64eac002c86f7ad95adff921cc1896cf

SHA512
fbda4e1a5e4027edba2158a6901a10716ddf34a3dd795484634ad518b4657b8c4348b3f7eb2ad3f85d92424dcfd18efe73b589c1746a11b2252228320af96c88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
844c9340e58b4fdaa732316592bb22a8

SHA1
03d2783ed4e27e8508c66b2d1ea87f2fc7371990

SHA256
65a9320b89508e317f4de3a316a2814b04abbbb4049d1ed826bb0a9b9a063574

SHA512
f6081783d70e93911bbe0835cafbd5655ed06e33b0239201b0cff36921e7bfb405585f3a29e2304726424b130407f7a0f264b85e70bf9249a878548c734f4318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
067a4fae55348ed4bcd682a8b7055d24

SHA1
3b6d8dd4f1e383de1162850d0d884899d644ef1d

SHA256
84f544d35289ea0767e94565c5225eb03f897d03460b33b1eb7f7de0b4d6fe32

SHA512
4395b6399c2425153b3b45c770f32b8386d613c54eeee6de6cf13b04fd69dfcdefda779745b12c9ca3a3372d3ddf3a8ee75a27a1615deb9a16a4f11318f28d34

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\activity-stream.contile.json

Filesize
4KB

MD5
1fc1ac89df6ac6b3654206472cb44735

SHA1
e76205739c4577bb2ff738181e390449399c72af

SHA256
a4ff69ccd46974339e342513c4c579497fb27836662595d2af073cf3372532da

SHA512
fd0e5f8a2d5e54961a36367b34a50d3a1fa5237e1d8680d9abb83001b7ca2b13cc842f147d11c1d29690fd887f57c7f9252c22870308246c386e2b1b3b9ecf93

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\activity-stream.discovery_stream.json

Filesize
31KB

MD5
b7fc5bccc4f43339b8ad6e4a161404b7

SHA1
fc0e9f46518be6757a20bfa174912a30551c3e22

SHA256
1147a8721bc37b6605e39d00c0a41dd097bdb029087200c20967483319b71431

SHA512
6475a59803350c444213786e711aa64c4ade12baf4ae92b1e6a7c9e506772b9ed032ae8427d95d831cea363b12822415f66e9c17258973ec87eff62e99c2ccd7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\47C0F04DDFADE9715943C1EC408240A15BDA389A

Filesize
93KB

MD5
7f795fd9839ff4275d840a78051f3640

SHA1
89ac0d1f5e0e3c4b11bd00462ba1988d6227d39f

SHA256
640512983a4fd6df2a4d26ef81ca9acf62e16fc03ee7550ee44e838f81e69179

SHA512
429bbeaa39750b3e12e7868f27a0e4ce57dde43f6752fc9da4647dd95339e89481f14db4f6e013f4c751cb39edc8d810d05f046da48f055cd9a5790c05dbcac2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\5617C2BB77122AC13DC0FB65336A8386EC872F9E

Filesize
22KB

MD5
afb4055eb4d7f395ca964daf7303dc45

SHA1
b78ede7d9061fd0ac72e55c1fc53a29173532121

SHA256
a46250c0d3e7e9ea8b525d4355e47ab79b25dc3086a6b025ead24aabdf2577b9

SHA512
c88ce5b7bfe6f2d514460305f0fa62b25c14c5ef5d1755333e5762e92e27ff5418652a5d9e166ac5a30dc70c0989f058e920829ef4bb5f8a33f491a8050e8a82

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\6D70F46D77CE67F8E47D2DA1E3DC4BC77601D6C2

Filesize
265KB

MD5
1609557957c094f12a3d765a99b3ed88

SHA1
4468336c475304aa3f2035d95fe2cf1e1f51e31b

SHA256
9a6c5dd0a559e3a14d824552ea39e17018bde7eef0b1ecff73ddacc59981b205

SHA512
79942ce85b2b82bd5148e9f3408b966322a41301693bc20197271c11cbec2b55791773c8a1acdd38f644b0b9deb502d33b7ddca858ce795df81857b4cf88d994

