quasar | 75cbf4da21b9a4f28975d19b0d1b501c332c699dfa0a1dcb7700f01f1db6c240

Analysis

user interaction
yes
max time kernel
517s
max time network
517s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_2941.png
Size 795KB
Sample260821-csswfsvthv
SHA256 75cbf4da21b9a4f28975d19b0d1b501c332c699dfa0a1dcb7700f01f1db6c240
MD5 f3d16cbf4f91b5dc853c17dec7004b8e
SHA1 add4d24bf8b8af94fb3b50a74125dd4391b7be20
SHA512 c450b125f2852cd974044ccc03935e5ab0552e1d645abdf2d189facc0a4b58cfda9eef0ab3a4ff216df3f37db1a41b87cb646f936ccd3081e8101e8cb163417f
SSDEEP 24576:5VakRShbTBsDV2vAgk4zCPJET/q5kF29G608J:bFRSBBsDIIy0GVPYJ
TLSH
T1F8053323C36419CDBE5954E226B18FFDB53883C2E0AD94B06CDA936C96E15477122EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware office04ww discovery execution quasar persistence ransomware spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04ww

jewish:4782

Mutex

97a52e22-f86f-4001-83d7-443d3b422c6f

Attributes

encryption_key
FF8D521C70BA7BE67B262D3DB4B0C48846682D31
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
quasar

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/3460-1949-0x0000023002510000-0x0000023002648000-memory.dmp	family_quasar
behavioral1/memory/3460-1950-0x0000023002AF0000-0x0000023002B06000-memory.dmp	family_quasar
behavioral1/memory/2976-3727-0x0000000000F40000-0x0000000001264000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
2976	Client-built.exe

Loads dropped DLL 2 IoCs

pid	Process
4156	msedge.exe
2620	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
198	camo.githubusercontent.com
199	camo.githubusercontent.com
236	raw.githubusercontent.com
237	raw.githubusercontent.com
364	api.gofile.io
365	api.gofile.io
367	api.gofile.io

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_256215540\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1387744707\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1612465866\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1612465866\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1612465866\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4156_1059645840\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4156_696348575\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4156_696348575\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4156_1059645840\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4156_1029214390\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4156_1029214390\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1510489538\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4156_696348575\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4156_755654874\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1612465866\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1612465866\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4156_1144845457\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4156_696348575\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1612465866\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1612465866\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1612465866\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1612465866\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1612465866\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4156_692560416\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1510489538\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4156_1144845457\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4156_1029214390\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_367054242\_locales\el\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1352	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1480	PING.EXE

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5948	msedge.exe
5316	msedge.exe
3892	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317524975161973"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\NodeSlot = "7"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Downloads"	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1480	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4172	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2608	mspaint.exe
2608	mspaint.exe
4156	msedge.exe
4156	msedge.exe
5464	msedge.exe
5464	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3460	Quasar.exe
1940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3460	Quasar.exe
Token: SeDebugPrivilege	2976	Client-built.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
3460	Quasar.exe
4172	explorer.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of SendNotifyMessage 23 IoCs

pid	Process
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
3460	Quasar.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2608	mspaint.exe
2608	mspaint.exe
2608	mspaint.exe
2608	mspaint.exe
4172	explorer.exe
3460	Quasar.exe
1940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5880 wrote to memory of 3256	5880	msedge.exe	94
PID 5880 wrote to memory of 5948	5880	msedge.exe	95
PID 5880 wrote to memory of 4244	5880	msedge.exe	96
PID 5880 wrote to memory of 4244	5880	msedge.exe	96
PID 5880 wrote to memory of 4244	5880	msedge.exe	96
PID 5880 wrote to memory of 3132	5880	msedge.exe	97
PID 5880 wrote to memory of 3132	5880	msedge.exe	97
PID 5880 wrote to memory of 2800	5880	msedge.exe	98
PID 5880 wrote to memory of 2800	5880	msedge.exe	98
PID 5880 wrote to memory of 2800	5880	msedge.exe	98
PID 5880 wrote to memory of 3492	5880	msedge.exe	99
PID 5880 wrote to memory of 3492	5880	msedge.exe	99
PID 5880 wrote to memory of 3492	5880	msedge.exe	99
PID 5880 wrote to memory of 4232	5880	msedge.exe	101
PID 5880 wrote to memory of 4232	5880	msedge.exe	101
PID 5880 wrote to memory of 4232	5880	msedge.exe	101
PID 5880 wrote to memory of 2496	5880	msedge.exe	102
PID 5880 wrote to memory of 2496	5880	msedge.exe	102
PID 5880 wrote to memory of 2496	5880	msedge.exe	102
PID 5880 wrote to memory of 2568	5880	msedge.exe	103
PID 5880 wrote to memory of 2568	5880	msedge.exe	103
PID 5880 wrote to memory of 3312	5880	msedge.exe	105
PID 5880 wrote to memory of 5748	5880	msedge.exe	106
PID 5880 wrote to memory of 3312	5880	msedge.exe	105
PID 5880 wrote to memory of 5748	5880	msedge.exe	106
PID 5880 wrote to memory of 5376	5880	msedge.exe	107
PID 5880 wrote to memory of 5376	5880	msedge.exe	107
PID 5880 wrote to memory of 5376	5880	msedge.exe	107
PID 5880 wrote to memory of 5940	5880	msedge.exe	109
PID 5880 wrote to memory of 4404	5880	msedge.exe	112
PID 5880 wrote to memory of 808	5880	msedge.exe	115
PID 5880 wrote to memory of 4404	5880	msedge.exe	112
PID 5880 wrote to memory of 4404	5880	msedge.exe	112
PID 5880 wrote to memory of 1444	5880	msedge.exe	113
PID 5880 wrote to memory of 808	5880	msedge.exe	115
PID 5880 wrote to memory of 1188	5880	msedge.exe	114
PID 5880 wrote to memory of 1444	5880	msedge.exe	113
PID 5880 wrote to memory of 1188	5880	msedge.exe	114
PID 5880 wrote to memory of 1188	5880	msedge.exe	114
PID 5880 wrote to memory of 6024	5880	msedge.exe	116
PID 5880 wrote to memory of 6024	5880	msedge.exe	116
PID 5880 wrote to memory of 2020	5880	msedge.exe	117
PID 5880 wrote to memory of 2020	5880	msedge.exe	117
PID 5880 wrote to memory of 2900	5880	msedge.exe	119
PID 5880 wrote to memory of 2900	5880	msedge.exe	119
PID 5880 wrote to memory of 2900	5880	msedge.exe	119
PID 5880 wrote to memory of 4964	5880	msedge.exe	120
PID 5880 wrote to memory of 4964	5880	msedge.exe	120
PID 5880 wrote to memory of 4964	5880	msedge.exe	120
PID 5880 wrote to memory of 1444	5880	msedge.exe	121
PID 5880 wrote to memory of 6072	5880	msedge.exe	122
PID 5880 wrote to memory of 3892	5880	msedge.exe	123
PID 5880 wrote to memory of 4696	5880	msedge.exe	124
PID 5880 wrote to memory of 4696	5880	msedge.exe	124
PID 5880 wrote to memory of 4696	5880	msedge.exe	124
PID 5880 wrote to memory of 2544	5880	msedge.exe	125
PID 5880 wrote to memory of 2544	5880	msedge.exe	125
PID 5880 wrote to memory of 2544	5880	msedge.exe	125
PID 5880 wrote to memory of 3388	5880	msedge.exe	126
PID 5880 wrote to memory of 3388	5880	msedge.exe	126
PID 5880 wrote to memory of 1196	5880	msedge.exe	127
PID 5880 wrote to memory of 1196	5880	msedge.exe	127
PID 5880 wrote to memory of 856	5880	msedge.exe	131
PID 5880 wrote to memory of 856	5880	msedge.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\IMG_2941.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd6bb2c188,0x7ffd6bb2c194,0x7ffd6bb2c1a0
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2068,i,6399996900098118512,13756198480355523778,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,11540521818261835827,6400532218248494274,262144 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,3472267376317276821,13399620518379108873,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,9342888651655076143,9479932387634407564,2097152 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,4208102101214134853,13238788579998237902,2097152 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,4173535615022415455,9219161826808664909,2097152 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,1984168861838133562,8248115218746340944,2097152 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:9
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,16050553969049032726,4194858805039704318,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,6724729683497416968,4819844037874818296,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,15645304764393246018,10885385108351880271,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5764,i,1934946005290020803,690422675602829650,2097152 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,13045767575859465943,18403625958090211942,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,13045767575859465943,18403625958090211942,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6372,i,14690004087131569090,16378398977956342926,2097152 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,3666131581472510995,4518375169685004335,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6500,i,4566508645542923139,18339203849894378202,2097152 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,10763977095262491464,10126440151204183750,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:14
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7448,i,6156184270900104169,5595652936979157268,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7684,i,11684330279663067580,7880410493217346981,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:14
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6424,i,8918894640119998947,10291463408400551847,2097152 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5832,i,13246070550056185017,7346863527323587535,2097152 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,17568760775031226517,10196725811801806031,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:14
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1252,i,17664583604163954609,5831344478826034903,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1256,i,12256025710416874040,11404219613305932451,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:14
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=1464,i,5417707737463823162,14848109401037698651,2097152 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=1468 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5880,i,975347704157371367,7674304602603983129,2097152 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7296,i,15548035790078614985,18184146022287035040,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,17022892647246709833,16445819213304607473,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,13995507252935218998,15215360002320671354,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5012,i,3676145196113255930,15717916017367499405,2097152 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,1449179574732562531,8949637873711341007,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,5004902850088458491,14333396165244247744,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:14
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,10964649357154397394,11921593463688801481,524288 --field-trial-handle=2364,i,2942846989516499895,7487749516724456646,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffd6bb2c188,0x7ffd6bb2c194,0x7ffd6bb2c1a0
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,13163463006921691445,6941296752474970695,262144 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,7885042178601163360,986220394672863330,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,13225198877357093810,8327504219258398277,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:13
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,16849428343219728550,5438504776874327759,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,16849428343219728550,5438504776874327759,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,12767642753454159341,11975485581557157601,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
    3⤵
    PID:2604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,1092105531836237577,8454688782825819760,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,4631568549321747944,6012335926556337935,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
    3⤵
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3768,i,8359732319054626876,10253240618429991730,2097152 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2736,i,12899202916748909704,5446405674375286706,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:14
    3⤵
    PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,1255699377401535844,15456986504152048018,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5472,i,2447842534184803446,3406863458951271843,2097152 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,3906574439682478190,4502595621428690035,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,7828577909114814162,9456345797294099041,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,9597210227634201138,17098701417299134927,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,15967664612552370699,14925925377073901005,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6304,i,17770198916242445194,12455655086071807851,262144 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,15159383073691721639,16364034272497315305,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,16192472771574443402,7818820772463540651,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,13903343093857560102,17980291432043094116,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,18416643957529525287,10355253025442506864,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5292,i,10998293809774831636,17653903600224040011,2097152 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5012,i,16946693298421814447,2152885077584663049,2097152 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5988,i,15815119950163310120,4759450906736866997,2097152 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,13568828866628701533,13535415057534981048,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,10777995195505247539,3799762905223023117,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,4912544768287436291,4497862988655672215,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,13856257598842857883,7119365600509183802,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,6167885942241523332,6902801119523144956,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4012,i,8984098398644696637,18156576315008929111,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:14
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,1850993451978069292,9094490326003140252,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,14611811484793337120,9892309431889539744,524288 --field-trial-handle=2220,i,8241397056458330849,952114897399660653,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:14
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffd6bb2c188,0x7ffd6bb2c194,0x7ffd6bb2c1a0
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,1921943216763505459,12683652187359600906,262144 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,10125676294444093574,12159358199580292074,524288 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
      4⤵
      System Time Discovery
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,787790649969832061,9939186973261323332,524288 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:13
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,12245990093743803540,10534667831421429302,524288 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
      4⤵
      PID:1228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,12245990093743803540,10534667831421429302,524288 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4924,i,16645678705377462529,15287061338439409062,2097152 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,2190080297344049443,9133376106470115585,524288 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,5627497507459064698,16211920641087131185,524288 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5672,i,6121380553906832218,12598097804340477643,2097152 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,10753756217625504154,5709134477720729549,524288 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,17050693568074151683,8143855932327697178,524288 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,2391783610819391089,5805598982137675501,524288 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,10879697717529327463,9885823544504115338,524288 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,4723737364392628173,13599535792860419988,524288 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,2750138440792433751,12880026918885004871,524288 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,7663002824202252914,3660925153260735207,524288 --field-trial-handle=2320,i,7403951199312033945,15525743074146291341,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:14
      4⤵
      PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1548

