quasar | hxxps://mega[.]nz/file/7fxSQKiB#loBUO-15NuqWvmYAL0aqm47lpJKQz2Lo3_N2LezJ6ZM

Analysis

user interaction
yes
max time kernel
385s
max time network
387s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://mega.nz/file/7fxSQKiB#loBUO-15NuqWvmYAL0aqm47lpJKQz2Lo3_N2LezJ6ZM
Sample260623-temkyses5x

Score

10^/10

office04 discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.1.44:4782

Mutex

a755dfbe-2a4f-4f04-9286-94cc00967666

Attributes

encryption_key
9E158EB1984CB9E7C5081E024A33B59FA66EBF61
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000024448-333.dat	family_quasar
behavioral1/memory/2692-418-0x0000000000A00000-0x0000000000D24000-memory.dmp	family_quasar

Executes dropped EXE 7 IoCs

pid	Process
2692	AzlooMINIGAME.exe
4340	Client.exe
3112	Client.exe
2060	AzlooMINIGAME.exe
2436	AzlooMINIGAME.exe
4748	AzlooMINIGAME (1).exe
4732	AzlooMINIGAME (1).exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267039064878141"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "201"	LogonUI.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{645DD4DF-2729-4832-8FCC-6116778D45C5}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1452	schtasks.exe
4212	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
988	msedge.exe
988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	AzlooMINIGAME.exe
Token: SeDebugPrivilege	4340	Client.exe
Token: SeDebugPrivilege	3112	Client.exe
Token: SeDebugPrivilege	2060	AzlooMINIGAME.exe
Token: SeDebugPrivilege	2436	AzlooMINIGAME.exe
Token: SeDebugPrivilege	4748	AzlooMINIGAME (1).exe
Token: SeDebugPrivilege	4732	AzlooMINIGAME (1).exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4340	Client.exe
2060	LogonUI.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 456	460	msedge.exe	86
PID 460 wrote to memory of 3940	460	msedge.exe	87
PID 460 wrote to memory of 3820	460	msedge.exe	88
PID 460 wrote to memory of 3820	460	msedge.exe	88
PID 460 wrote to memory of 3820	460	msedge.exe	88
PID 460 wrote to memory of 4776	460	msedge.exe	90
PID 460 wrote to memory of 4776	460	msedge.exe	90
PID 460 wrote to memory of 2664	460	msedge.exe	91
PID 460 wrote to memory of 2664	460	msedge.exe	91
PID 460 wrote to memory of 2664	460	msedge.exe	91
PID 460 wrote to memory of 3856	460	msedge.exe	92
PID 460 wrote to memory of 3856	460	msedge.exe	92
PID 460 wrote to memory of 3856	460	msedge.exe	92
PID 460 wrote to memory of 2124	460	msedge.exe	93
PID 460 wrote to memory of 4356	460	msedge.exe	94
PID 460 wrote to memory of 2124	460	msedge.exe	93
PID 460 wrote to memory of 2124	460	msedge.exe	93
PID 460 wrote to memory of 4356	460	msedge.exe	94
PID 460 wrote to memory of 4356	460	msedge.exe	94
PID 460 wrote to memory of 3484	460	msedge.exe	100
PID 460 wrote to memory of 2852	460	msedge.exe	101
PID 460 wrote to memory of 3484	460	msedge.exe	100
PID 460 wrote to memory of 2852	460	msedge.exe	101
PID 460 wrote to memory of 1656	460	msedge.exe	103
PID 460 wrote to memory of 3956	460	msedge.exe	104
PID 460 wrote to memory of 3956	460	msedge.exe	104
PID 460 wrote to memory of 4488	460	msedge.exe	105
PID 460 wrote to memory of 4488	460	msedge.exe	105
PID 460 wrote to memory of 4860	460	msedge.exe	108
PID 460 wrote to memory of 1356	460	msedge.exe	109
PID 460 wrote to memory of 1316	460	msedge.exe	110
PID 460 wrote to memory of 1656	460	msedge.exe	111
PID 460 wrote to memory of 1064	460	msedge.exe	112
PID 460 wrote to memory of 1656	460	msedge.exe	111
PID 460 wrote to memory of 1656	460	msedge.exe	111
PID 460 wrote to memory of 1064	460	msedge.exe	112
PID 460 wrote to memory of 1608	460	msedge.exe	113
PID 460 wrote to memory of 3336	460	msedge.exe	114
PID 460 wrote to memory of 3336	460	msedge.exe	114
PID 460 wrote to memory of 3348	460	msedge.exe	121
PID 460 wrote to memory of 3348	460	msedge.exe	121
PID 460 wrote to memory of 988	460	msedge.exe	129
PID 2692 wrote to memory of 1452	2692	AzlooMINIGAME.exe	132
PID 2692 wrote to memory of 4340	2692	AzlooMINIGAME.exe	134