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\A175F5A17FB1329B98C65A5564AD92A1E96C826A

Filesize
1015KB

MD5
1afcb65304397b174cd1704b2de7c199

SHA1
2b2dc46c57b01e1f1433a884e1e883498480508d

SHA256
085efb2e53582e3002f677d5e3cc66fb486effb58fca56121afd778479c568ef

SHA512
a7553732870bd2959225cffdef77f351fa07b09d3e18147f417bfd76b7a6c24cb1b39bff975de8a3d2956a82e32fc07840e5253891dfac6e560b90af7fc77f4d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\D204A45137A0F1472B669E9F6FF468E300285C36

Filesize
5.5MB

MD5
966ab1f5f100c5873c3961a0f00a51c2

SHA1
e855eb7f9aeff69d49cdb4c286056cda088efc2b

SHA256
effdc8db92fa40b260ecafdf827e7e61651692e7939b643f3eb412b8f677f86c

SHA512
5720afb01543924645fc9f24614394bfbf0b3f36f3badd716d18dcb95c73a05f2a219d1a3715200cc59b681228b1b8d1596d4aa76aed965bd5b502350685dd9e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\E19316B1CDA62317F9DA2551F9B56E711FCC77AD

Filesize
13KB

MD5
e72d551da3b34788c0ed01b2fc1d1ef2

SHA1
79fa1dc1887c94b71e2bc43b91b9123b7e31488e

SHA256
86ea458b4e7788d47576133e845e7285c13d9b9a5b23a0bbe2e38dd5b7b46243

SHA512
3733e26ecdc5ccac22f1bef2ebaf4b82ecf1d4a173b40d3cbf42ad384cd9d27cc3e6361d9345d7f44cf38861f86024552ed8b17b7c2bffe98a30db1ba29f71ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\cache2\entries\F6F5CB5D0A0354B977BB4601FA0A44242CF5C15E

Filesize
63KB

MD5
d1955554d48da1f394c37c054a8b1003

SHA1
5a49317ff4dec9ef16951eb784afd282a560df66

SHA256
cf138e84f8437096da5df14c3c1fa791ef60133935543dbacaa10612764181bf

SHA512
ae74db13988b60febe6cdaa3bc30b9f843c6c53cfb598a9a4543779049927f87281c0ac7c7a8ca0bbbc8942445e9ae1941628172714f074eeba07e28441dfe8a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\50jftte4.default-release\jumpListCache\XyQZlAeidkyVcp_vrhSAeuDUfY6Mt2Oiso7uCmcAGPg=.ico

Filesize
691B

MD5
42ed60b3ba4df36716ca7633794b1735

SHA1
c33aa40eed3608369e964e22c935d640e38aa768

SHA256
6574e6e55f56eca704a090bf08d0d4175a93a5353ea08f8722f7c985a39a52c8

SHA512
4247460a97a43ce20d536fdd11d534b450b075c3c28cd69fc00c48bdf7de1507edb99bef811d4c61bed10f64e4c788ee4bdc58c7c72d3bd160b9b4bd696e3013

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
23KB

MD5
f87b0e270c4e12dc2ec4c10188bfc7d9

SHA1
a2be0959ff2a31d4d3d77e6517ef69b60cc3be65

SHA256
6f2b6a4f1ab40a9bd0360516380e53bfa5b96b344be5e7ab81c7a0193c42e5a4

SHA512
85d9e6974d041f044a5077eb1d3dc30c9175e5abbe9537baf4d92511c31a46e2d1eccdea5d05e7bfc3d187fda2dafac607bbdaeeacaa1f62fcbd47e561c256b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
21KB