C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Quasar.exe
"C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Quasar.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3460
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12"
  2⤵
  PID:5956

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1608

C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe
"C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2976
- C:\Users\Admin\AppData\Roaming\quasar\Client.exe
  "C:\Users\Admin\AppData\Roaming\quasar\Client.exe"
  2⤵
  PID:4456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IwqZq7jAr2Yz.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:1352
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3032
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 749175361201bd0417ccac5903bcc8b9c6c7c143e7ce1a660c32b66cd638d3b0
MD5 d2b6eb2a4f0969fb42aaade00c006221
SHA1 c2e7bbf11b2e2d10fee2be7a84c21a760afaac82
SHA512 8fc3cd774c52712858f9dd859a319800c62ff630ddc8e4123bb1ea38a867775b29ffcb185c534d57785c5b2663f7b9bd55d4d6801a13f6950759209e173bd7db
TLSH
T1C4D02324993CFED1F023513D01A03300309E0553B947F207B160410C4C7514213F0CEA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5021ec2f09a2284a7d4cd151a6b4352f580f2b17969b268d0ae0686e088855a7
MD5 9522a8eae980164f30442aba0a229ddd
SHA1 a31c4cf7ac1354747f0cd4d1a7ffd0136034f8a2
SHA512 3d1f16a42ce191ed5518240b510131b8907313e811b6a47e44bfe49a4b217c4a37747c942cf27cd6bc31a991f3003936c8436f913f513e15b751579409910fbe
TLSH
T18ED02339932EFC01E003413684D03711315F5553B417E107B0A0030C083B24073F085B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3173082c81b818190b7198cae93be2cc604513d8e5ba7159c1cac7e8c7a28ab6
MD5 db83f36ddd3b6abba587330635d50d0f
SHA1 d4235f16a2ea90690b4425c82e434c42f0b836c8
SHA512 7a1c3c4efe46c67cd34facb36d320e1599ad1aca19520135c54fc5c5999c081c874de47aeb1a087ac97a4f4956d57d8ce4726c4862d9904e732ffa7b2d6b2904
TLSH
T1ADD02335932EFC01E003413684D03721314F55537017E107B0A0030C083B24073F0887
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 913938de8d939b8aed3cc8ba73ff1571ceffc55bd4eace7582667da0716a72db
MD5 287fad8076f3f8ef9658a703f38132a3
SHA1 a2148ba1962e93112b7498e57b3cfdf5be7feebc
SHA512 3e62793f744e8f057cbdd0957d1db644e0e322d4e026a9effb3ec1bcd75ee09530039c1702125d59a12e12dcca8dd8e7950df669e3d5425b9ee65aa049fa504f
TLSH
T1FDE026AD84ECC26FB704E487A1E8932CC3C8360E93C8A99E1704C8CD71820C9A2C6690
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 138KB
SHA256 5de629c89665475826f9f51f913f7ec3d3c4a72192ef202f7d8569f8c3ebe8e1
MD5 5c824bc480b1fe1aaa855f8be4321fb9
SHA1 f240acee262335ee8b0e47a5d388d6c7574177e4
SHA512 38c40f23d4faaa59931bb6b33a5b827b5ffb6a155c3e1180e6e13cad00ca75214ca51e23180aed6221357b72aa48de56204008eaa1dfe90fef3c052ef4cbb55f
SSDEEP 3072:txzweTXlSgrRyaejW/Tob8UkSnKcCATG0DJ6a8ClcLp4Z:PZX8QRyaejW0jxn/CATvDJ6aflc14Z
TLSH
T1EDD3124F5C013A17A0AF5C7EE01616AC8EBFE9D7632740AC4DDD89331962867CADB4C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 68KB
SHA256 fc70b88dddb2da85326b7ff7e1fa801f0099e5c0d3a85863afd2737af9b199a2
MD5 cb3d1e69fbf9c94b15e92f2fa26892f0
SHA1 b8e5aff1547d49a1285e2e0c4cb43dcd9993f468
SHA512 0f890af69b223aaec8bbc753bbc626f6cf0e0660182e38871a03337f1eec7be6b47cb9d5034a3cb8c226feb6cd964d396f56fecf07257f3cbc13de642c175ac2
SSDEEP 1536:1RrPSv8UR94fNhLVxko8PojNVcL7tk9/yGeJ3GI:PPZGefNhLVxko8MrcL7fJWI
TLSH
T16E63026A7FAAA437FB2C87016FF23034D1F8FD579034042826515BB5A4578E92326F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 39KB
SHA256 28bc2090a696abac3f58b64052819146d487884bf63dfaa5b15c95a948e2b6d6
MD5 730c2d34c1758691b03f81479c4f8d97
SHA1 1353462d20e4eb282f6f7ac40ecf91628b1ceaf7
SHA512 a07e73c6cce577aa5be5ed0a307c6ec118acea5969bb0971799ba062b31bf01f5d1fdc2fa6299b86d4a1a3f96482f374280c3daa57cbc8763038348e7cd23455
SSDEEP 768:Dxjx1Coy6lWaLRB1FDdSEbmIovkJPx6CnE8H8lgDUTo/yX+Jy43:Dxz87SHCPFvOXHYgCo/yXRM
TLSH
T10D03F12CECB27134442817E581EAEFD9560EC6A7FA452041ACDBE741E0999D2D78FCAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 42KB
SHA256 22310e405b57df376701376c05a11935fb333e16ed4fdf9bff06c02f8883e253
MD5 6918f12cd8b14706edc5db4961ff8e8e
SHA1 dc5c2ba95b61d8e63100aee5dbce3dd2f17ced7e
SHA512 c0a403b0f93dc45c574de291400c6f9d8bdc4aad43b991a8ec4e11c28a2e347cd686d5aac537ec9ba2eb0818dda700fde42ac35c94ad8d5460528810fe346ec4
SSDEEP 768:zBr4ZuYWT5CC5Ep2Jr3QOmKqe+WMwvJahb/SiRAX56p/6qMTgmxgx:zBo+ELp2Jr3FTTTcb6iq66dTgim
TLSH
T1B513F12BDEA8D23B8F10815C513727B2D1C3941E049F93EFD5C918A72156ECFF991299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 25KB
SHA256 98ce629b9994d6b7d6975e76101da08c73c2bd3c94b21ec5e31f83a9caa62f6d
MD5 0834ce8e8c6abaef93f28f50d4a27f2f
SHA1 bf530837114ec85074f9b05e866c5a9234c767ed
SHA512 1f83dee38090b470454e361a302ae7b5947aa26ffaaa348c577679086954485796c68b25a315cfd10af850d4bf707d9ec239f01e015b4ee4eb9cece641858d31
SSDEEP 384:0V1AaZxQoGMf3uOO2BTgeinWlHLdKUEkaRLTkk9ZIidBSxjV4PKUQNnb4W8F/Pgu:Fa7aMJPtiSLd1KRpwizai/AMtPgxDpO
TLSH
T16BC2E139FA7F1485D28D2A0CDF2561FBCC6AE2E311F4A04679AA4DF531551AB3938330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 18KB
SHA256 612e63efd4158ea6bac61cd1f5586ad4a03e241eb59ec418fba62097032c065c
MD5 02dfa548fb3e8552f570c681e21c1e4a
SHA1 4031a90e66ed2ec780939480552c605ba90e66a7
SHA512 30a1510053bf9676436fd96540c01e363265a4f2f17f464966ed5ed7a69b31d4413e09cad4f0faaaaba9c1c9b96a126103e53b7c003e06c14c0757509cd7f47e
SSDEEP 384:vuPLcPGBF6qL9Sz4Y5W4yvgOFPiYlho/5W7VDCDbNoOAirdcJg+rHTxf45:vuPL22ZSz55evgOFRlKxW7NCDxoahcJK
TLSH
T10D82D0A033A21A3E45E5E40BAD13B0EA9755577FAF337A36C628617401FB5086DC806E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 17KB
SHA256 894485e3eb8552b04c0ebead2673011eb62439d4409316e1fb5e6a738a493334
MD5 ca67c262307e1ff84bda8a5889f6d793
SHA1 4037131f0c0b0dcdf987de92d352d16d49870d49
SHA512 22e732dd50283aac214201660930d735f235c6daa4db076878c959014461dea0b0b3e0cb040c719543d89eff1ad71053a27382523e237a535a774727b1e67a11
SSDEEP 384:PJsagVeFuQNT4c49Hu0kXk/b/dAlbGXb8MI05gmL:PJs9LQ54c49Hy0b/dA8X/d5D
TLSH
T18C82D080F854801934536B8E36B241DB2D72AD6717E1501B454BC68E3AFF38A65CD9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 16KB
SHA256 7d678ab5922798b8a99c27e51e08ee0404ae928f484f6b0edfc9921c4fa152f1
MD5 55b8f744eb27609b6ba2e6b624509727
SHA1 c06ff5b191c7f3d490fdd1d47d0886bf29d324f0
SHA512 b187e56056c0ed8a52d0efef060e18994fd8cc0ab23ce15cf6c733c332156a677414cb0e8735d5a1d2e2891a248bfb1c3aef1ccb28a2c9a9c1e5b5bfcc7fd26d
SSDEEP 384:PMRNTnHyPMpoW4gW52rfr/Dt+2l0+IL93qaz1EvhCz+cq88eS:PENTHl4gl7tn0591cQc
TLSH
T12B72D11D740B298ECE713516E069336F8F14E3295AC76B4A6C8D7D2E633BDA5881D801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 31KB
SHA256 e4424b1232c93d3d34142acf4719a526b69aae2ada04debefbd3520a3fb1c4f5
MD5 71459b5346c759b6243f0be619ffde65
SHA1 65fb8caa09a05c7cea37ef76024f24053eadb9fd
SHA512 c9838eae49a652d0d7069c366c8d6caad8f8ebee39172b3244a258ecdee638c43a72c98437f1d77e8cff551e106e2c15d320ab53b8e65b71a206715d59bbb2cf
SSDEEP 768:aoBxGA3BCFf2rhxDGj+G7XicLp6LSqlk3jBIRePg3BELz:3P33aShxaaQyczwkTBIQPS2Lz
TLSH
T107E2F1CD9063C6D0CA32482F5529F43FCDA5DD63B7222C0F928A2654D9EC9ABF9C6415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 30KB
SHA256 1c73ec9a4be1bbafc8f132f60744d54b5ccd060d77a309da27917c2b5d7d0125
MD5 dc993511c3b2af0400978bcbb87d4890
SHA1 eea995d3140f01650ae8f41de3cce688f44b105c
SHA512 68e61d98358b846c94ceafc89052d185749ff755ea5852600e3dbf70e012a96e64781beb0208f997a891d8cd65b3bf2f37f822383d85666fa5e0a969fe1f1071
SSDEEP 768:ssBm4Ip14/IeKDIFVk2BKeflJkr9VQUOvBec0nnMISeh/:3IU/IZcE2NJk9GbM3nMCh/
TLSH
T1F0E2E13A634D121D0F55F7C60687B3F3B628F5582598C194ABD03A84A99DF1214FF749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 b3384c0942992cb21bdf034c39587854355b591df38682950ebd103d1919778d
MD5 f56ebcb66bd7c6de6012165570201a84
SHA1 ff31b1ded2b76811d96628bf2511fb844515230b
SHA512 5f11b3411511d5daa6a16088563eca03d5cb4b911b3e3ac230d05cb318fca7b310dbb191e3a74273105629acd0573074c74667144d676211c35ecc9033d36e42
SSDEEP 192:gX+ug2ayhHyEw+9TNp7bAenkPVuqon77e:g4w77bVnEke
TLSH
T1F8329592BD7E2560EB9E2EB02BE5A8A736F2718260A30F0245005D785D21FD056EE4F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 d1d1077e87a258e68b5b4532025cf6bf79e3c03871c4c921edc653c34457903c
MD5 81ea0a841aa41a67d7293dc44cd0730c
SHA1 73194417e0b0d4174dc220a7fde357d972c4fe31