PID 4340 wrote to memory of 4212	4340	Client.exe	136
PID 460 wrote to memory of 3052	460	msedge.exe	140
PID 460 wrote to memory of 3052	460	msedge.exe	140
PID 460 wrote to memory of 1764	460	msedge.exe	141
PID 460 wrote to memory of 1764	460	msedge.exe	141
PID 460 wrote to memory of 892	460	msedge.exe	142
PID 460 wrote to memory of 892	460	msedge.exe	142
PID 460 wrote to memory of 3048	460	msedge.exe	144
PID 460 wrote to memory of 3048	460	msedge.exe	144
PID 460 wrote to memory of 3704	460	msedge.exe	145
PID 460 wrote to memory of 3704	460	msedge.exe	145
PID 460 wrote to memory of 3704	460	msedge.exe	145
PID 460 wrote to memory of 2920	460	msedge.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/7fxSQKiB#loBUO-15NuqWvmYAL0aqm47lpJKQz2Lo3_N2LezJ6ZM
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2e0,0x7ffe5c71c188,0x7ffe5c71c194,0x7ffe5c71c1a0
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,1306134288859960625,6356203843958856045,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,1779341745457088505,17679863598967710540,262144 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,7391540466234105023,6848762341419559057,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,1627809796760307326,14112357915721466513,2097152 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,12683266022324550786,3925674018649505206,2097152 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,11811059722801043459,12020389234362036209,2097152 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,9189285779633202469,2741462035096209513,2097152 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,6743407983082856538,1429628620370588665,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,12644433670102986573,9550054301065783664,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,13320156333702524809,18224732908188012196,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,13320156333702524809,18224732908188012196,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,15262841297046076425,4293545539048098792,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,18398500851377729986,8107494628098839402,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,7735826539354317194,6835485241384931068,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,14692760739209053219,10713961191783520556,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,16273701608918887195,2030618719001081633,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5884,i,14793188482994591613,4209992602435951082,2097152 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,5453724862038633128,1505604644220649250,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,8590496558679530855,3458697275676267929,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,7498834174638356258,13713854580443769337,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,12110775135817563914,11077742444826611292,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5944,i,10192330282886408428,13344582222303639992,262144 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,3068833274673993873,18215921463887903385,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,8278374523313444685,1175658661939602206,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,17972000740279362853,11791554694365525006,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,12197427462833006213,3950204472351731563,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6676,i,151899179643159067,3700012824059327352,2097152 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,8888462677938254872,4580945222775050170,524288 --field-trial-handle=2160,i,12872439818693302037,7459938070031169884,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2624

C:\Users\Admin\Downloads\AzlooMINIGAME.exe
"C:\Users\Admin\Downloads\AzlooMINIGAME.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1452
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4212