MD5
b22a4360b6c424e90033f7a4439c76a0

SHA1
9eaf47222ca276b837d0b7eb317747786aa72ddc

SHA256
da90615eabbaf326645ad5bd00ddf2558632c95129401a6f084e1b77bbb86e01

SHA512
592cc4edcfe1c834175697b3c2c6819a43c1dfbd5c646f22417a8d1c92d93b4e460597c1dad2ca9c130d54599715ed43d09c02580476eb65692685f900073a46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\AlternateServices.bin

Filesize
7KB

MD5
4ad216dfb77978533634fff3843c6594

SHA1
7d8ba981d614714e37184eb095c812a4d59b38a0

SHA256
c3c41000ecaeb210d46d9c0747d42d16f01148becf81aaa78f088c3ee50747f2

SHA512
c900a8205e3b03baa314fb402b01e7ff552bf9b8a29506b1115e396e126d6f4b623ef6f80838fd87626fb7349ee58fbbfccb69d939d71e97dceda6eec8f6bb58

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\AlternateServices.bin

Filesize
18KB

MD5
e3ea8fae4d9ac1104acefd388d9c20bb

SHA1
14778662a5c02b70fd0ad341fe4d6b734975bdd8

SHA256
9b6fd0f921f9fad7e84d9aca36386a9f8f1222ca374b34eead3d2020673e4439

SHA512
fa2154e03d66241ad7dbe2be923ac8ccf5b4b22ae3079544d17b88ad56f1bc70bf8f2aee552f6ff2bbf805ae6bbfba20d908456516d8d1f28711c143d676c3be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
741e418a0faebd19cd822159dc934e0b

SHA1
28317e6ad07516bb3667a40723aad4c17cbff697

SHA256
a8e513c26a557c043f365ffcb695277cf8b565e4f0278afd5b88bafc4d887c82

SHA512
45f93c56538960c41ab3e62a56d504254ac51af782acde42d6f6efef44595da4ebdc3f4fdf8485562dfe1e012d9c8522bca0c96180cf011e865bde7d462e66df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
44039525a870cb745b388050cb73f32c

SHA1
2dae2300b88b11989c5dca043a3d7f7babbdae8c

SHA256
ccd6ced057b3b2f35e6dea654028154e5f0cab3d47b102628f98798785806694

SHA512
b6e5e3c67d3f80b2d942f662d7beafa0ecbc9146506bd524188c10f2f683fb8eca25c43c45ae721507d9ba4045213fb6cf5a30ac6566c04411dc2caaecce1dc7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
1d8c70a8f0b28fd97409316c1eb3c0c3

SHA1
1ab92b57c6199c7ceccf6f5091f90d5544f7973d

SHA256
145811599832c49eecb720f5dd723c1d813df2a7e82a25415444632ae65cbdc2

SHA512
3ddc8516655b1921c403d904e414ba47cda98678b08ea08ab5ce82a850b9e335e1f6f55e8cb0ea13f013d789cf077ddc88124c79254c6bbe6d0b36d8075f6c82

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\events\events

Filesize
4KB

MD5
32a63cbb1ec28e62908f8628e275e268

SHA1
b8aced954d54f20313dde43b954e34efa64f338f

SHA256
48f4b766f23d35b71caea3b8ebe4a32010eba89c5de99861b9a9707df25130d4

SHA512
6fbb4de11e7a3f0e315ba3d001a89283e2dc3d902e29bdc3101bbbf8602de576d452628e3bb759b0aa327637f289cd22d20a15c0e4dc5eed10cc6f31b9d7505f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
4e425dcdaab75fcece137b40cd5acf34

SHA1
be84695486f3378ee808282690111e9cc8bce8f1

SHA256
aa57db849f543c16a428e124c4de43a9a8149a6641461bd1022decb90b32486b

SHA512
5a7ec1a45a815c8809f2a7a9d99b82d905537130cab6aa6c4a2de962a9289d56edb820a201f01e331f0cfed82191b027d9061cb60a31ccdca618ff1057e60010

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\59123c73-a172-4a4b-8278-b8f988c677e1