SHA512 9aa345ae119fdb33aa6d03266bfea89780ee678bda8a0bbbc1db6f7089f3b42383c8a829cb81251d78d6d36db1ecd11f34c32b179b509fe7dcc61aaf98c4f5fc
SSDEEP 96:B7fOAXujabZTG4lT+hEISR9ivxB36hbckJc0Kmgckoqfs8VFyKllpTqDtZoYEet/:N2AXujMIc9CxI5FUe/Ml8yrFHusu
TLSH
T162023492BE3E1674EB9D3DB01BE5B487BAF6769680934F0181002D354C62F6456EF8B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 8ff0b52c0b7f5e81206c4cd9c0765e0cb5d334a3c9364e1349575f45226f41f1
MD5 965bb714bb6c05a2c2a42a21f38eca87
SHA1 e8e2b9b04d181a0e2857e2939609c916d1944cb3
SHA512 6ebfbf7f5ef9e0d2e4cf252c444a6e165f277822d736d70d6fbea9e82b20aac9591a8af3b9d68e6d0751c4662d70d8333cdaccce607d4c2517af539ea2fb2268
SSDEEP 96:bU7fOAXujaeeUpp4lT+gENSR9ivFB36hbUkJc0KmgYknq2stSVFyKlEpTqDtZoYS:bw2AXuj7kI09CFI5tUy0ucE8yQFqCJI
TLSH
T13E0253927E3E1564EB9D2DB01BE5B487BAF2765680A34F0281006D359C62F2456EE8F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 3c5be192a53ea8f8700e83214f63b7ca0e7e5958b893bbb8a7e8cdb6f6385afa
MD5 51bf27ff8fe68542836fe7e808cef66b
SHA1 fef4f1bb1d5b8221397a3f884d232d9eebbc57d4
SHA512 9ff6c418fe58268f2ba107028a9456d65847664043bae4f9204286aa3c2340de6b329969208c1d5c6c6975daecf4ce7810867126a41b8c405016a0675768af64
SSDEEP 192:kYuUKYTzg4gae9LMYSdgBuXW1hrqsusG2RC:LxZUIYSE/4j
TLSH
T143225392BE7D2560EF9C6DF09BF17886B6F6714640924F034100AD789C63FA045EE8BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 5dd0c10159025e2152195f5ffad3285e24dd9c928bb7ad4f0faec0dd89cc84eb
MD5 a9f268138ee3391fb559de04c1f36e23
SHA1 b62737e11223d425062872d12f30ecee3e2612c3
SHA512 d8d2b5704f2d7d6c143e61d567daf1f990606a067c3f6658443e80dc55b295be3e6264d7b036b413d91b60e0443347470d7ef461aec1eeaf4b6c216549964248
SSDEEP 192:YmWeuOTLg9pEi9LM997v8hNDuXb49NqYuXKyNm:VnZoI997UKahX
TLSH
T1C6329791BD7E2520EF8D6EF0ABF1786772B1718260930F034500AD399C62F9451EE8BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a034d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a034d.TMP
Size 2KB
SHA256 2bff5bc1e519deb2dcaa9047a92c4c72a583b69e62ab3e7963c61230318c67a0
MD5 8229344f5aee22ea044e7a48a4ba5afe
SHA1 1fd6673216424e2958286a8def6e434e58c118c7
SHA512 f6646235cfb785a1a5feef0a1b491dda578519c2924035b4e6161b4b3c268a0aa906269bc97929a06c61585df134a609a3adf83b2fa419d14fe2718f6a224107
TLSH
T16B514F07333267ADCBA155B250E8B8DA36F2B56B407B5F2088102D7E0966F38D4DD9D3
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 8a322ba89a2b5265ba23fbaba1d1ab4988371288b39dee0fabff00fd04995af0
MD5 1cf1e486e476562597db85af78bfa6ab
SHA1 dd6a63b0dc5974dc1463275827833712737e1824
SHA512 22ebe528562acc57b95d13bd86e575e68ea4c6b651e5aab39f62fc7e218f2b8e75853e0280ddbcd685b12ed03b5a03cb8df4d4771a104d652e911bd76516f486
SSDEEP 3:MsEllllkEthXllkl2zEviKt:/M/xT02zs
TLSH
T15C4404047FC00C05CF0450304413C354C774D5340511D74334D104375CC75C04C40040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 2e482add0ea7bc1fcebc8e3c54d2de7f571388f980371e68fce63f49c26c92fc
MD5 d4269e0ee2920c666fbbed65c475ba55
SHA1 5c159483f4a011c813ea52da663ca64e252af6fd
SHA512 f282303f0b9bace8b2983d4c66138d0be5cf826dca6bae2149c8d6495a2528722444ba5607c74999ad2c5a12049461d2a41ac32c17d25d197ae76121ed34a249
TLSH
T171E07DA504CEC16DD454A8DBC76C470887D2342FF2883E469F089C447283242B28F38C
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 32KB
SHA256 ae1a8128887df14af322c1963caec8861f7bdcd0a14fba63c435f07ed01ee9b1
MD5 c37696fbe199ad95870d9f45445db7f9
SHA1 a03ce63042d665236bea0f8f1094fa776095d047
SHA512 ddb00380b9e97f22ca109be0ed21b1141fd5de42d93239ec0842411e5ec781a169dd670d3ee67ecdc5adf2351a876cd3e4c30b3d3a14aec23d606bf85eec42db
SSDEEP 192:bZgDEY1MY8cE01v/KERtDtUoTCnea/yZTIIhEM0Z:FSp1MY8cz1v/KcjmHuTIzP
TLSH
T1DDE229F39D65B805DF052AFA989D3AB2DF33D08CDFE1DC88B1210021887D1270AA06F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 af022b1abf4bbf57802a9d831eb642e5de587fe869163fee0143c5c310382baa
MD5 368ebd2aafa782da8e37669fc71ea886
SHA1 5c5ee3245f22c53ae5a2776b84c16d011bd1f904
SHA512 15f22aafebd6a968843c4c467709ad71073365022c59db64d81e1cd0e07ab4cda0f0f3f46954002cd889e5084198da5a726efe7f187b3313b3a668523f74abc0
SSDEEP 384:R6s186eo1hzsWou1Y1ybsH2vyIkUI3ijVoWN3qL/ciZ19cW1G1OD1ZS121Wo12Gx:h/bsWvD4i93qDciZ19n0z/
TLSH
T18524E9FF9E757B06CF2C50F5A8D929E7A52AE41DCF8298C9A46140A0CED2113424DBFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 35KB
SHA256 03cc3dc5cf671fe63a68cc9714ead1179be44920a9f1ea958414f60c6fd0c388
MD5 6b25ccb7fc86b8af0a4ee3bff5d95f5c
SHA1 8563fc06a6320f1f9ef8ed1e9675df88323894f0
SHA512 646dc9cad45b8ba08380f8d261e760c8e30c2dc194024147bb841a12ce50ed52c212e2e6a9b01ec9485d4914f5a04a387ee4df94c08fda462e2cc19aa9d07635
SSDEEP 384:DNxk9nbv5DxsLSQZvHeJ/g3WU7nclNvHe6tn28lz19PLlHP2YZ1A6x3nFfPyZrNq:UEHeLPHe6289PL7AH3mw3m5tJ
TLSH
T1A8F2865D75F98C27EBF7473B38F2342C89B5F604B848CC9D60A12D6D4ABAB8055097A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG.old
Size 343B
SHA256 8c9044473c9a4eaabdbf47927c9a78d574bfcd84cf015cb54a7aab932eac0026
MD5 b106176ba42f80d0d86c8d7ea4d3e3fa
SHA1 907c9c0dde65cd9b66dfedf4f07b0dc143713c52
SHA512 85df1d02da1149bbef9eb6755dea580001a9c64effc420fe75900f0c9ec12739ee6d1f5699d826e9b08e9fdbf9f38699fc89747a66bfe5ff312cc558367622fb
TLSH
T18FE0D87885C9C55F561554E799247B0E9EAB251EEB98ADCD0E01D814B082045B16E251
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 21KB
SHA256 89551f1bdc7a934736f7505671c35572db5644ce8111b45da7648acf731da77b
MD5 add47f12493a898ec6e664a287a2ad22
SHA1 9b15c5eb63f67d2609bca65e93aaa631678681ba
SHA512 99040ddd566d09ac5203b1f946b0f513f0714022e62ede67e51dc2f260f147ac2c620913aa4e5ac028f9df9854d3fe7f89c73fe9876a875f941c3a68840844b4
SSDEEP 384:fBuCVlxFo3+y3yyJveVlJkV9VvD4D+54MJLgxzTkMTMszeGkaSpK9kbkZkwkbkw2:JuCV/Fo3+y3yyJveVjkV9VvD4D+54MJg
TLSH
T14AA2976675F9150EF27B5FBABCB15BA0487ABE552D00DC5D64A0314E4D70F808A33B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 63d6b0799b223ea6c2fff709cc6c65416a13d7186559aa3144db389ccf50ba80
MD5 b5e25674bc6375e0bee8539bf1dc8924
SHA1 46059f7af249f807b7010b6cc124067795151a87
SHA512 b7fe3023cb832cef31bb631be877eee22764457b22d8b30eab91f422a01d773665b03029fcd1c6273ec5eafc28b1fcca16710b483e6a35f610dbfcc3e73007d8
TLSH
T123E0D87149EDC11E5604E0979224B718C7E5340FE6887A455B08984DB556104F3891C1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 1eb6693596b575d1c9253b8eade2b28f79cf2f312c297f5c9c1c7a1b16cbf45a
MD5 7a1145a3e097af3c01656c7e85a1b989
SHA1 786a163a1bfdf78efa13e49d553a673e32e8c686
SHA512 df1f29d47b343f889cd88104655a70e4bfb38f8c1a5c2482872b9ee0a51e41cf12c204ab9d7256797fc38ba239c4e818af98012883baf6be0a258c8dda9c620c
SSDEEP 192:DWvjxGmY1yjPaVZjhKua1mrZ4jmrmBmtmD0mzmgI75tcj/wKtzigvGkSPhA:DWvjxGmY1yjPaVZ0ua1mrZ4jmrmBmtmL
TLSH
T141E169F783B5866DDA1195F0EA08AF1FCE1C0512836C796985E06E17E3F2471E181B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 f8846366e7af0b73f91a8f784c9951ef66f5db8859b3bbb6e9f595e1c7dd0854
MD5 40c39989c3788b28a3af96bf586d3ac7
SHA1 47f96581e3515c3acf0342ecbf7b0be0d5f263f1
SHA512 ba3eb513c1975d8d1f8e0b75fba79ae02537aac58b25ca9b042a255f72a10857d13c31a6472699bc40e68c8cc6f91f2640ed55811b8dcf86b1361a179ea2f137
SSDEEP 96:DOOaU25Wmk5aVZjhKuaez5/GO5jtmr/h+vEBwVGmrmO0mDmtmnBmH:D9aUeWmk5aVZjhKuae9/75jtmr/h+vgr
TLSH
T1BCC1BCF783E5862DDA1155F0AB086E1BCF2D0511832C3D6A84E4AE5BD3F2871E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 516aafd300015dc11b224c0a40f6bf3b2d8ca53773bcfdaea3b3fcd6a179706b
MD5 199703845a96957c79eba9b328cb13ba
SHA1 48517e281e210ecb34410457bde2b44b935dbf68
SHA512 2a07e0f628990d7033fc8010553727ac86b4685ce50250daa3bcccbf32862663a7d7ec6c71a3ed250f84b1f226c3810abc1ff16588c92affa1a8c1c92f45f9c2
SSDEEP 192:DWvjxGmY16jPaVZjhKua1mrijmrmBmtmD0mzmgI75tcj/wKtzigvkSPhxx:DWvjxGmY16jPaVZ0ua1mrijmrmBmtmDl
TLSH
T128E169F783B5866DDA1195F0EA08AF1F8E2C0512836C796985E06E17E3F3471E181B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 3cc5a76ff473c81bf71f0494434067afd102a345638579589e422b4cf20de28a
MD5 1fdb6d5152a4b5375b43fef3cd259036
SHA1 260a16bdb34673666ff4305f1c119e48be931260
SHA512 ff83dd151f12456f1680062b0e2689806627887a36b139d171a1b8ff50504a78b07e1d07fa037e37725b2a717df4e3d9bcb32b5946cd3928948ef6b7ca1b0496
SSDEEP 192:D9aUeWmkhqaVZjhKuae9/75jtmr/h+vD4jkmrmBm8mD0mzGmH:D9aUeWmkhqaVZ0uae9/75jtmr/h+vD4D
TLSH
T1CED1ACF783E5862DDA1155F0AB086E1BCF2D0551832C395A88E4AE5BD3F2871E181B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 d1a6058f452f1137736ced14ce1b711e63f4844971b5ea97043c60e5dedde750
MD5 340f3d2b30b172eda4e7be7a5d5c8d7e