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3112

C:\Users\Admin\Downloads\AzlooMINIGAME.exe
"C:\Users\Admin\Downloads\AzlooMINIGAME.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Users\Admin\Downloads\AzlooMINIGAME.exe
"C:\Users\Admin\Downloads\AzlooMINIGAME.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Users\Admin\Downloads\AzlooMINIGAME (1).exe
"C:\Users\Admin\Downloads\AzlooMINIGAME (1).exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Users\Admin\Downloads\AzlooMINIGAME (1).exe
"C:\Users\Admin\Downloads\AzlooMINIGAME (1).exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa396a855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AzlooMINIGAME.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AzlooMINIGAME.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 e4bdb70222bad9f2e100f7e3d74241311c2b6bdf25d1948301de40dcbaf5c716
MD5 e71af81b96b7c5dd81950849c559965a
SHA1 f28f2487a5357b537d2487ff1dfe8d5da4023f16
SHA512 ee1e25293dcb4840dbf7a6e915902f1f4d9a475add3930ae216059fc3505469ea54a2262b2b0bd0a15606763dc10f3e061fc00dbf810568aee63c7c08f426810
SSDEEP 192:+jQXwQQQQQQQmmmmmmmmmSSSSSSSSSSSSSMSLO:+jQXwQQQQQQQmmmmmmmmmSSSSSSSSSSf
TLSH
T13FE1760382D5E39ADB0510CB4AA8626C51753B0DEBDEE90C03DC9DDD304F5EAB9A6798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 b72327a4e4ea91686fa3317047271ac8a156f2c77bdccca5447af5380374b2d4
MD5 a23ad791910c31c7b7dda2830bc1e1ac
SHA1 e8335e8d43f8e76eb0f80af228a580852146b498
SHA512 57c11d1c7c515537b756946f565c0368c571cb584dba7c1c0578c571b8597d78f805e39edb066257ad9bb95c70075cc923cf891c4f0fbfbbd897a6b6d7a1b146
SSDEEP 192:pjwehZZUPNNzYYYYpppppkkCCCdddduvuvuvXMbh:pjwehZZUPNNzYYYYpppppkkCCCdddduQ
TLSH
T167E19C0782D5D79A8F0E108F4EA8629D5072770DEBDED51C07DC9EED304E9DAB8B1A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3825ea913d618fb333e62d22228f3d86e2893985f0231841f0fa69fd621dad33
MD5 336a5ba6447a87fc2b05900c7874cf5e
SHA1 b08c2bfb04c2380c46d909bd050f9e32281f407e
SHA512 3310a42930bc0d4ad4cf3ef410772d1647c4cfb97c7827b9a329cd795f22fedac229a58660e26f97b4b7c7d4ab3fb6cc560f2f977ee4abb9b64f42b744888d6f
TLSH
T1577108785E0708A5D703A0B374D252C032318AF7F426EAB5C16D68B06607BABDF1B47D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586e45.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586e45.TMP
Size 3KB
SHA256 b2a1f669a29cae7425adc7be6be7086f9b0d85f685b60d7d849ee66fa848223d
MD5 7eeca4287a4cb42451634c02f69fff2b
SHA1 3f0bba4970b43ecf8b1b4db1400fae8a665530d6
SHA512 5cd1d7bfd939f0fbe26fa95e588a2aa8898a5be5c2bee327ae2b481cfe8c8cad546f8d45f122d8a8fbfd95e123d51fa69f4df3b3efa16c4db8b2802867d641a3
TLSH
T12E71F9785E4708A5D713A0B379D252C032318AF7F426EAB1C16D58B0660B76BDF1B47D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