Filesize
2KB

MD5
b24ac4eda6ea81b4a07e108e6c47efa5

SHA1
871dcdd2ecfd7cde7e571ba05cfff59ee5e8e29c

SHA256
9236d39be3a7871103785852e5818eac21dbf15860d0775e425c648dcf06d212

SHA512
675de70a49d7d865ed1632cf8219aae7c69398615959758a34747a935ac198eb5b1a7bac6f03ee1046f9b6a97afe4cdcfbb5882a1ccfd79d6bf4cbc9c4a69ad6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\6853c1c9-4f77-4972-88d9-92281cb391d4

Filesize
235B

MD5
8fd8bcc01b244750eb975f2dd552f49a

SHA1
d409cf61d83a66cbc27253f7a9282208fb51e5f9

SHA256
42bc97e5b6b938839f241370d21bd72999cd6429b4c633dc7096a614a1eddf7b

SHA512
4090e59db09b17c6a0ce13f1ee565d6317d90472526c09849efb61379064c5eea6e92e6d8330317d6e3082baa7c35fec1f69cc52230ca83c3e3988a9c042106f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\69ffc33f-b941-46c7-ae4c-cd15be4320d3

Filesize
16KB

MD5
155ae249715a9f82ae19069880e5656f

SHA1
e6cc81870f781fa6d19fba2adfb8f809f4cdc54f

SHA256
41292b456dcacf8495ac6fcd8ac0c0dcf82edf47a2cdb73e1e2f93ca2f14e1ef

SHA512
2ecd4cea2f26f6fb0cddcf4fe349f213e5dfee3ee9dc164cf34e67305013a80db954077f48193099d40ce7a786fb2be2573789460d8d9d286acf19ab09efa3c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\96ddca64-bcd9-4cc8-b14c-3292541eaf35

Filesize
235B

MD5
9c6c5aef87eede64fef0f58bba113558

SHA1
2009cde6d7034365e2b6442efd0dc42c55a1f4c0

SHA256
a86a1e32aca6911f125087728ad38fb3306270e162432ef08d279e3122dda65f

SHA512
aa5b11c9e2533ce3ea5d045587f5972e27edeaa7016f00937a7e595425c92021dd6ca95b5000afbc234dcae78c9d0366b7c6a1ed5182260222bc4c42acc412fa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\9a83682f-3f1f-4cd7-aab0-3eef00b29b13

Filesize
886B

MD5
6c7f6e1ddfa6edb1ef56e813b1621b3f

SHA1
688298e950db81cfa0648fb28dbf389f069464bf

SHA256
055cd3625f11225b17b17d1865f759264f720dda6080d2631178146b6143b424

SHA512
1245c39176bace8131c8b420e071289df8da363a5398d565c9e6e4300e33e6df13385d060b8439804ed416f5fd607582d1410d3d20953d431bd3ac9d57817fd8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\datareporting\glean\pending_pings\9e8878fe-c06e-433b-b7a7-91f8bd48cebd

Filesize
883B

MD5
b7e2d9336203c0343b99c05be1e51657

SHA1
1975b4e5780437eaf5a569230ca0185ffbcefdf5

SHA256
838a33b3dfa6547a1f87add099e13b7903372d8026350c99bfccf87344a69648

SHA512
5d0244e6a32439284777e2def4ccf6adb7a9f4590b163d01b19c1dee67634618de0a7cc4cfcf83b0169e09681bbbdf4c875725603da96b4edb5f7f1d7168f50e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs-1.js

Filesize
8KB

MD5
2b74237ddcb34158d6b2e073798ce44b

SHA1
b25dedcf58040bf10ffb0fdc9b33bdaf672809dd

SHA256
ca176d4f01b1528d1303006cd861f52cc94e6b3e89487d1908916747797b0dd1

SHA512
afcc52146796d9fe7d3d780f3b67d03c66d70b0f18271768ef8b836396babba751837165bf06dc6cafc016de70f68faaad1655e00c119dcb30ab07472f1206d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs-1.js