SHA1 37821a9000453cd4c7ccb7c7e94872c61fe3ce4b
SHA512 af79f16656c3eab598894bfbcf4f018d598fd9cc4bbb27c2637ee3c480bc22541b0b942b679bab840ac775a5e6bc37ef30b51d5cadb91589a78c9eb70560eacd
SSDEEP 192:DwDXvBmzcrjPaVZjhKu41jmr/h+vD4jmrmBm8mD0mzmbGIk75xtzF1Qx:DwDXvBmzcrjPaVZ0u41jmr/h+vD4jmrO
TLSH
T132F1CBF783E5822DDA1155F0AA186E1FCF2D0551832C3D5A88E4AE5BD3F2871E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a206f1ea1227cebca909d7eddac80b26a0660eb019c315ab2902a03bee75ee5f
MD5 d0d6fc265e6f8e29ff2081116e8917d9
SHA1 f642921b94a066482228fb67576672e6f062b1ef
SHA512 0de8bd4e05d0336a4a55c4f0acec90e15932ac9ea01ef49a4c32c75fc9fc599b2094eabfcf2ef8421ad033138af8afc791ca229dc4c867fd113bf0681479bb5d
SSDEEP 192:DWjxGmY16IM0aVZjhKua1mrijmrmBmtmD0mzmgjzigvSPhhGI75THa/ttcT:DWjxGmY16IM0aVZ0ua1mrijmrmBmtmDA
TLSH
T1A9E17BF783B5866DDA1195F0EA08AF1F8E1C0512436C796985E06E17D3F3471E181B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 65de697f634927c50876d0aa6f3f2f396b49d0cf9334b22523bd74a9b85a1ffc
MD5 78b94ebb476dc608aa04b41e0fb01752
SHA1 3bdf57d72b95b550da646a207ee81efad1f86735
SHA512 d2c6d4ea1e98a38f7912f75ced30cfb141a311d89b26ece736164d4111b79d6d0b10f757cdeb8d62fa99e7f4ec72a29a54b51b6a86ed3cbd62c8e8ea21da3458
TLSH
T1A0D0A793164120B5A5A82E9181AAEC4E8326005488429E94109068D905318591517045
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 7cdac98aeebc5d5420520f6e38f44a513af5c4786a0e0ed91f157c8508c10a94
MD5 0bac2256ad0518c17826605a8f04b31e
SHA1 60cde30f1ecb42b4005b90c534e67e776f4057c6
SHA512 817dc8a971dc927cb976db277c49de002d5a75595b9aef63d18267951bb8762a4768c28a84954fcd37d87c1432c4de17091f5ff0e6c2b6dc0e248d53861de21d
TLSH
T1B0D02263168131BDA6AC7F8181AAEC8FC73780648882DED850E478DA15318AC062B240
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 2bbc01f92d5266e005ea8a4d05d119083f02be36586938243420329f93461813
MD5 2f918e9e001f6af9a3c190c68c8bcf0c
SHA1 c1b705cd89e068673f9d62a3f099ec6b2ddc94fe
SHA512 0a84bdbb9ae40201faaf000c3bf613bd5f99fad9f022ebbb026bd017cbf4e7c4dcb5cc797d0b361cea0b3f224ad76c31b0a70ba40e52f24c66f3fbb3338b3f84
TLSH
T163D022A3164230F6A5BC3F8182EBEC8FC3270060C883DFD810E0B8DA053186E6927140
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 b868a03eb9a9af20de116d57591593426d1dcacffb12b1fd902afd7707bc9ae5
MD5 cc26600f6350e6262fa552d71b116804
SHA1 8cd6815fd1badea8160b66cf764563c2134c3e86
SHA512 a094fb863e1c8916807d7b696b8c685035642c3406740664cd8b8152a7fd9877ecbbe0334ec2445022c64e60c705eb75f6ca36d942c95d7e068d1751045ad22c
TLSH
T19361EF9382FFB45F20B8496F2F85FC061D7AE835415194F9DE9AD1ACB0894F75712022
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 4a639f43e0250c17f26cee724fc75f662242841ba7d685aecd81637c9eca2faa
MD5 ac500f47296222cf7badaffaf153f131
SHA1 88e902ba6a14b8dea0988b8bc6078b9f0268276d
SHA512 d4502481a5e58ae33e94066413e643a7e3f888e28ad948ccc74ed6b53a14cc3b2e8d022183a867997a9d5b51d8ad57f45cd9781c6f71eb48ce4f16869cfff2a0
SSDEEP 384:sxRjKm4C/fosZWv8vEcJtN/5jLDvBcv/zeRGd:sfKm4C/fFY8vHR/5jLDvwzoGd
TLSH
T18882B442592499BB8CC7E619FE75BF53D3F9106298D19E4CAAFCD91C00EB6ED2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 8041c32afbdb9cbc7dec3b61b1b1cecd3481bd6833fc0f73e468360ac6a6b25e
MD5 57b66dc4d83cc861e9bfb4a44b841678
SHA1 669e242f6dc49fd7d5ef3917f4a4261d2ab2fb5d
SHA512 4b336e8a69ccf3cca6cb07ab5580e7ea93674244dd29ed89cc4ff4e84dbff251a1e04cef85b5fdda658024d99ff9b5c398d06f3e9ab7f2efadf096ba9db701ef
SSDEEP 384:sxRFn/Km4C/foshWvTxEaTy9kil/5jLDecUf9XhMoHZd:sR/Km4C/fNYTxW93/5jLDa955d
TLSH
T1EAA2C6125520987B8DC7E618FE36BF63E7B910629C919E4CAAFCD91C00EB7ED1217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 0e753db8561962120b45a3ae78674de385ab8e9daa6881a8e8af2144bc6c9859
MD5 64a5eba8434cf6a7324e7bcd1f3e9d82
SHA1 ee5c25eb6f65be323a0bce2d7acefdb525d8a73e
SHA512 14764441f99758eeac8ca720cc8ca4c6615af38d4c4ef4422c4aa6580c90869a7447224a36d7c5a2ffcd00453d8a1fca84c70f55fa2e8180cdacbf16435a9bc5
SSDEEP 384:sxRjkm1C/fos3vEsJt1/5duDMzruv/aqyd:sfkm1C/fbvhx/5QDMzca9d
TLSH
T17582D6525924997B8CC7E618FE35BF13D3F950629C929E4CAAFCD91C00EB6ED2203817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 daa42d31f4101a7c05ebd8832724a26b2a27f387ba62a8177309d9955b900b46
MD5 1084e0d990e00f2debfef615b20aba88
SHA1 4c214fde940cc04bcb026e90395fdf1b0aba7cf5
SHA512 fa0253f65258eb18854bdcb477a8bec7ca03eb9ba292b5e9f35af5b2c78f04c9104c22c0b2d6d5865ae5e0dfeeebc7d207b5efa77c2d6d1eced852ba3a319d41
SSDEEP 384:sxRjrm4C/fos3vE3JtF/5duDMzHcv/rqyd:sfrm4C/fbvkp/5QDMzCr9d
TLSH
T16482C5525924997BCCC7E619BE35BF53D3F910629C929E4CAAFCD91C00EB6ED2203807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 70c2daa29134184f77bf7f3e4da2ee641cc12b762b2669ce0a11af5b4e74160e
MD5 33c44e9b04e146b9b039725c349b1f98
SHA1 3c8b5910d7cbfcabd12bc3cd98745e59241d0103
SHA512 7b162afe234f064c84fe9b10685f7151a2f9c34411d217756efb767a55586625ecaf2c43ea8e4ac5c928d93fc28964d21d706835646e58d16ca83832a6086aa5
SSDEEP 384:sxRjKm4C/foshWvTxEaTLJtN/5jLDvBcv/zXRGd:sfKm4C/fNYTxnR/5jLDvwzBGd
TLSH
T1B092B542592499BB8CC7E619FE75BF53D3F910629C819E4CAAFCD91C00EB6ED2207817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 8c56dd4aca157e51e5a757bfb62cb13ad763df5525826864d6b76ea69d58051b
MD5 15b40f3aceb1c74492be4a7ac82c71d3
SHA1 4adbd4da73673cc3fee3dcaf1df487bb09c4e5b9
SHA512 a9ea9010040323282d40317b66512e8461deb0f9aa524adcdc9475b230806c3e4017ded219e30879bfe2f4d55199265db2c823d7feb8680eb1117a0834355896
SSDEEP 384:sxRAZm1C/fosKZc5l7JtH/5mDMzsv/OqW1Bd:sMZm1C/fGZEl7z/5mDMzyOZd
TLSH
T11272E6125924987B8CC7D619BE35BF53D7F810629D929E8CABFCD90C04EB6ED2207817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 8de395f1a93c644db518835943ce590b73e27754a1621d3c9edec28e94eaaacb
MD5 5b86cb9f37ab206266b85d74fa38b1b0
SHA1 4be7bfdeab100f2047ab5cbf5c314e45b5ca1500
SHA512 c2cde33b32f37e170ae768fe00b1d6f914694d52e9945cc09078877c49ed1f722abcf649da667b1d5bbb0924031be2211a6ce29f04d3b18cb284b5f903e97434
SSDEEP 384:sxRFn/Om4C/foshWvTxEaTCs9kil/5jhDebOUfk4AhMoHZd:sR/Om4C/fNYTxR93/5jhDWk4u5d
TLSH
T151A2B7125520997B8DC7E518FE35BF63E7B910629C919E4CAAFCD91C00EB7EE2213817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 591cb266cf863e4f4fbf0172d5d380d9f572a84490d72246e091ca2f8abbaafb
MD5 108bcca70c19314b365cd12522dd74ef
SHA1 0a3a5c37da20cebb343ceca76afa4309b3d85319
SHA512 084887b401fbfaa3937cdf7eb82cf89f4ff507069dc43006a85fd22081d2c24cc7e0f0f3318ceb1a56a2bfa85f0be73cfe284d72da37764b9c0097a8fb09724a
SSDEEP 384:sxRjZm1C/fos3ZE8JtH/5mDMzruv/2qi1Bd:sfZm1C/fbZtz/5mDMzc2ld
TLSH
T17A72E7125924997B8CCBD619FE35BF53D7F810629C919E8CAAFCD91C04EB6ED2203817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 4c24409cdb56c8736c2ba026f1feb22231cf829745cb9e74e5d4e443957a7eb2
MD5 028aed0082862c11693271d6dc48c175
SHA1 4b7d28cf09faf8fcd5b72b6f5536a3f84839f4be
SHA512 2ac21576824139aafb8bb75e9a81fe4a0aa9adb25527ca6ed04f022eaaf8d7955aae83665a930ea569b7c6f4a22adf68cfdbab2b8e781e1d0dfe69cf8155ae89
SSDEEP 384:sxRFn/Om4C/fosaWvTxEaTCs0TA1/5jhDebOUfk4iThMoHZd:sR/Om4C/fGYTxR06/5jhDWk4iV5d
TLSH
T1F2A2B6525520997B8DC7E518FE35BF63E7B910629C919E4CAAFCD91C00EB7EE2203817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 06c837dd73f2a750c3aaab329d4547fd2a853cbab4477f461337b2049d67cc4d
MD5 a0fb2bb3e650e62fcf5c5b92bac3fad2
SHA1 00f01e19f965b905577e555a324897b527948a4a
SHA512 07035a71f26c7ce0e74095d53dade38d3815e2cb0091f5834f93a1e25388e7c0c31114373666f46b26a8f70ec22bdd8615452e07335005e7ce23345b71ace937
SSDEEP 384:sxRjkm4C/fos3vEMJtU/5duDMzJuv/Zqyd:sfkm4C/fbvFI/5QDMzWZ9d
TLSH
T1FA82D6525924997B8CC7E619FE35BF53D3F910629C929E4CAAFCD91C00EB6ED2203817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 256d36e08c5667d6bd90c1aa2f9324f46a6274650b8af5dd87ef12e80273e1f6
MD5 749419ff84daf81d6a1f17b8ee9b8698
SHA1 a22ef3efff59b76743fd1e9ec0755c99409f789c
SHA512 906c6856619ac2ce99f779ad5b19ab6c2a8c35b6b01ea7b9f4521eee4ac1000ed4338e621fd7226a15ffccafb9261fa576b40c376672c24a98baed47d4bd76ce
SSDEEP 768:jC+vJ47pLuLzDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1/0QqcTroZy:jC+vJkEzDQWgQ+f4+u1ja+/0Vcgg
TLSH
T127D2EB7B640DCB7F4F804ADDEC197E9B6DA802CB9698CD4047FA941C02C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b84f9c8463af7cbd7b4a92ed2b928daa60c64adb1bfd93cf8704c3cfa8ff8691
MD5 9d16ba4a15bf0b80d7e2f1335aae41f0
SHA1 0a32de3e85bc8427703c6c801c1cd53f22b37783
SHA512 071de94b5b9680bdf866042acc6db80d20a47087987f526f047bf94c997d1c1ac10da3a958509fbf08edcab71e3c2dc3d563da9dbf2c856ca896a73f908ceaeb