7f6a37e1-661b-4957-9f99-6ba173217041.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7f6a37e1-661b-4957-9f99-6ba173217041.tmp
Size 1KB
SHA256 328a11221d4ff2b8da3ba4e294321096740496e410972ba6112b5d9a31e7178f
MD5 be507cd31222ad8e0af92fc0951a555f
SHA1 bcad8232a0bb6303f4eb9e3403f00f1827bb2be3
SHA512 e2a82f8cadef4c2e7360131d961ebe2a22d3e2edadf93aa5cb3c4ba9714bd80a2b62a2d4bc5b55f5aa20fbae250618514a35c22eaa49484d20a52be44cd03d4f
TLSH
T16D31CDF783B185AEDE1156F0EA146E2BCE5C011553AC3C6A8AE4EF57A3E2071E101E1B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1916ab106c3a7d391f0812f31856f30bbaec8d321df1b89f38d106b8a57d90e3
MD5 9865fd4d7d52883857fa90217ead382d
SHA1 8db8320c4b60c5cee2015f6e1e11d9baf98ca6b3
SHA512 8a141cf3048626e8370da7c8f84a3e568eef6eb00e54f9db689ac8d8f2586ac8db34683b1c6716d1d2a69243d26ea880f44396a8eb673b79b530da0a89293c27
TLSH
T1E031CBF783B185AEDE1186F0AA046E2BCF5C050553AC395A8AE4EF57A7A2471E101E0B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 77705182f291e3fce51dd2f47e173ee0cea465383d546c8b2e93bf4a0b723a16
MD5 f8b9ad21fa895132cd52faf49c332b1a
SHA1 c4efe39f6005ece22d5942994382c2eb4f30f4de
SHA512 d2a368cfff2b93a7989704bcc5d9be36bdcdfcce0654f84d47135a1f8de02f6ddb47ae080a055b4bd94dbdfd07670387bfe4292b44849e93159919cb72796121
SSDEEP 192:sxZ2RfyM/jK1Ml8Mkn/fHsJezBAIdpL8HW6+WNQPN/YIn82SIgrJ:sxZ2NMn/fHsJWBBQHbS/49
TLSH
T10352E9126B38597BCCDBD209B945BF53D6F95573A6900D449AFCDA0C04E6BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d189d860a49fde65c209000be608c4fff1f915ecdf09fa7028c55fbd481f302a
MD5 c42e6d37b7717022e1ceebb4d3f577d8
SHA1 0fe7d7f7a066063dc69fd43d720f1f365c347e8f
SHA512 59c8fc862b816cc19ccd38ec0897d66d2afe70f5e2e70957cb390659d0d234aa327323d73941114b3be6e370129e05a18942475fa8af6c3b7f815d3620b60e83
SSDEEP 192:sxZ2RfyM/jK1Ml8Mjn/fHs2ezNAIdpp8HW6+WNQH0dYI5leSIg5qJ:sxZ2Nbn/fHs2WNBmHbzdBU
TLSH
T15D52D916AB345A7BCCDBD209B945BF53D6F85573A6900D449AFCCA1C04E6BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f7d1c73fcf97b33694632c4c1831a3770280660b970cf738e13ced09def7b2c6
MD5 c14fd4bd8be2fd7195c605d951b6f214
SHA1 e1e1e2c33efe809f86de8a9e719c83418edd44d7
SHA512 44d2c71f93c9dc91bd1f316b75fccdf97c191a7fe92b9d07dc02b2b02304dcd8dd030d71da481494a6e7a1d9a1846f2a128fa8fb93e70ce2cf8ee47baf137d92
SSDEEP 192:sxZ2RfyM/jK1Ml8M9n/fHs2ezNAIdpL8HW6+WNQWDZYIP02SIg5qJ:sxZ2N1n/fHs2WNBQHb9ZMU
TLSH
T1F652E9126B385A7BCCDBD209B945BF53D6F85473A6900D54AAFCCA0C04E6BDC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 1e4c6dfa088ccbb344fb21e4bcc518d33bd6b47192d545dcb738ecaf2f32486c
MD5 8265d6e81d5b9c0b2de31a41a3416422
SHA1 b78864388853ac72502973ee9d2fbec064ca6219
SHA512 e6e2f0dce298061f43c85eafc075acf8b6ddee3b96218c2708f21b2dfe481b9ebc6e39d572fa034a758baf6dd05e9dd36c8623fac4fcaf1fb1754196edf339b4
SSDEEP 384:sxZ28qgn/fHs2WC66s8qMpRiYnazAW8pZS15posJWeT+CBmHbjx7U:seLgn/f6C4Mnc7WeT+CoHb9A
TLSH
T107D2F806A924C8778EC35D19747D7E339AEC50926384CEDA1AECCE0C019D5FCAB4786B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 a91d1dbd6db086cff7cafd083fc323b7338897ff3a335a584750bf24b24bfb15