Filesize
11KB

MD5
d09806b05d7b50bf661d4c768186fab0

SHA1
f0c804e5faa3bec7a0015867de98e5a10bf1f332

SHA256
f5bad83b91810941b7da815cb4ac409b3d740f616eaa568b6a31d36e01bb4ffe

SHA512
b2888f9a15fac6fadc79285f3648c45ec3b5e9964dc2f7d0939d2231f374d1fb49252745d16ba51683d1233eba947333831d503ae8a25feeccd36ec57e6e39c0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js

Filesize
6KB

MD5
d217bcfbb70a73345f7425447d60ad1f

SHA1
f5e41b6e0cb69520be2f984784d4c13f9c40f5df

SHA256
878c4b9f147514c2db57aac1087a4fdb295a17257987167c1e9d5a09eaf1d963

SHA512
69876498e18445ee76241f6413e1b3704d5b0d164d85486721af603049f52eb2b4c585df9fa5253896bcc60b4511ec3b156291a74863bc797a005ab948e4356a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js

Filesize
11KB

MD5
78ab52203c16dc2e888712bc2367faaf

SHA1
6ab0301fd75e103c6cb27b48a4abd90c56198536

SHA256
318489a70509b8c5d09faa871cd94307083fdaee91834502d1539232fb2aa8de

SHA512
fe9c89dde37548014c67e8947349ea8068e618c0e0f2027382badbb4b31436b50d8d4a0b8b4013a2c9fe9157953bb6ddba0685af1c54e3131683b6507b497502

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\prefs.js

Filesize
6KB

MD5
de23659edbe5612e24ce8b700ccdd6fd

SHA1
401278d08f6b7beb5311dda4fcc140f306908ebe

SHA256
bcd405dc3737136fb72d9c91ce69ddc704fdb4c21dc0024e4026efd485fadc99

SHA512
974fbe67b456a7c0c8a17e9e28099ddb3e9ac51fc57062767f206ae763451105f0be8ed019ecd5cf1ba429a84afbe47c9417c65ffc663612fe2bfdf920cee728

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
a96251874db5d5e322b3864872da1b23

SHA1
eabe39feae51417b61a0b2974c86e2644fb7ff9d

SHA256
0e9e2e8cdd4405588ea8f9c22f5bb670937c7b389ab4572174776e7931ce56b8

SHA512
9e6303ad2fc47029a4b6cca335c703515716c44eed9bb42a8b0a1208a6797382af85bb89c449647a7deb46801860483bf1654bc54540b4b845f3911be579a283

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
5ac852d6516313165b7229f21a61e805

SHA1
b944cdeea3c4a71cfebd92b36e11178c0a23d435

SHA256
6ad7444d1dd1f4bdb5cfebc22733413bc98c9cbc711c6c9c86c79e8203571391

SHA512
05dbd8518032808d485330a6ec8b4be17ec669773979dbcaa97a542dadeaf2963d130e15c6324220a4a600d0a01ee447bac73d56c978e56390826dd73a90d0af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
4ca74d9f2d9bd286a2e37ec7895aa79b

SHA1
20493dbc76d8b937d52a42e2ad82c511ed76d467

SHA256
b16fccd502991b9570be922f6dbd490e488e92a1e2bedc76c5b0b1a0107bb812

SHA512
4b3ca4084241365b942e7bb963574d2e9579ece50ea30b7d7e86923e7469afa0a766828155eef277cc95c42af5f98cc3e970eeaefda0e18ac2d157b8e4c56537

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
975e53dc5724639a8378dc255a2cdf0a

SHA1
bbd0a2115d6bb7e835646be4cfc9d74fd0f5243b

SHA256
7277507f3a043405711aac0c6d8bab5183e4edc5def542f07b3eee08d1cee0bd

SHA512
b49598f5140e9fe7dca8dca29f54d7d8bde99eec33bc06e75b77ae697a3229be1b34839c8e9f894643e05393e73a62b7f67be632b5b21ec7f9004cba9d536051