SSDEEP 768:jC+vAN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOQqcTroZy:jC+vA7E7JQWgQ+f4+u1japVcgE
TLSH
T1E6C2FA7B640DCB7F4F800ADDAC197E9B6DA802CB5698CD4047FED41C02C6BEE52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2e04a3b8-4ce5-4f71-83f0-035b67ec5ea6\index-dir\the-real-index
Size 72B
SHA256 cd7e90776c8255d5d87dec39a4bdcfda8b0b52f0adf202dfe3101165a8b2e5c5
MD5 ef8b6f5385ca0c17c8e49bd98a686e17
SHA1 8c587e71ec88b4b33e3f0e6f55f8155353ef814e
SHA512 68ad629db3a546ba92900cb7daa1aa08249ca4f976c0bfe9966523031eeccde3951674c3e0d753599336804816ace5f522a62b07551d60eb7644eeaf0c0087fd
TLSH
T111A002D80B810055C1021AB427A607D76B50DE2A0741270B41E2004AEC797464E6530C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\60850e47-4468-4a11-90f8-d54d776accb4\index-dir\the-real-index
Size 72B
SHA256 f12e0be1d59f5bbadcb48da349617cef74e1bcccd8caa673c14c7258e3b73ac7
MD5 dd61631890892e0d1b415f1afb60096c
SHA1 4cc6b86f2c243d188d3de0bea93da869f1d94356
SHA512 fe42b79e4c06e721bd2f37ffecefdf343f36192831d436de17d3667f7b589c5d67e78455c3713275b32e433ce1b33c1ccfe0d49a3ad4a8e17092156163928691
TLSH
T150A0026461550292DC2007B05951C158271AED1209514347609048D9CC551DD5A11040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c45185de-afc4-4384-a56c-169c50c12187\index-dir\the-real-index
Size 3KB
SHA256 92100988ae5dd19a0004c1e40eac4d7f8eef4535b1006b8a4e3609cdf7dc8faa
MD5 9c064db37b0908f7d7bc308da7f0efd8
SHA1 3861ee03278291902ca87b93311de8e3a8f1611e
SHA512 fe9dc5231aa7ac83b65a21597e75a8a76b5ea76e18ae09d088abfcc53a17b615c2da720446a64a640ca5c32f783877aa84b522249bcd7da41fea77f737343216
TLSH
T13551958FCD8A0E9AE9AD21B358FB048033B554DD47588A076EDCA674BCC336F2C18A55
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c45185de-afc4-4384-a56c-169c50c12187\index-dir\the-real-index
Size 312B
SHA256 9dbef3602f387d6cd344136aa9e7656a2a4f6e5d3a8ca959f3be5949cc54abc2
MD5 12b51bac382c811eebb6d0ab23762d9c
SHA1 6426bc50956bc05e07b478d5208364b707e614a7
SHA512 73c0083fc0ff4d55973b572ad972d6d82a98fb1ed25a4febf1335260aa38d0af97ad55e58e50f67d1b2379ea2ec0567c313d61c7bf235b7a1731feecb0748f55
TLSH
T158E0978EACA25827C33A387A05B3201D333B05FD3101AF2B20BE002E8A56B6C9E49305
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59230f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c45185de-afc4-4384-a56c-169c50c12187\index-dir\the-real-index~RFe59230f.TMP
Size 312B
SHA256 89c18b572b52a6963f37006ccc6724c6b269331c6705db6770ae4be709ea1731
MD5 c631e864252715201057410a398b2956
SHA1 a24bd14262b19d838a6922ac52659149e48207ab
SHA512 6a522b0a7842a0f869f974e5adaff237bdadf0e126604ed1dbb9d4403d22cc9a35867d24168008c64956de8523cea1fb55bd6d6c970d093134a4b4f63641c1f9
TLSH
T123E097CF60906C22CB2A68393003910A337F0C202111EA2A20BA081F043169C894220A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ccf8adad-25ca-40ff-a36b-90336f545286\index-dir\the-real-index
Size 72B
SHA256 02d5385a70659ac277f3187677d0da57386ea4e628303b7fb3419ee87d884f9c
MD5 2d6c0398a4f4e3ee9658be3f1972a9d1
SHA1 02e6558db870fa664753138ddf7840dbbd685457
SHA512 b0445943df667ab292baf690b2259878ec4e998d2c0a965e6e41519a99b3f79ed6909933123bc8b7e29ec73d4a90a802b6d7f40b1ddb5e61d3e3fd7dd3c2b3ab
TLSH
T11CA002A9924857D1F2043770189B5545273E7E502949830740ED40448CA41999DF3459
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5fa3cb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ccf8adad-25ca-40ff-a36b-90336f545286\index-dir\the-real-index~RFe5fa3cb.TMP
Size 48B
SHA256 be0a394a3ec0444e899b71784f068599653d9c15a943ebda0dbc596db8a2e4a2
MD5 cd45133843c023d04f282e599ed7820e
SHA1 a73b0ef258bd6a9799d9564a4378c4a06b33521c
SHA512 4e0d2e02aa092fc2f4c20c514dd762078626ed6077ccf560283e34315dbd4efd053d7d3bfb3791eea09334badc16ee1fba9a1b3854cf76b7585849a787b469a7
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 cbb23b8c2b3713a5948321e26cf4fd5bb5981d8f7871c49f5cbfa88fa62db72b
MD5 6d0f9d9562ae2a4216458f9fe6a91c8a
SHA1 bf5ff76fd61ce8153a740ce633bd8db52e421bd9
SHA512 d03aeea32a7b264dc1df321cadb64ddacadab625327b3f4cdf4873232667e1ae17b6b2750f7a3dfb2ef102b07fa89e4018c4ef98ca1059f4323f6e6698cee1da
TLSH
T197F027BB7EF71C30FDABD6D6247104A50149BC58C909EC4F1016B29354F121A356ECB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 807dcb4bc171061be8acb98301ded2f5b7aef6418d500233580008226e5e88aa
MD5 9afd2e0f1c8060e75dc668a8fda4d036
SHA1 89478b54d70cc5b06d8b3b4a2a81be10ec21ba69
SHA512 bee8c2ce93a161f059731bdc1fef477f74e68f6cc19023dc1103b8bc3f32a16471ae579a8d50eb041a78691d6e87996bf501d7a5f87d3015d6e27ae83fc66010
TLSH
T170E068FB39E31C30FE6B97E6207104A801857848D905EC4F101AB2C310F1256349ACA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 0ca3ec7c224d2eb751f05f3fded877c3c988df162f25c71533bb2f6ae4a939c9
MD5 a119f841997205c02d04aba587a152bb
SHA1 a2a0ae1c062cddd3b3ee70e0185b9c5523131ad3
SHA512 47bb68cdd364e6c399aaa4d4d575f5cf73ccf29dc66ab8bc69bfdce3b93ba00169c462b0cb9fe17dea383b2a03da308db7726bd42bf706958249b69fc61be7bd
TLSH
T119F027BB7EF71C30FDABD7D6247104B50146B958C908AC5F101AB29354F121A34AEC72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0def656324e4602fa390f351339756e02758dfe05750c5d52b90b17138ff509e
MD5 bdfc60618b8c5c34076b5ba356d35837
SHA1 95298a6ae7860fbe0fd448b26fee0ddeeb60c602
SHA512 896b246df5e6ab21f94057701fb5ca2da8a0c9b743bff1377bf002316c0492aa952c9350a7c3af8f80061e75d8f831323a9d8904ae3fb6d5bf57aa570351c4fa
TLSH
T176E068FB3DB71C30EEAB97D6207104A801817844CA04AC4F101AB2C310F12563456CA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 68439482a064c7984db4a3b42ec6af3947b79ace2d81829cd2789e0f0ebbc9a2
MD5 b5c40fe4a6e9fd5141347a2b85bf741a
SHA1 2ad24dc3c078a38d45bc28078378cec45f106b01
SHA512 f6620182c6434eb428accdba9b26f664e1b9a734a274a0e7e22ecdc66254391e3473f1d02361b01c531f46d8bc223dd8da395e2cc45324d284d5ae2a8cc75d48
TLSH
T1D2E068FB39A71C30FE6B97D2207214A801817844CA04EC4F101AB2C310F12563456CA2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 667d8d20a409b46b99b7335814c51cbc71231ce15c4bb3e3d371eaa916229195
MD5 aafb26e191b5a05f68c2fb973f8b03ea
SHA1 ce2787d9b39c69bacc13a50254403a130288d29d
SHA512 b1f020a2872c2e54436521e55067eded8ba10ce9e69609a946fb6c933d3c412de89f72fc13f19f5bf1b8e8a8af81ff1491a396282dec60137c257ec69425b071
TLSH
T1A3E0262405CAC27E701560C34A24830CC3ECB41FD2C83D4A6F00CC8462C3505F29F280
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ece286e1828a25032a1a7e84236df1f96a7a9f86fbbc504567e1f6eddcc0baa8
MD5 0167137982d3f67677e881d6812cdc86
SHA1 69d69da591dedfc50a63139f1177a0793085e66d
SHA512 aa3bab24b18ccfc37d0d8c5cef4128894c76b8fe7f81920bb207cc1e3774d6ac8ffa9dc216456c179f240fa63ea53c1e8154b6ec3d923e4274d2b61e5ce464a2
TLSH
T1A5A002A0898D9449C4600A7014FD5690336048D911A613256ED9989C8F91B44B2C2212
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bb9c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5bb9c7.TMP
Size 48B
SHA256 d0fe9e25107e632ecea6b57410b8f516efd1fb4aca27a9ae4461e0b2a46603cd
MD5 7c15de8444629a723a16af381c5a7d85
SHA1 af8f88a5369cecd5e5d57ee813b67ec04384f074
SHA512 d54e5e729a7d76a7b6c427901913d72dea16841859ae4bd36ee4fde25ea8c80ed19b446785d27534415ffd7f445ce94f1a1888ae36e5c2f314cbd38b72848690
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 244B
SHA256 16cdfc5a8856b9513ef280b4f1c743f45036ac868848035a628a1af678b9918a
MD5 3316c64b8b0f3510aa2bd3d8a9963868
SHA1 56265c10e60af34451eef2214170c322ffa3b86a
SHA512 1551a1a122c1ce8941c1403d37665d7aa14e8a6429704978ce506f285c3be5fb3797b0143910c575e005de544ea3d8362b2061e87e95afd2aa73d5fdcd7ae569
TLSH
T143D0A791B74413A3DC872435124847805F5494034114D447CA4F975C5E025814F81A9E
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 38b23bd2f793716cf890dd320069389a44fc1e6dd1541333283a4401143c6156
MD5 dedf1466ceecf46d1b01c10ff0887ecd
SHA1 682ee6e7e0946fbba6a36623a8690ffc8b4f7683
SHA512 63bb2bc698f23a60f27cd05d0b4b5f76f0b451b6aea3a9a7348526084bd351ca5cfc1aed7423afdcda01b9055b1d956ca3bd8188fffc7d706410fb38817a5aa1
TLSH
T1B7E0DF3416C9C62F7245B0CB9228E30C82BAB40BE6D879566B089884A347240B28F380
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 0f0fc4771612a5b23360552f0758bc5a874116ecdae20c627b41b8c803adfe70
MD5 bf26d0ec5166c6a3a81475e3503463e3
SHA1 21e2a3dac18af947545379d6dd75c464dfb2f0ac
SHA512 c309db9cbc0e29d45036dc0a4d03113d0c5395a721bdabce4503b246fff1be09601be71b4acc015539ea6ea97ec500c9785bc146179ee3505bbee0765113bd7d
TLSH