MD5 4a9b0d5040f10079138b942ffbb13431
SHA1 1f22014d20f51d0fa4374e4970f85236291b9729
SHA512 5f081f7664dc52e9efa4d63efc6c33f021108c960492848b3a720301e82d5ed842c3122d0434f9357ad02691d72b3cb864d827a9eabf9749b729d5bde903334c
SSDEEP 384:sxZ28qWn/fHs2WC66s8qMpRiYnazAW8pZS15posJWeT+CBmHbjx2U:seLWn/f6C4Mnc7WeT+CoHb9f
TLSH
T1D4D2F806A924C8778EC35D19747D7E339AEC50926784CEDA1AECCE0C019D5FCAB4786B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 31f74c9a9e5cc0d2a81a951b8769d565ccaf04295b1d2d85c0d9aaf64f9bfe9f
MD5 85673201e66b680e5ae66d785f78013d
SHA1 b439caef61bd0cb8e58b06967a6e2de73efe91b0
SHA512 e066ee3aa2565f8e21c635a5987b82ea1f81f1921da89a24e3008302730d935f7495f6624ce02c85451587ddb585412ca45ea5ca712363c63a4dfed7b79dac88
SSDEEP 192:sxZ2RfyM/jK1Ml8UQg9n/fHs2ezNAIdpp8HW6+WNQH0dYI5+eSIg5qJ:sxZ2NqWn/fHs2WNBmHbzd0U
TLSH
T10962D916AB385A7BCCD7D209B945BF53D6F85472A6900D449AFCCE1C04E6BDD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d0889c45698821622055305afffa341090f41d1f640de94b0fe8104d1b9d5064
MD5 14ed7dc229229e4d332a819f80a470b8
SHA1 d568cc541818772e486fa698bf8a79166f73abec
SHA512 3381c959444066085b367f4125352d5215466e5230c092b0cc42d1723e96b7e4dd5d93343e2ecae3d4c6c765e939d2be6b615be12dcd5759775549142114faf6
SSDEEP 192:sxZ2RfyM/jK1Ml8UQgjn/fHs2ezNAIdpp8HW6+WNQH0dYI5leSIg5qJ:sxZ2Nqgn/fHs2WNBmHbzdBU
TLSH
T17862D916AB345A7BCCD7D209B945BF53D6F85472A6900D449AFCCE1C04E6BDC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 90c38d94c55e91e10dea8089e9af60690d6af8307546d67f2126fa572bdb46dd
MD5 f7bad350d3e2267c68677cdfef2a4dd7
SHA1 32967d7a9313a379c5767281e17731c6e9906fd9
SHA512 82b34dd77ffb5eac2dd611ac63859d85a9f6422b56e7b0aa2b82e782354930ce66a9cf8a2e3a12603f1d56dc57d4f6f30155b58c59d1b54fa867c7b4827652eb
SSDEEP 768:vbsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9QroJX9:vbsqxXlWvJD6Tu1ja54LAs97JN
TLSH
T1B1D21B3B694CC77E4F840E5CEC266FD76ED801CBA6988D5447FA884C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 033f14618e55972909968dc8d06ad5182c134ee68fb009c846c8b3658a87cf57
MD5 17baa63e90f140bf3fe331afb528bf58
SHA1 18b79927266bd35cf37c817e0d3a1939167a81e9
SHA512 042127dcf0a4b9d05847c0b34c0447f1532e2b021cd50544be8bb4c9f875c3475b992e7d6739a3561efc7b4c84ecb0a7ade0c1eaf591521b7e1dc92731ba68b6
TLSH
T1793154CD4E50959BECA488B2147271B532B0C8CC2B11A7138C3C62777C2736A1A6B2DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cb166.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe5cb166.TMP
Size 1KB
SHA256 e2344fe80e96395bf62a68d4d881ed0c952db178cb85b3c4b44b2d128af85eaf
MD5 646ea32bc3474853df2100567baf61ae
SHA1 862dffdcedd4d8460c985699d2a108af03a30a02
SHA512 76e284dc3939cc8dfb35f478f09e5ae3df77b598b8c68af7beb74820c401871dfe5a9ec0b39d09038d836c9abf780b730a3186fe4c47871a152d054c2b29beb5
TLSH
T1C631638A4A419A0BECD444B20993A4B83379C8405322B387947C6239B8767BD1E5F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9fb5184ab0d0f44e33e104b54a6d342971b613a8d45ab987029d324eea9f5747
MD5 168f38b61b957cbf40312cbe9c41e22a
SHA1 e0a9fb10d9171800c13f70b64019b1ecb1c9ce0e