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
a15a66347e898d5ca231cde1f0ec1b21

SHA1
94fb6359bfeef388407869d71b4ef09eb561e446

SHA256
8ba477716684d6ace9f9d625e4d0afb0007c90420cbc9c518171576967039649

SHA512
993e28e877518f1232f5fa7a5ef402ce810912535bb2c1205bf226fe772b512adecfda254076334d669ed90b4f9ce153cc021a82f84cd418f614ba95355ca549

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\sessionstore-backups\recovery.baklz4

Filesize
16KB

MD5
148e4ea7eabac8a2a0e38794ba3c49ee

SHA1
d66854ddb188da652494664ab0a8bcc9abf2fa25

SHA256
be90e8cf850832c26fff8a2631a4a3d96e23ed45f17780af29063e1bf451045b

SHA512
758497388de1ed1dde8c4b318a6c7ad2219f7f91133e13823153dc4ad0d713c9cbb86c685c1807f6453d3b2e9cda368b12500357c8c4ead4f67f9e18a66a58a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.4MB

MD5
2d52e6594d7a52fa53174e1fbe668bbe

SHA1
d49568a45db37bc5a52d525ad9d2a9e3faded9cd

SHA256
7845c19d29dc3408a389cd208365497427334249e1a2e0d3e92e8dd2a732f229

SHA512
36a3bceca9959d3771c94124186866b4585572e8b265e38479f19b313179ef74edb23c35a90389694073f9738e7220bbb38dd662eb1a918e6b1b6d8cae50679d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\50jftte4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.5MB

MD5
b4f6a54cc9ce04f023090c2d96e708ce

SHA1
a9e1ff05630bffa018cc2ae814cd4ef467234580

SHA256
a9174b1033508c8a1096a7d9518d6f1ca6e7872efe57ef29efa45582093d0148

SHA512
9738437f2d2311c337c5dc5641606549d6f814567fefded4769e379bea18cbbf540fcfee951f38769ca0b8f7b87a71f878ec1ecddd46df2d05fd38c94326011d

Download Submit
C:\Users\Admin\Desktop\rea\Profiles\Default.xml

Filesize
990B

MD5
3c0c92e9438d06325488d28910cc3be3

SHA1
aaac1abb528b8bec312ebd44d10304108c6a2dcc

SHA256
8c549d86afe9d62bfc529badc5a32b1e12bcecbae03e052a51937e5019a7c0a6

SHA512
8f74d62774d29d74c3549610048317bb8bca36d5b2c090db040994ade43c094dc4a1665cbf7bad40457339fa354078b208fe55f56616028ad959dda576380fd6

Download Submit
C:\Users\Admin\Desktop\rea\quasar.p12

Filesize
4KB

MD5
e0122c52158b37bd15cb7c5e538c5630

SHA1
30c88cd072196ef5deace686e7918d59b70ba9e3

SHA256
911478732701d9ef84b5a41babbe072912d38b70afa12c2c814488317ac15b2d

SHA512
ea3f972ced7230c0e30f5d8856e18c4b37d12a4fdc64ba4ace7979764d9a74f847d84c17645cf5c23c4b9775d09dfe9b42672814dd1f18b589d3652cf13bc6b3

Download Submit
C:\Users\Admin\Desktop\rea\settings.xml

Filesize
465B

MD5
dbfc6858354265bb101fe437350766bd

SHA1
341c2904befb3c7dd1d72322dce2f78d53171860

SHA256
4339601e1a6bb23ec158ee19e9dd89b9721a4aac34cbe84ff8ede6485698bf3a

SHA512
6755cff2242eee884c95911a61e6b86c248459bb7e9e24d00d78f5b44e1b645445b7830814f545dceb75d024a0d88bec27682d4c750d37dd2cb954c243dfcc54