T16BE0867045D9C37D5524B0C39668971D86F8BC0F97D87A8A970C4484A642185B7AF680
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3463702ad8e0454fad0f9c656eb3d20faf6e7a844142a87e9a32ed468574e8da
MD5 ebed5cf51895a2a125eeb31d97837815
SHA1 f78b86e8e5680230e02c65e9320d0ee7881436da
SHA512 4eaf55b102c0da41f65d74f0780cd27829423ba15705320b9c501ce0f738d21be660f1440a36bc12584231365bef443c82be9e4d5349f7722090562c5ac648d7
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOC+IK/aAiMAKJ2B:CbEBVj5JAdSp9/EgTK7j6dJOvlTq
TLSH
T115912A40B0FA22003C3F7D1CC075896BA986B0673416B56B7FAC84660F67E46ADFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1234dc6-a199-4a42-80fd-6343622e8e13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b1234dc6-a199-4a42-80fd-6343622e8e13.tmp
Size 414B
SHA256 390fca5bbd86bc3dc8b11e25109da39d810e554efd1b9d3f56123a21621714ed
MD5 d4c51aec4d1a8f0d33f4eac28bc8c6be
SHA1 79d7b9bf6e74ea8d0694b79ef12cc25c8fb479c3
SHA512 f6986683bed0ccbc6bdd34ef79b2b0a71e10c6c14aa87ba22de87a8742c3fa51b62ba5ae3ebd13c86995ca1714352d26b9a47f31569687b3c3a5565a91d0b786
TLSH
T1F7E02BE5CB72EC3715FD0B1990500606EB4413666AC1850F7A3D921C8FF17774A85C6C
MD5 SHA1 SHA512 TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0764.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0764.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 53ccd5b15029d0c4870b7a997938aed2b8d2797db25de1e5bb64c415d282b130
MD5 bb93d01895996b541ada2266018fb9b6
SHA1 26f5c3f3310b380abdfab99e56c263ffae7e48fa
SHA512 7178c92cbd0a15a13837569709d50dd468b5bed6a373221cac14da0917f29bc85fe07ecb66676df4a49ed56ad1515413de5b4476b9e24238fbaf6f34ea52dfb5
SSDEEP 3:MsEllllkEthXllkl2zEolRd+/:/M/xT02zDRY
TLSH
T11B4404457FC00D15CF041035C431D3714770F45F1F11574334D104335CC55400D00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6966a5066e0f0a878c944755be788207ca02d768c9d19cd9a68eb410c5b47eb7
MD5 24ebdc497c5ff9a24af9a32e1ea83fc8
SHA1 e0cbb8caa719c426c5bf5d28274c46eac6e8e1df
SHA512 4c72c426b238ef27d0d33dc127f4bcb56c9fb61b619e155614c20bd8812fd4df579f2e6db60e8737cbb7e9a5909443a5b53ee3240aea5270ba96c9de32a58d58
SSDEEP 768:Lc3ta9mg5uQWp8+p3bd66j+4BRv86aLIWSftJT:Lc3taBA8+p3Z6n4yAftJT
TLSH
T1F7F2AF71ECA9DC735CF9D344B2467B83AFB450A399C05E94E8DDAB1D005729E2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 ba545810bf5bb2f3ab81223d1ddea48e8b90801fce8832992e2730fc5cf96b06
MD5 d3550ca93a0248fee1129e6c89e1eb52
SHA1 2c01c80e5842550bcc26e08a3956fc91f5009dcf
SHA512 e12a86c86a14f7a04674ce05515451b37595b3ad23c3f3d4ac3552212048e72665c2660f48abf053580dbd03707372f5fae6452dbe26405720ba45fc9f86245b
SSDEEP 768:jc3maEmg5uQWp8+p3bd66j+4BRv86aLIWSftJT:jc3maeA8+p3Z6n4yAftJT
TLSH
T186F2AF71ECA9DC735CF9D344B2467B83AFB450A399C05E94E8DDAB1D004729E2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 27e31e295d8a1a6e82213f89341dccc4418cf7c95f746f8cc85aee65d6e0d30f
MD5 b16866cf415030490c7787e44f681695
SHA1 0066359594677c71385e38d437864d528782c3ab
SHA512 28abdcb65c09863a82cef0d90b7000f3b19b6ad92280922c4771650dffc5d0ca0b5afc8cb52c128d2e07829a674178da0288a65b0fbf5dd57cfea0add19f426c
SSDEEP 768:fFo7dwgsdpmA9hWnh4TnIlWNEkdZ9r9t5i:q7odJWnEqB+n9t5i
TLSH
T1F3037FF99CD3887AD8ADAB47533C6D169ABCC137B0A49894F7851B0CCC625BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 830dc15a2ca2efd9fb0a135c053e15d180aee541fd2312ed06f3a52f5125f40f
MD5 c4c67c9b2529254d1bfa21eee76dab52
SHA1 7f5b310b4319dc17923af4a565e0178c77c2447e
SHA512 d3b6b7b32963ab9fc43c677567808970f980176231937914078dddec2e4efc2cee7b14f6db561b94aec80210f887252cf7758d32af2f05550eda4c3c91c81549
SSDEEP 768:rF4sC3+wgocTmU4uyp8+p3bd66j+4BRv86aLIWSVP9rjftJT:C13bcs8+p3Z6n4yk3jftJT
TLSH
T18233C2F99CD3893AC8AEA747633D6D569ABCC173B5A48894F7841B0CCC6217FE706811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 20d9bebf7a85bd96dfa1abf7983495835d7dbfa80569fbd5207e2b0f773dbf58
MD5 1db2b04a87f396f158447a5726b870ec
SHA1 a1bc1275a67473a85332e40a028615635ebec7bb
SHA512 c7d764c29db5d45331e9b39e96eb224f4339d5c10745ce56fab7dd728619c925c2203d2c231b763c3b5abfa5352170647b4a8a732edceed382ee5c56e539198e
SSDEEP 768:rFQb3dwgoaom34uOp8+p3bd66j+4BRv86aLIWSftJT:+b3May8+p3Z6n4yAftJT
TLSH
T17E1329F198D78976D8AD8783A37D6E429EBCD0A375849894F7C86E1CCC421BFD706821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 6c6f1a1f1468aaf0aaa7432ea719d902a75914ffd932257d529159ec349642b8
MD5 eb4fa5a2095e06faabd987930a379a2d
SHA1 f0702173e5ef946ce1b6e2d03ebdd80f7bbbb5d9
SHA512 a23682209585b77aa15ed8860071323a8ac3e9162bd6fe4fc25dd0cb7cc6bd308806afefbb3c56d1bddd81422491888cbc54306a20759bcd9dbec5391fd52229
SSDEEP 768:CF4sC3xwgoc8m2nhy7Ls4kp8+p3bd66j+4BRv86aLIFdh9rqt5i:D134c1u8+p3Z6n4yA/qt5i
TLSH
T108233AF99CD7897AD8ADA743633D6D025EBCC163B5A49894F7C81A0CCC621BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cde044d0dbef978c8bca862e65d82dc92ae47f41fcc954a81e0386b6c51dcb4e
MD5 d339a6c3f9f3a7aededcd598580ef6b6
SHA1 40a3ead8367779829265a0efe7d9ee4b6b6df018
SHA512 7427a17d7aafaabb48574d0b10a32e3b7d5c3a6c84067c23a56a46a3bd80489ec844a696cc64dcac2611f3441badd4d361018d571a9907257652c71c16d3aba3
SSDEEP 768:fFxtdwgsu5mt19Wnh4TnIlWNEkBk9rut5i:DtouQWnEqBCEut5i
TLSH
T18003D5F99CD3887AD8ADA747633D6D169ABCC127B0A49894F7C41E0CCC625BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 f573f5c00213b82ee4a6b5c6f76f2ae3150c79ef33f7611dc2d9c9e8b0f1d7fe
MD5 da828906ead719aad0344f7602bdc27c
SHA1 44a68222e3fb4b4eb453a35f11826ae723114ce2
SHA512 4102259de6310343c95df8bc19e3f99559b3687a84faadf2da0a37dc5931f03854715ff9b3de0506fe5d4397a47fd2c5065244b01aa4d1fab311ddf98176a0c2
SSDEEP 768:Vrv+4UNbdD3tacmg5uQgp8+p3bd66j+4BRv86aLIWSft2:Vbsbp3taW+8+p3Z6n4yAft2
TLSH
T10003BF71F8A9DD739CF6D244B2467B837FB810A359C10EA8E8D96B5D014B19E370B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 579c0994aec8244edd4574e1e1cb74dad82f0d554f1ca0997a24ccfdd09c9e2f
MD5 13158b1de2987467567124071c93cc33
SHA1 bb4ba1783cd90b0e11c1f017e235075f14f23974
SHA512 e4845f76bcc90a7eab5b53c2cc1be18486721adbae5d755b13877037f6b8957e6e5f8be19a1a8e5cb57989aca5f0761b3ec9fab9f88ac3c250af7bdbd9c771ee
SSDEEP 768:fFHsC3UwgVH5mOjWnh4TnIlWNEkBk9rut5i:R13gHPWnEqBCEut5i
TLSH
T14403D4F99CD3887AD8ADA747633D6D169ABCC127B0A49894F7C41E0CCC625BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3567ff4857e019c7c6c9ee85b345a4bd4875d6cd8347fb071839f455eb0cb75a
MD5 84b17d9857ad95f84acffa4967d259d1
SHA1 3472bbd35837a617bf9bcd98595a6a1e3caddbe3
SHA512 31ef4192440bbad0ed7879fc57566e8864dc94a990ac88f550f33d271b6b1b4e990c7010b75083cee356d45e34ca1834e135f9c8c490106f317c7408b5025f9d
SSDEEP 768:Irv+4UNbdD3Pc5VNp8+p3bd66j+4BRv86aLIiA2bwCl1:Ibsbp3CL8+p3Z6n4yC0ww
TLSH
T13003BE73E8A899739CF6C648B24677437FF851A396C10AC0E4DD2B4E419A19E630BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 1add2a38f409fa697c4f5560b8f09dcbf4cda616cbc583aa5f4c1de247d214cd
MD5 fed733e9ef4c0895641ecb86328d603a
SHA1 8b02c19755c6cb7100604f452a86052556c155be
SHA512 e839677ceb4d89e1d4d024045eb6fb14b8162ef5d60978f1cdcdcb879521da0bc5e7bd53ecc06380fe78619d69300f7a8720fc8861d2de0f9b3e3ca3cc57995d
SSDEEP 384:nEiF6ZcIsC38NH8TUNTUlIleTZhn+BvBm2AtfojAzdon9rGv13qJ8/7IzGoJ:fF4sC3UwgocjmOABk9rGt5i
TLSH
T113E2A4F99CD3897AD8AE6787533C6D169ABCC067B4A49894F7C41E0CCC621BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0779b79d1205b965a95aa26759543ae2079f1d15451baa452fa877026215cefe
MD5 08e71a22283ef58fa30afb3ee9473315
SHA1 eb61cd21b21c9b37c4c39c52469e832257957afc
SHA512 9a8b0885b22891fefb7ade2aeca090dc3e87a5b1608ca25b3cfc11fb7d04c42095c7e10a00bf9e451cec8915a5451fe8c7648bd822bd6d95ca8647ed63b7a57d
SSDEEP 768:Irv+4UNbdD3Wn5uQNp8+p3bd66j+4BRv86aLITS2bwCl1:Ibsbp32L8+p3Z6n4yL0ww
TLSH
T1E303BF72E4A99D739CF6C644B18677837FB811E399C10ED4E4D96B4E005A29E370B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 24a38824f1bbbb2623327a5a1197bff465304c354c8ede3eb53ebd6af6460d24
MD5 cbf74394f9c0fff119c1ca322bf36481
SHA1 5416c6a1f9c4bf52b8d9b71f3a9fee3f3c4159e2
SHA512 e0d10bd3fb5ae58713212b22ddae2c67d38caeea6e8acfbb075a0b69654c2f50ca0af847e3f1126b076cc86d826f9e0892e6b19f9c5b4f5f179551dac20df5cc
SSDEEP 768:JFo7EwgsdYmA9ZWnh4TnIlWNEb/R9rqt5i:A7/deWnEqBrPqt5i
TLSH
T1BF03D5F998D3887BD8ADAB47533D6D169ABCC127B0A49894F7C41E0CCC625BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 8eaa042bbd67fb2f65f9120d6cb77be752016da72c8d6f81dc77bf404d15a4b6
MD5 a3638534495182b3648e660d80c12d8c
SHA1 fcb48ccb15b8f798432bdb17d6d806c4176989a7