SHA512 4606b07fc0611bd9b54ae764644ff32453fe5f4fde75e8a2ca885796e2ca3c3a34f42a719ecfaf4f1eaa7d0f23989154607c64c44396aeffd6e5a3506a287c73
TLSH
T17CE06FBB2AE70800A8ABC3EA187344AA8410F828C991EC4F1029A28310622A02822C26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3c2b75b2049cd7083de05356d5543dea5448da2863fda0eb20b215d3266528b5
MD5 794e2b4b9fdca775eb78775219496539
SHA1 d40e4a381fdbb55609e525bf133fcf5da899c7e4
SHA512 5f8de0633afb0d68ee0a310f7ca79ecbfd8237ba0e1c88beb12755ee2e2c6be5e018c7615b89405af14b57517cc455a72322a77ee554aaab90b75e6c71d2f8bb
TLSH
T1DCA0026929549561D3447270907341C42252C9100E0A261250EC42588D54189412243C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587a9a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587a9a.TMP
Size 48B
SHA256 0f6ebdf7654b274e28da072a2ff5b0d4a5c06ba3821de626ef7b70d5ffdc16a9
MD5 18d70afc84bc7c20ef8466dcd83531fe
SHA1 bd5e7aeb52506d08958cec75ef6e317d704b9118
SHA512 cfa2250b29a8ae6338e535a83ed30e1dd664f60d7825a8fc11871fe4f2a0f6be59383e41973e70ce7044c35fb1954440609df9f08ec277158cf38473eca21faa
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 19eaf33df73d481afc1c55a767561ff6e4e88ff887d701797de39cc891282eac
MD5 e09fe87a59648d9385ccd27287fee664
SHA1 17c1d1c72560f4ba9918908a4b2e1738d3a845f5
SHA512 3dd330abb0d7f326d67c68c6150160d15922c7627983190fa5198ee51e7a88d12e0366066d183557f10dd03756c1cc2e8eacc48da62c999553b08fa25e0c34a3
SSDEEP 96:KYbaKYIKSogKteiCQQKp2SAgKdG6Wh2KKgq:Exb7j+rtr
TLSH
T15FE14A56713B220338BD2948A36695769E4132A33418786F7FB840B65E77E220EFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5904f8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5904f8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7bf234559fa75184cb55ad04e6916478f43e9d6a1589967e06ad48e324a608f8
MD5 eb34a064ae230e46cb9aa29e446b88c0
SHA1 83ed45eeddd85fe8a0e042803c8d288b2137fcad
SHA512 8fcf0a2704c33f68d6cabcabab1b7c72e3a07d1b40c3cfa6da2445beb65bdc383a81decf014cb33857c6a235c82cc94cf5e70e7652380f99614ccbf80c7e6794
SSDEEP 384:UtNn/s3n9SfsNtoBJosbbXuVRN+Oi+p9hX/ITGT0IrXayXx99:Uj+9UiysH+Ois9hPi+0oXayXv9
TLSH
T117928C336D789C6B4EE25086F54B321B5FF811A7E6C53E84D1EC6F0D05CE6AC231A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 005d64c12db9b5536dfe0f42affd4e96604523b85d436e884e436acab03c0eb3
MD5 f2d7ebaa12c15e54b9b654ca20868e35
SHA1 bc220d011568e8967877ae7ab67ffdb4e45ddbac
SHA512 a1ee26f525dd3a3cddb3cb1a10f7cc153bfed59b1f264b5f8bc38c41b8ae660ab0b415a007388e6e3212fbf630c283239fe14c47fa4d3a8455229fe2ea9720a0
SSDEEP 384:6iFKtNn/s3n9SVhsNh8TUNTUlIRFAJosbNQuVRN+Oi+p9qX/ITGT0IrXayXx99:xFKj+9QAwglXsH+Ois9qPi+0oXayXv9
TLSH
T1D3C229F249D7887ADAAE4747B77E2D074EBCC067B5806A50B3981E0CCC8A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 239ddb85f8ea58882c67888d71099d835d1b77bc94aa634b9f88f156c1f8bc1e
MD5 3d929692e5739a4e74046aca4ccfecaa
SHA1 04fff3544e01840c63b866da12dbf7a4f7758644
SHA512 bd1374e89548537f103356c439fd617ce86eb80e445174ee13ec046525220237cc84ac2f0c80996987ccf76409cc86f15141b1e45b61b978423fbb1bcd4511c6
SSDEEP 384:6iFftNn/s3n9SVhsNh8TUNTUlIRFAJosbNQuVRN+Oi+p9qX/ITGT0IrXayXx99:xFfj+9QAwglXsH+Ois9qPi+0oXayXv9