Download Submit
C:\Users\Admin\Downloads\build_output.znjdoVa7.zip.part

Filesize
4.4MB

MD5
49cd629b630f655bccc2832eeecac2c8

SHA1
c3cce27bcfa3679c61f46504562deeb35508a1a1

SHA256
45f6d097fae8ceb0dcbf45819974667e0dcf9c1243200ec05692c4888996a739

SHA512
c2a04cb64f2685e5a9caea2e22143fcb2108e2b63d22ebfa52d4c4a10b5e8bd207cb93b03445ecb99435c26dabbc89e74d6c59714895f45b0270122eae482128

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt

Filesize
551B

MD5
7bf61e84e614585030a26b0b148f4d79

SHA1
c4ffbc5c6aa599e578d3f5524a59a99228eea400

SHA256
38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

SHA512
ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\Notification\notification.bundle.js.LICENSE.txt

Filesize
1KB

MD5
8595bdd96ab7d24cc60eb749ce1b8b82

SHA1
3b612cc3d05e372c5ac91124f3756bbf099b378d

SHA256
363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

SHA512
555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_756125029\json\i18n-tokenized-card\fr\strings.json

Filesize
2KB

MD5
cd247582beb274ca64f720aa588ffbc0

SHA1
4aaeef0905e67b490d4a9508ed5d4a406263ed9c

SHA256
c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

SHA512
bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_774633054\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_790627153\hyph-bn.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_790627153\hyph-mr.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3636_790627153\hyph-nn.hyb

Filesize
141KB

MD5
f2d8fe158d5361fc1d4b794a7255835a

SHA1
6c8744fa70651f629ed887cb76b6bc1bed304af9

SHA256
5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809

SHA512
946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab

Download Submit
memory/972-3488-0x000001F394D10000-0x000001F394DA0000-memory.dmp

Filesize
576KB

Download
memory/972-3489-0x000001F396A10000-0x000001F396A28000-memory.dmp

Filesize
96KB

Download
memory/4608-2152-0x000001DB3FC40000-0x000001DB3FC5A000-memory.dmp

Filesize
104KB

Download
memory/4608-2208-0x000001DB40960000-0x000001DB40986000-memory.dmp

Filesize
152KB

Download
memory/4608-3467-0x000001DB44120000-0x000001DB44180000-memory.dmp

Filesize
384KB

Download
memory/4608-2206-0x000001DB408A0000-0x000001DB40954000-memory.dmp

Filesize
720KB

Download
memory/4608-2207-0x000001DB3FFE0000-0x000001DB3FFEA000-memory.dmp

Filesize
40KB

Download
memory/4608-2150-0x000001DB223E0000-0x000001DB22814000-memory.dmp

Filesize
4.2MB

Download
memory/4608-2151-0x000001DB22C00000-0x000001DB22C18000-memory.dmp

Filesize
96KB

Download
memory/4608-3468-0x000001DB429B0000-0x000001DB429CA000-memory.dmp

Filesize
104KB

Download
memory/4608-2205-0x000001DB42230000-0x000001DB4227C000-memory.dmp

Filesize
304KB

Download
memory/4608-2204-0x000001DB420B0000-0x000001DB42160000-memory.dmp

Filesize
704KB

Download
memory/4608-2203-0x000001DB42170000-0x000001DB42222000-memory.dmp

Filesize
712KB

Download
memory/4608-2202-0x000001DB40000000-0x000001DB40050000-memory.dmp

Filesize
320KB

Download
memory/4608-2201-0x000001DB3E4A0000-0x000001DB3E4B8000-memory.dmp

Filesize
96KB

Download
memory/4608-2153-0x000001DB3E130000-0x000001DB3E45E000-memory.dmp

Filesize
3.2MB

Download
memory/8172-3492-0x00000293FDEA0000-0x00000293FDEEE000-memory.dmp

Filesize
312KB

Download
memory/8172-3491-0x00000293FDF30000-0x00000293FDF42000-memory.dmp

Filesize
72KB

Download