SHA512 1ed9a0b2b0d74bd2c3177e746b6bbfd55c11b1937c4fbbf240a53c1dde6ae8bb021ed3fb4d5d0c13f57ba1c4bc5ef4f65b4b791283dfe83d27a47b2e1e5d9914
SSDEEP 24:TLej0afDdWec9sJVUO11HnIcofhhvM0sxbe1jy:TUDbg34U8Hnhof7M0s9eVy
TLSH
T1B992EF62B9302427E5AE0B75F8534CA00DFD12EF4E67741099A00D915962FC67B955FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 be5d48e4089001685dc47e479db7c77f128566d94832ee18b9e3fe5eaa816e55
MD5 201f550bc0f696ba776b390758a5edb7
SHA1 23807bedf9e43d05aab07a52c4a657b533d11d88
SHA512 6c080f7cc62bb8bf7e1a4a501873c0d5dd7562dcc5e1636319d4a526a47c685fdd99705ad956c3ecbbeb52ded2771b9fdc12c49c70b13363046dda400e6d1d7b
TLSH
T1EEE00203AB00105DC13892305043527913D1C45041B1074795100155EC415000F23DD1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ad2d63e2e00a6da8eaf092a590ee24690838c0f875f6d57d4b44936447e49893
MD5 34e65dcf71c4d08b94eb360d6b41518d
SHA1 acdc21fab23e697c9a44cdfca8d355fe38e43455
SHA512 41b36ec70acab7ffdf07ff263fe1d19700ee32814729fb4e9d9f7b8094c2e7aa6a82f910d036617bb5d0b6abeb4341eaf179bc6771f0093c4c74d5fe5025baee
TLSH
T17BE00203EB00111DC138D2305083527913D1C45141B3074B95200155F8465200F23DD1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 30ff07ea7157faa5f069ddf03ccaf8fc485d718d1a2c603ea8a5f008e5cd74e2
MD5 0b4fe96d3b3f0521b39784f50dde7965
SHA1 e451b6fafe07a7abcf77ca0be4416fa17062bc01
SHA512 c6e9ad6f4dd6419b327d968f435b824089300545dfedb4feb4b5c7af090cbc13d30a54027be725b00b6ef1673d1ece3c43738c4f54c3485b9bb854dafe50a9b7
TLSH
T1FBE00102EB00256DC178D230509B576A63E6C46262F3078B9511016ABD066201F32DC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 30e004efb08a2e42dd69e0198f5fa232011ef6326faa83eebc9159d5c4595b69
MD5 fbe67e8ebb49d259f2d1dc07eed9e36a
SHA1 8f4d7d40d7932ba5419728907cd478007cf899df
SHA512 dc4c87dd2fad44a753ea8f7485e5ada74acb8216274d37d0789a8326fec83078b53d2b3eacab00f6eb0160777e7a9a593e4c7389a5d6cfced0aa0a2cd923540e
TLSH
T102E00102EB10257EC17CD33050AB5B7A67F6C46262F3178B9621016ABE167102F31EC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e884e77d4a7c0dadf9c38a10ee40a1d35fe2b7bba27d1e3b5f9e4439daa78677
MD5 ed5af54f6e25c4c67e00e2959f4ca8ec
SHA1 9e2a75b604639fca4fd6df0a70693f7f87ee9756
SHA512 07180840674eb81e9e636cb0096c7e96fd276761d8a83cd4f04d630fd5e07491560de363cb3cfad0da33d7cb510fce8c53e9abe7c98e66b93981f3a8ea189bf1
TLSH
T11CE00203EB01112DC17CD2305047537A13E2C89251F3078B95210155FD055201F33CC5
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3a0db2d77bb4c13e90455b106a2d0b145ee8cbc2ef87127a3cfd69d848c39055
MD5 743b754bb9ab4f5cbd1c6789b9f4e84b
SHA1 29a4e50d017ba7a611a805b7990701523cc95db2
SHA512 8531ca4a880c48beed242aabf80865b0d14526822a7ec2dc12d549f9dad1a5e90cac8d4d3ace1433aa638f91555c9fe41d98e9d2a9297f93a302d15a7aa6bc55
TLSH
T1B7E09243D70010BDC03C9230009B1B3967F2C06102F317C74220002A7D222002F31CC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 682abf65b683db62a71d8cf9c60db779a8de24ddbd012099c9223d104f40a7ce
MD5 00cf6fa1f05e648d0ffce5303a8690ec
SHA1 fc859036bfc5cfd0cba10d501be79361b703c353
SHA512 7ff1351d052cdf4734cdb9f9114184149289d06649fdef0868f38e6965c2a217d5e1364a1d54b776063217b375c1868f5ca1817fb20cb9cbfa0d453f90782bc9
TLSH
T1C1E04843D70011BDC03C923000971B396BB2C0A102E317864220002A7D222102F31CC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59913a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59913a.TMP
Size 392B
SHA256 75eba04b202a8777220aca3220f3f7a423a36cc721ef4dc1e236d73af6bd13c9
MD5 51d38adeb105650f0b59c4f50c77989b
SHA1 7722345b2535383fc4a3f028c84a8123207defaf
SHA512 d7fdc134a6117db34dc9d324297339a3feefd2f4fc26dc251f22a11a30627c8619d37533faa10451361c4dde275518292c5a02d5310035502c868c4dfcbcb5ae
TLSH
T198E00403F700104CC13413304003137D13D1C45051700747D4100155FC015000F135C1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 c7e1bfb4c38d0ffb38a50150f0af4566f2879c6ecbb1fa722173fdcfe90a6efe
MD5 9a88af3c22411134fb205a7fd57cb86a
SHA1 694ced0d7fab93c9b264c369040354d0d7bb3627
SHA512 0388d3182305c197dff4708ac1958f4b049ea8c91e8048bc490a35d2831feea0b525dea56e6d9e4e435c8f04aa1ce1029904dd000296c32c49e9568746eaa80b
SSDEEP 3:MsEllllkEthXllkl2zEol0mw+It:/M/xT02zD0eI
TLSH
T1F34404057FC00405CF045034D431C3704770D4550D11DF4334D144775CC55404C01404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d852b37597a07a56b80d051ddd197073631d6b0d2568856ea7baa2f19bbdfa12
MD5 218929c0305966ae1fae9814f063b35d
SHA1 89c55b390870ab8ae7529ff930547d301b43ff87
SHA512 5ae1017f9612b55b22932663e95ecba1b550e99956a4f7e97e1216255c6b3d71d972a47a7c79aa65f61fdc4156b9709e5028cf235332b0b4eac867bd72831b5c
TLSH
T1B41112E11C7A1AC7C5BD0EAFA4833AFD50D8A215F4E830341898ED54962D41D255187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 023daec32620a8e734213f7177d77464a9685b900b7a341da87c2b155c680fb5
MD5 2ac60688ee6c8f9ba65ecef4dffe0e3d
SHA1 ec6434be873a359da8f6d6355d30bd7715e2c9cf
SHA512 4ed94be9ad76469db36fc45d75ad55c4bf8512652a8e4fa9f897ba7fa0ca7de4d29f96b3f2a34dec57d57a3b6c54ae88a5ac6057a6f6faed3b04a0c22d4dec4d
TLSH
T1A32120A1183E19C2C5BD0DAFB0972AFC50EC9211F8A834382898E8A4966E51D359087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 966a7ad63e514ae1146010e4c23a80bc2a3c1bcc4334e15457160eeaabfdd977
MD5 0de75cc64337f4fa8057967e0fd42c73
SHA1 5e614eccd8cb40caf18b22683dfefe5511fc96fd
SHA512 c12a52ed55d0601e7f9bce3ef475173c4786712b3a00dec853fc25106d0753123f82363974151af0e2ed463703e088d13729a92fb85d21dadcbe1e6a7dda1531
TLSH
T16C0110E10C7A1AC7CABD0EAEA0832BEC14D46526B5DC347418DCE460817841D349182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 6e2d89d356ce4dfdd12719ec4251c4573686bd8dacbe6c7ae3ce885efc8d87e7
MD5 2eef3cb8a3f241e02b65e2dcf7e6f7ea
SHA1 e26c099a126d5467130e2ca14b9494abbea353b8
SHA512 0787b98d39bdce2f8242883be09ac326156c834331770cb271c59b02fd0c06c8096f73b021b57fa56555d578e6acfee6ea77c599d53eec1e0c32e01115e3408a
TLSH
T1403120E1487D1AD2C4BD0DBFB09739FC54E8D221F9A834382898E9A85A6E51E355083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 55e365aca725e38415545a99cc8818076700c73007de958203396e83a2f8e045
MD5 b97506f0f9374eaab27b685fc0139c50
SHA1 0a3cdf622604da8117b93b38be0fa9f23db983c0
SHA512 615c7bc6a56a6f327b4a64eacabfaa8891460217e66fd3e4e90da78b04085a34410ebcc4b36d5a3454c74ec53dd7befd4aed666a411e27969051a24e19113ca9
TLSH
T1902111A1183E1AC6C5BD0DEFB0973AFD50D89221F8E834382898ED64963D52D359087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 d04725eb3aefa64acc17ff2c46617ee06b0c24b54b59e75f9c3c4943efc97f7c
MD5 d09d013cff390008f01ef5c50c0a28d4
SHA1 4902580f2168d4c45a0e74133e4f54cc651ec905
SHA512 60a73f5750f2964083e1661521e7472fe768311e3f395f83489c05a55d52c429a1fe11633f176fca36af399c73544dfee8a23754183775523e654471e8f12ee8
TLSH
T14CF0D4D14C3F16C7C9AD0E7E64071BFC54D45616B4DC383404CDE5D5907A42F319542E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 4798637edd24a84c193bde8fb00369f7cfd99df412fceb49a7e54ddcbf6840a7
MD5 45f36c95f67dea416e2d491caa802a08
SHA1 11e2701225193283456b1a8f4773517c31e8e262
SHA512 bc380da8086016c64b5587b211e958bb25906fdddd67d5a9e8f012f09607a80f80ca1dd04d3a0c0592ad6aa3e9f7990eddaca1251d972cd6bba7c3746e5ad12c
TLSH
T1FE0141D10C7F1AC7CABE0EAF60873AFD54D8A626F5AC30381CD8E964817842D345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 2d4949769ea41d19d6eb7af48b5ae31d7b2c23328e589cba4f9d510a658a104d
MD5 e42e4d80710ce4f98d2cb6e9d7a022a6
SHA1 308b6329c4569018ae0a0163e0940a306a4b1e37
SHA512 b0e40e04ea80249a1c3575c74b0006f9de2da1fbe6cc8734d87e76d36514845f499ca550d072a15d3fde27ab936fbeca9dfdba2b123eb6b079450985274c0414
TLSH
T19F1144E10C7E1AC7C9BE0EAFA4833EFD50D8A725F5E8303818D8E954527851E345186F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 02d602fd2dfad9816c252143be696b7465e8082b7741ca32f5c60bebdd8e0ebd
MD5 f121ad46599ee024f379e37a3fe59d26
SHA1 7c80eb2497908e450b87f640764b590264406b24
SHA512 523e564e41301cc9b5fd2cf8cd5055a9be2eaca6158ec20b348c47645c321c168b3d8b3a70a554cbe221754a445b0a67d9c66c6a3094684ecf27d6b130897cb4
TLSH
T1393110E1587D1AD2C4BD0DAFB19739FC94E89211F8A434392894EDA84A6A51D354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 a06aa42731ed666d809f098540e5448cf7e4e235b7f4cee91d5c2b7e6a4ec77b
MD5 2f975a1be4b203ccab9ca50974b9f996
SHA1 dd55029300ea897721935fb19087f4b7a5fe522e
SHA512 bc64a30960310487745ce3b9bd43458d6f423ed82e01f81da5d2299ce975d509dac7766b06d3d81a3542518a8a320998b6456ccb0add68ef0333d550e6f62c31
TLSH
T1ADF0A2D10C3A1B87C96D0EAEA0471BFC54D59516B1D8347418DDE4A5857982E349141E
MD5 SHA1 SHA512 TLSH