TLSH
T16CC219F249D7887ADAAE4747B77E2D074EBCC167B5816A50B3981E0CCC8A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3229cea6208f63c47ddfbff355a4c14f743d9c0b86742494d72c78141a826008
MD5 06d01be88a87a25560d7460e487a00d6
SHA1 803d02b5de4b5d5981d0dc2371ac207df7099c9a
SHA512 11d335d2eda0d9108e8aed59dd2e8b62007b087c69a1588e11d56997ce6411985249591c9ba92a378660188c4b76e041a8cb77e1992dd09752354a7c445281b7
SSDEEP 384:6iFwtNn/s3n9SVosN38TUNTUlIlFBJosbbQuVRN+Oi+p92X/ITGT0IrXayXx99:xFwj+9JKwg4hsH+Ois92Pi+0oXayXv9
TLSH
T1DDC218F249D7897ADAAE4747B73E2D074EBCC067B5816A50B3985E0CCC8A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 36278c8c84c78fc6cd3bc187a2d158f4dded51d425a74423fa51f5b7d97f80c1
MD5 cedc5d9fbf7c7fae46b86942538f907d
SHA1 5e7be03b1774e92002ec6241727f4f691ec6983d
SHA512 968a142b974e3c2ae3f4991e1465880211c67f0b075539b571bfd81ed9c3edfa4014ec670cbdd799fbf1ad8976dac64c4f74331d2b55cadd51f44444e4f5397e
SSDEEP 192:tONd6JkRtQmiUypPW+RN+OmJ+Nh3NRCU6:tONd6UrWW+RN+Oi+3mU6
TLSH
T19402D635AD381C7B9EF36E49B88B27175FA8202BFA856F94D6D81F0C01D765C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fe4c0bf3041e2c24d39dc88b26584bbc927d0a8c1b20b930340c69a2410a6ca8
MD5 a2d52687c8db890c2a5d4b5d6712d5ba
SHA1 67a40afe76cdb6f20a2f4510b62bf6c777c3013a
SHA512 f4b586fd8d97ef6d667369f871612ba8ec08d747ec006d53952c72fd23b60b2add131bbe2b7ecb625240c97d20a96b4abcd51322734f9e7ddcb9e68256af5473
SSDEEP 384:StNn/s3n9SfsNtBBJosbbXuVRN+Oi+p9hX/ITGT0IrXayXx99:Sj+9UFysH+Ois9hPi+0oXayXv9
TLSH
T1D0928C336D785C6B4EE25086F54B321B5FF811A7E6C53E84D1EC6F0D05CE6AC231A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 26db49556e2975c163869c0016a8e0628441527dc1deaf9b3307ce1bf7a2ed30
MD5 d421185b604c79a05bf4f30c21c42030
SHA1 de0cc190304b06eb56d09dc6d786cc238da20138
SHA512 64eadcbd7572ca0e500e78bdcce2e0199f344647bb97b21d6918d83db72df9e83579c6f535e85cff8c12def99dc56646f90c24c081d20be3a80db4dd784d8cfe
SSDEEP 192:GONg6JkRXQmiUy1PK+RN+OmJ+KG9FVcMqGA/U6:GONg6U5sK+RN+Oi+p9oX/U6
TLSH
T1DA12183669685C7B5EE36845F48B31175EA4513BFB897F90D1DC2F0C02DFAAC230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 15d2f0a5268aecd5086f9e02b32ab093e923773c823601a81f1bc415e034a806
MD5 dd22d31812a653e1340c0a9081074a89
SHA1 467cfe4d031da90d82baa887a3fa4b95aef0927a
SHA512 246859f9919d6fbe75769aa90fdb6b6f452aa5f1bc42fb1c92ff42d1f6887fc4621abd0ecd5ea1352c2f2d15dd36fc80033d9e5df39acd5cb5bce6ce1cab3e95
SSDEEP 384:6iFXtNn/s3n9SVfsNU8TUNTUlIlFBJosbzQuVRN+Oi+p9IX/ITGT0IrXayXx99:xFXj+9ifwg4RsH+Ois9IPi+0oXayXv9
TLSH
T11CC218F249D7887AD9AE4747B73E2D074EBCC067B5816A50B3985E0CCC8A1BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6e51336a270981e0bc54b8646d553609c470931c239949b773270c8cdcf88664
MD5 badb074f8df87ba8e3fb9c835f6c48f5
SHA1 ba6fa6d7a634d09f63c7229d3d29074b748ae0dd
SHA512 2e3be0e0b80eab180a09e58a16b1a5b7621d063f7f81f3123eb1982f842ed602e0bb8b529f5c403e016ce0a994842a112c562ee48f6e4e9a274b6090a76d6503
TLSH
T186412958B6F9114CB3B76F5AABF7A86D44BEB8332E06955D10110E4F0623A40C961737
MD5 SHA1 SHA512 TLSH