Submit Download

8c791782-9809-4eaa-85b2-6c6dcbd62e43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8c791782-9809-4eaa-85b2-6c6dcbd62e43.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe594329.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe594329.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

4b41485d-0464-42fe-b41e-081370d4ba4a.tmp

Path C:\Users\Admin\AppData\Local\Temp\4b41485d-0464-42fe-b41e-081370d4ba4a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

IwqZq7jAr2Yz.bat

Path C:\Users\Admin\AppData\Local\Temp\IwqZq7jAr2Yz.bat
Size 207B
SHA256 d3c3123e0fcec800b7108248b48009ec7ae611c115ae86b5ad3d29a96c3ff73b
MD5 934825df0c72510215c3599542818c1e
SHA1 904c03b0988600b3c18c718ab69e525f1379dcfe
SHA512 825774ee074c4c29beee40e8fc1983897175eabf62e8f2b2d5ac5396cb992b297eaff106cb5e25f6dab36f34819d8545e98d73c282cc7f7646bd99dfb46b900b
TLSH
T1B3D022111780CA1E590008571BB1A2CDF0AE04EA2F0DBDA385008CDC038789CB5AB182
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5880_1981293622\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Quasar.v1.4.1.zip.crdownload

Path C:\Users\Admin\Downloads\Quasar.v1.4.1.zip.crdownload
Size 3.3MB
SHA256 4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62
MD5 13aa4bf4f5ed1ac503c69470b1ede5c1
SHA1 c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00
SHA512 767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d
SSDEEP 49152:lYLmNgMh/9yUsRFeWMyYISDSwtfxZQNemi57PdHmeFINp/lFnsDbNFNepL6DJo+J:mL9U1yUUQykOQ91XFYBlR8P9d5uNJo9
TLSH
T1FBF5334F81B0539ED88719B29C051C5BFCA6BBA1D53A7A27ACCC9D0CC7170A657BE84C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Default.xml

Path C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Profiles\Default.xml
Size 506B
SHA256 04d78b32047755c7bbaf006ce9e2d5943e50e2c622323a81b310dca4f61a8f28
MD5 16f89e26e480c1050033b62968e70364
SHA1 d1f992d763333cbcb8627f8d45b7324eaef042a5
SHA512 832578edccf13f8e68a2abaaf2201afe32c42ba8508736a7d32b3b14e77dcae16fa0c2d8c13f6a2ef90770c678fb4e5b2d251fa95cf8aee2e491b425eeec650d
TLSH
T1AEF0E2F6BDC4757B26B00328FA52DA512C41DAE4860D5D94F2CB81CB2B0484B626F2F7
MD5 SHA1 SHA512 TLSH

Submit Download

Default.xml

Path C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Profiles\Default.xml
Size 1KB
SHA256 1b3c8cfb86ec0172db3279d8fcb7ac52baf54ec229350e1c76010d248d5167f8
MD5 095d051943d3808c67ec79ac99b06e02
SHA1 42fa7a222fbb64118919cd2c3da0ec91bb2bbd4d
SHA512 6f6705937e14883fc62428f838734eaf925e2bf39b464a5207ca10bbb6a9a7a723d1a86ce35f6a4e65c6c86bf5750050cf781f53b52c44516980ce2bbe7f32f5
TLSH
T16B119EBABCC9B1A670F10324BA519B412D40DFED810A4C99F6C693CF665040D637B1FB
MD5 SHA1 SHA512 TLSH

Submit Download

quasar.p12

Path C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12
Size 4KB
SHA256 405ab16152a6a9495b204bfd9dd416c96657144773ff96583541f0e460e8c8b1
MD5 4b1d839f0dc2d3a9286b84fe0c107162
SHA1 edc3a02a585771ac17fb5bf83955c950f0dbcd49
SHA512 346e15618b8ea2faa365187daf1d7b40d3436d668830c12c7808a769a92cc780f430212a7787f491599ab6cab2bd64020a458238ebce13bfc64f85e5fec6b27c
SSDEEP 96:+wiX+j7Vs2SiecTiXHOwCurbGzHri/gSPSm0oKNw4Y8MtSNEa:+d8+YTiXP3SK5OY8XT
TLSH
T1D4916B5F70BA00CD27F7D825F386304DAC8AFF2AA5D5680B353951C55D21D22AE80B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1612465866\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4156_696348575\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2976-3727-0x0000000000F40000-0x0000000001264000-memory.dmp

Download

memory/3460-2519-0x000002301E670000-0x000002301E6C0000-memory.dmp

Download

memory/3460-1950-0x0000023002AF0000-0x0000023002B06000-memory.dmp

Download

memory/3460-1949-0x0000023002510000-0x0000023002648000-memory.dmp

Download

memory/3460-2520-0x000002301E780000-0x000002301E832000-memory.dmp

Download

memory/3460-2521-0x000002301E6C0000-0x000002301E70C000-memory.dmp

Download

memory/3460-1951-0x0000023020860000-0x0000023020B8E000-memory.dmp

Download

memory/3460-2739-0x00000230247E0000-0x00000230247FA000-memory.dmp

Download

memory/3460-2738-0x0000023024890000-0x00000230248EE000-memory.dmp

Download

memory/3460-2518-0x000002301E420000-0x000002301E438000-memory.dmp

Download