Submit Download

AzlooMINIGAME.exe

Path C:\Users\Admin\Downloads\AzlooMINIGAME.exe
Size 3.1MB
SHA256 ac9fdcbcc14d56292320f3985440aab3c7cd5fbcded6cb54ba7c313ea9f6df8a
MD5 b4d5226a54d6b9c123ff52f1dbedd39e
SHA1 7d6c8e4b0280602f0272627fad22b268d6c9b90d
SHA512 9a7ea25478fac080f1a4bb5d76f9b823d2d943947977d15effb39c7dbbdb9e3601f77417e4273649fb19a9eb512a4425119a84f1f6714653e2e74afbf9a8b1ba
SSDEEP 49152:3vyI22SsaNYfdPBldt698dBcjH3dxNESElk/iZLoGd3ETHHB72eh2NT:3vf22SsaNYfdPBldt6+dBcjHtxAp
TLSH
T16AE55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B1191677E1C53B5059426AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2692-418-0x0000000000A00000-0x0000000000D24000-memory.dmp

Download

memory/4340-437-0x000000001FD10000-0x0000000020238000-memory.dmp

Download

memory/4340-427-0x000000001F320000-0x000000001F3D2000-memory.dmp

Download

memory/4340-426-0x0000000003400000-0x0000000003450000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads