b630d8a764e028da3e2186de4cf7e99240d93d5aeb18df114017b20583016628

Analysis

user interaction
yes
max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/11/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quasar Loader.exe
Size 8.6MB
Sample261111-aaa7kscf84
SHA256 b630d8a764e028da3e2186de4cf7e99240d93d5aeb18df114017b20583016628
MD5 b5f165ba63d00a0b902bde7ab06490f2
SHA1 24a92af0bda47332614040b47c1eb8d87a885e06
SHA512 d9a4698a82108f4ab4c8ec006b01ed62071a22cfc3b564d268c157e4306f93eb81fa24c4267d23cf52829ad9b8a14bc4748de96a37531d9c4f69e74b4a9619e4
SSDEEP 196608:Dhcd3wL9HsIXEpXnH2ph1iut1/1QpL0uQg+REtK7voKgpVFS8:DhAE91XEAphVtrQSg+REK7vFgtS
TLSH
T18E9633ACB3E419FAF8B3843D9E91D541E3B274512F62D2EB03B049151E3B6E14E74BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4568	QuasarTool.exe
872	QuasarTool.exe

Loads dropped DLL 11 IoCs

pid	Process
2824	Quasar Loader.exe
2824	Quasar Loader.exe
2824	Quasar Loader.exe
2824	Quasar Loader.exe
2824	Quasar Loader.exe
2824	Quasar Loader.exe
2824	Quasar Loader.exe
872	QuasarTool.exe
872	QuasarTool.exe
872	QuasarTool.exe
872	QuasarTool.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_985409022\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_1847392611\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_985409022\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_1612_52818313\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_985409022\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1612_55491279\_locales\et\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4520	cmd.exe
4772	cmd.exe
5736	cmd.exe
3504	cmd.exe
4132	cmd.exe
2112	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1340	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{F9957AD1-5A5D-4BFC-8917-9B35635D09B1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2824	Quasar Loader.exe
2824	Quasar Loader.exe
2920	msedge.exe
2920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4316	7zG.exe
Token: 35	4316	7zG.exe
Token: SeSecurityPrivilege	4316	7zG.exe
Token: SeSecurityPrivilege	4316	7zG.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
4316	7zG.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe
2752	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 2824	4592	Quasar Loader.exe	85
PID 2824 wrote to memory of 2112	2824	Quasar Loader.exe	86
PID 2824 wrote to memory of 4772	2824	Quasar Loader.exe	87
PID 4772 wrote to memory of 4876	4772	cmd.exe	88
PID 2824 wrote to memory of 4520	2824	Quasar Loader.exe	89
PID 2824 wrote to memory of 5736	2824	Quasar Loader.exe	98
PID 2824 wrote to memory of 1612	2824	Quasar Loader.exe	100
PID 1612 wrote to memory of 2404	1612	msedge.exe	101
PID 1612 wrote to memory of 1340	1612	msedge.exe	102
PID 1612 wrote to memory of 1580	1612	msedge.exe	103
PID 1612 wrote to memory of 1580	1612	msedge.exe	103
PID 1612 wrote to memory of 1580	1612	msedge.exe	103
PID 1612 wrote to memory of 6004	1612	msedge.exe	104
PID 1612 wrote to memory of 6004	1612	msedge.exe	104
PID 1612 wrote to memory of 2804	1612	msedge.exe	106
PID 1612 wrote to memory of 2804	1612	msedge.exe	106
PID 1612 wrote to memory of 2804	1612	msedge.exe	106
PID 1612 wrote to memory of 1708	1612	msedge.exe	107
PID 1612 wrote to memory of 1708	1612	msedge.exe	107
PID 1612 wrote to memory of 1708	1612	msedge.exe	107
PID 1612 wrote to memory of 5156	1612	msedge.exe	111
PID 1612 wrote to memory of 5156	1612	msedge.exe	111
PID 1612 wrote to memory of 1616	1612	msedge.exe	112
PID 1612 wrote to memory of 1616	1612	msedge.exe	112
PID 1612 wrote to memory of 4196	1612	msedge.exe	113
PID 1612 wrote to memory of 3520	1612	msedge.exe	114
PID 1612 wrote to memory of 3520	1612	msedge.exe	114
PID 1612 wrote to memory of 3520	1612	msedge.exe	114
PID 1612 wrote to memory of 4196	1612	msedge.exe	113
PID 1612 wrote to memory of 5352	1612	msedge.exe	116
PID 1612 wrote to memory of 4128	1612	msedge.exe	117
PID 1612 wrote to memory of 5180	1612	msedge.exe	127
PID 1612 wrote to memory of 1164	1612	msedge.exe	128
PID 1612 wrote to memory of 5504	1612	msedge.exe	129
PID 1612 wrote to memory of 5108	1612	msedge.exe	130
PID 1612 wrote to memory of 5108	1612	msedge.exe	130
PID 1612 wrote to memory of 4908	1612	msedge.exe	131
PID 1612 wrote to memory of 4908	1612	msedge.exe	131
PID 2824 wrote to memory of 3504	2824	Quasar Loader.exe	132
PID 2824 wrote to memory of 4132	2824	Quasar Loader.exe	133
PID 2824 wrote to memory of 5192	2824	Quasar Loader.exe	134
PID 1612 wrote to memory of 4340	1612	msedge.exe	135
PID 1612 wrote to memory of 4340	1612	msedge.exe	135
PID 1612 wrote to memory of 4340	1612	msedge.exe	135
PID 1612 wrote to memory of 3260	1612	msedge.exe	136
PID 1612 wrote to memory of 3260	1612	msedge.exe	136
PID 1612 wrote to memory of 3260	1612	msedge.exe	136
PID 1612 wrote to memory of 4320	1612	msedge.exe	137
PID 1612 wrote to memory of 5148	1612	msedge.exe	138
PID 1612 wrote to memory of 5148	1612	msedge.exe	138
PID 1612 wrote to memory of 5148	1612	msedge.exe	138
PID 1612 wrote to memory of 6136	1612	msedge.exe	139
PID 1612 wrote to memory of 6136	1612	msedge.exe	139
PID 1612 wrote to memory of 1660	1612	msedge.exe	140
PID 1612 wrote to memory of 1660	1612	msedge.exe	140
PID 1612 wrote to memory of 1660	1612	msedge.exe	140
PID 1612 wrote to memory of 3820	1612	msedge.exe	141
PID 1612 wrote to memory of 3820	1612	msedge.exe	141
PID 1612 wrote to memory of 1088	1612	msedge.exe	145
PID 1612 wrote to memory of 1088	1612	msedge.exe	145
PID 1612 wrote to memory of 1088	1612	msedge.exe	145
PID 1612 wrote to memory of 5100	1612	msedge.exe	147
PID 1612 wrote to memory of 5100	1612	msedge.exe	147
PID 1612 wrote to memory of 5100	1612	msedge.exe	147

C:\Users\Admin\AppData\Local\Temp\Quasar Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Quasar Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\Quasar Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Quasar Loader.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    - Executes a command shell one-liner
    PID:2112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mode con: cols=40 lines=18
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Windows\system32\mode.com
      mode con: cols=40 lines=18
      4⤵
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/quasartool/QuasarToolTUI/releases/download/QuasarTool/QuasarTool.rar
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2e8,0x7ff833b7c188,0x7ff833b7c194,0x7ff833b7c1a0
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,15306801119997833409,4350325488805943137,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
      4⤵
      System Time Discovery
      PID:1340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,16092479276019105100,15134214131108284675,262144 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
      4⤵
      PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,11134014431240146559,7638574144284212484,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,11438162871902059405,3327759898496511147,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,11554610809235321246,18187202379240608281,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,12241340940866983102,6607777242500337002,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,15035879951485567190,14476977046031344859,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,3148985639102346928,1132801836433072672,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5472,i,11633719460763086989,16001847973798732781,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,3807481969522197628,11226433693670582083,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,3807481969522197628,11226433693670582083,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9962829397813639823,16432025383570869805,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2820,i,3082549082324841066,7253984546284482845,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,17049289699952540493,18176440912611233569,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
      4⤵
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1552,i,16916465098629653735,12714426645963378530,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:8
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,14784046794918932724,16625135382776020330,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:8
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,13666963880166747131,3047789959860226684,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5220,i,7937389492715461441,2359509615295334820,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5820,i,5636956026931326251,14225986770916879664,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,17021896065117347670,309042445652999562,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5124,i,5442438909701139066,12645198910835138291,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,10769469413311755346,16103748043912156962,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5584,i,2840388620844163084,3843636365283229645,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,12813808449036448368,12424332878812132843,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3544,i,14117381406233734155,13881038711943930418,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6468,i,5768007747497092718,261230905959025718,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7268,i,2040925092312620365,5833990048156846096,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:1
      4⤵
      PID:2112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7272,i,4670617063839598429,9572198418406165215,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:8
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7396,i,5360660837446919361,16259645075887524473,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:1
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7476,i,9555689545349577811,13138548722030794061,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=1236 /prefetch:1
      4⤵
      PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7780,i,6655602475697199757,13252085953745720546,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:1
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7776,i,1899284787922453630,2424347428276406317,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7616,i,2039387752703166774,6021782511507839198,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7656,i,8403182552123149636,9691677576247269581,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:1
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7912,i,13739553528382591020,2371891820367089698,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:8
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7472,i,9186625435219145116,1036580474286932971,2097152 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:1
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6860,i,17712290701185155936,5097810377218297362,262144 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,10159992252543567886,18072259203811099302,524288 --field-trial-handle=2276,i,2180155781682182289,5128961472922665553,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
      4⤵
      PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/quasartool/QuasarToolGUI/releases/download/QuasarTool/QuasarTool.rar
    3⤵
    PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1408

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2752

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\QuasarTool\" -ad -an -ai#7zMap23317:82:7zEvent25534
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4316

C:\Users\Admin\Downloads\QuasarTool\QuasarTool\QuasarTool.exe
"C:\Users\Admin\Downloads\QuasarTool\QuasarTool\QuasarTool.exe"
1⤵
- Executes dropped EXE
PID:4568
- C:\Users\Admin\Downloads\QuasarTool\QuasarTool\QuasarTool.exe
  C:\Users\Admin\Downloads\QuasarTool\QuasarTool\QuasarTool.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1612_1847392611\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1612_1847392611\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1612_1985902941\crl-set
Size 13KB
SHA256 b85327be29f5d0a5be4a47da5bf5062f5115bda5e9827db40ac4776d829ccd18
MD5 5111ab39b220749a299b5bb7cd25c730
SHA1 970c9013ee629ded1b5d2a058cd147950c3544ab
SHA512 37caae776f5d9365367e12a6ca13e07761f09b3cf6d1f9ea9523af89e6f2579afdd148d3942822358a49ac597a544c30bdf070aee051d69d8a0adab6f6af708a
SSDEEP 384:oeYPnEDMU2kk0yu7uCnglcJUoCzL4pv2W9cBTgE:ojPEoMk67R1UoCwV2W0cE
TLSH
T16152AF4FDDC4A62AF03911AE982262A412794A8552554B731B6C3A64BCFB28D4E38C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1612_985409022\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

deny_etld1_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1612_985409022\deny_etld1_domains.list
Size 7KB
SHA256 5eab4d72f62e203553df43d7ae2e130716309a8baf9f17315d100fd6e40ae1e4
MD5 fed3ebc587d2984b3a26c093070c6b13
SHA1 05525f884ba816770d971147ac2311f928a8a177
SHA512 1210e8f872db31dcbe0295944916c047d8f552edb4afb854d20af2b5c70b9bb62d76db0b4bacc3ab4773ac4d752b282cc8f93a19eea13b86c36f7d6bc7c9673f
SSDEEP 192:WMUs5HICESAF/UW3H/XohJe/W5iSLAUygbpw:ysdmzuEHP2TAUy9
TLSH
T1C5E1AE389C0EA410B58A5C6DE05847F296CAAB3A25E14C51CD4D4D3A031C2A7DA6CACF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_full_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1612_985409022\deny_full_domains.list
Size 12KB
SHA256 19e871f69e774c847717469957dd18f342712e702d2c54c5efb8542907bcbabd
MD5 85a2a44606d0d937cb7c3cb97549d1dc
SHA1 27081c556bfa37eef2ac2b0bfafecf90dfa8662d
SHA512 3f564a6b0b71ff54e3cf0e7addd91fb63a2e0d477cacaf73409fcd4c29cfa2076e76d0ca0e330c4fd0fba6cdaec8f118401bb2ce0f83af9e334cd603adb61d24
SSDEEP 192:3zjGRPX/DE6OGcrMHNK17dYuybxV3SOZTAnbtIBzkJkW9ELtW74zPJ1vRbmZM0ED:PAPYmhKh8RvOkWYtW74zBI1F71WqEgOR
TLSH
T16D42D04EF5E8A884C70E0AE50B8C759EDE0A514087A22BD53FB57B5F6988CB9FB11601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11621690-8fda-4518-9e60-79da25841da4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\11621690-8fda-4518-9e60-79da25841da4.tmp
Size 25KB
SHA256 3479ea2d0f73ce0db7f8efb5a37bc18953857669139b9a09951e24a72fa5571e
MD5 9bf7239d66e2153a92697f991243f7ad
SHA1 099042b015a054fe40c9d4c562f525299822f246
SHA512 93367b8ffe411bd0cd072f815e7a89350f3e07fefaa880ec9e3ea746d8daf59c59d01fd5ba79a71247501f9c27d23a20b8ea9bc1e649454c041dfc600e2c9861
SSDEEP 384:n9iFiZcIk3sN18TUNTUlI4XFF5mg+DhMK2fLBVR8+cnsIrugL/7Iz7oI:0FQk3Qwg5th4BVR2sIrY7
TLSH
T1F6C23932D864DABBECFB8F99B74A7A17DEE01163859C8AC4D9D85E1D00D369D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18731c25-307b-47d4-b05b-2d60c0b4cdea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\18731c25-307b-47d4-b05b-2d60c0b4cdea.tmp
Size 392B
SHA256 a3f6d84b81e2681670f0aa8101e947b634c9920f6214191b6384f87e4e10c4ac
MD5 3f130c2f5d4b896bd09958fcac778c28
SHA1 e9fccd467140a4b0c690dc10f6d6cc50839169d4
SHA512 1086ee3e94f59d52d9e677629838bf4a917c64140d116c8621855ed0f2f52dbf1776b768f133b45f251e3c866f0d513742489fa6864dcadf5863739352463105
MD5 SHA1 SHA512

Submit Download

28a35e33-dedd-42cf-a8d8-96b4d58a6385.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\28a35e33-dedd-42cf-a8d8-96b4d58a6385.tmp
Size 392B
SHA256 bd36d7220094d13066fadaaf4faa1d5bf5bd3f2e7ec5a3745012940348e9cfe2
MD5 567494ae5b9549ac647acf55a467d60a
SHA1 7753617108d35311ed4e99275f34f3d7df3c82fb
SHA512 b5addca744bbb83f29594451c50887a2031cc1f1fc5fb8bd676fe022647900f69d4379a4d9c41618c9b18a66447c8c6ff11d80916180238c9bb94847c0cf23fd
TLSH
T1F9E00207930041BBC16C033040D35B3227D6C12001F6034B0D1006581C536005F70FC4
MD5 SHA1 SHA512 TLSH

Submit Download

90cd0af5-8fee-4b9f-acbb-8e06b70d0918.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\90cd0af5-8fee-4b9f-acbb-8e06b70d0918.tmp
Size 26KB
SHA256 d9c82c1e11abc11b14aec3e34a773d5bcbcf8cbb01bdbbc198d111cd228cd54c
MD5 4155ee27a7feba19b8f38e2433ee844e
SHA1 9bdd4c29bc9312030f740599a6e8688a91f428b7
SHA512 14b5d4c887e1cf7169705d2c9950a6e8a3617831dcbacf48f305d968e7b34379efeb7483f88b55183e55f35cad2730be2d462b6186c2743640110979fa6464c4
SSDEEP 384:nXiFiZcI63sNh8TUNTUlIm25mgn8NpK2fLBVR8+cnrIrsa+VY9gL/7IzIop:SFQ63gwgSbN5BVR2rIrhgfC
TLSH
T142C23A36EC94DABBECFB8F95B74A7A17DEE01263819C99C4DAD45D1D008369D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2026.10.20\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

0f6c6099-3099-487a-89c0-e84f0c4038a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0f6c6099-3099-487a-89c0-e84f0c4038a1.tmp
Size 414B
SHA256 c24139ea51a136c1ebdb81819a136938a21bc24e18b09f48c892f149e23b5d45
MD5 892daa74b0343fc656de6f2256bfc436
SHA1 d310752c3fdb85f6ac659252ca8d252b12c7a826
SHA512 3909b047d6ac990116bd58e1be6c1db766737cbd4a4385a92d04d2f0fa9a9effe5ce0b5fbc26fb8aa92cd14be6050df0f605f9a0e9d9c2712a55c1dcb745a17d
TLSH
T11BE02BE9C815AC3B08FC1728505456C5FA4113472A81888F373C800D8FF1636468686C
MD5 SHA1 SHA512 TLSH

Submit Download

1b2257ab-d893-4bf1-8952-61e6fb925a1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b2257ab-d893-4bf1-8952-61e6fb925a1e.tmp
Size 12KB
SHA256 1251277e06ced865c095e1cc1a00546cb9e051c7e224367f6214e5d048365ed4
MD5 5c7c8847e3b5af34e328566e34cc63ed
SHA1 a2e9121e7ba59a8c814ef15bb483ac4d5c05ad93
SHA512 4e91beb4a703d338e7ebac3fbde05508bb4304731e59c83a984de658725e86d410b59d81a4800f300b65cdfa8b893a8d4b76a45b0ab4d395a17614fd76698c1c
SSDEEP 192:sxZ7R9mG/frsIQZZNINkBzodpLHW6+WNGYbIZxUYzTIgj/J:sxZ7OG/frsIOZN3qLHbGFQYPjB
TLSH
T12242D815AE28693B9CC7D219FB55BF53D7F9603390941E48AAFC8A1C04EBADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

482d1db3-5575-458d-b714-65a3a66da441.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\482d1db3-5575-458d-b714-65a3a66da441.tmp
Size 12KB
SHA256 3941387ce7ba12dc40903f50640984ec60e0f0dc41efb9e6274df21e95bfa529
MD5 bdaa9a2eb77ae6d78289a8de97a055c2
SHA1 278c47d22c89c92f209c5109ebadb83d552ae7cb
SHA512 f8ff5b85f79816271ff54b486c5e6cd02bf5f29513178ca5ad5ad5126713fbbdf371bb58f11853848d2c339e8d3954ec3d15099d6fb72fa31e831025161ae2cf
SSDEEP 192:sxZ7R9mG/frshQZZNINkBzodpLHW6+WNGYbIklUYzTIg5RSNEJ:sxZ7OG/frshOZN3qLHbGFjYPeNI
TLSH
T1F142D815AE28693B9CC7D219FA55BF53D3FD603350941E88AAFC8A1C05EBADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

754c14c6-5f70-403f-b10d-afdca85a5686.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\754c14c6-5f70-403f-b10d-afdca85a5686.tmp
Size 12KB
SHA256 9534d2cab126ec19b4ebd551b06864059b24cbf31826a7da22209d04e85cb12f
MD5 44f2b84f283f4f292d4c6991bd56ed24
SHA1 bc7b70676ddb54a6cc660192d83547d93d5e3d9e
SHA512 0105b1a2f5f9a1e0b31034c604a64a2cc362e50b8a30c388ff751f48d78fa6571524d75c58c2ed67e4b2d1c49fdad25aa63415d55058f2a7101e42adf94db64a
SSDEEP 192:sxZ7R9mG/frseQZZNINkBzodpLHW6+WNGYbIZlUYzTIg5f/J:sxZ7OG/frseOZN3qLHbGFkYPBB
TLSH
T12F42D715AE28693B9CC7D219FA55BF53D7FD603390941E88A6FC8A1C04EBADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80f3fd10-57b0-48ea-a924-9483799a5786.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\80f3fd10-57b0-48ea-a924-9483799a5786.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d
Size 120KB
SHA256 ad58ca73f2b8f132ed15ee724e1731cbd7510af65eea7ef3c93e5ac2a5ca3541
MD5 7e2cf6f35e336618dcedac5730c99c6c
SHA1 3233e5cb89aaccf454652e61ab18672211f9c828
SHA512 ef54e061a31a472968702739f08552eb9eeed7b712affabdb8f4fc66c3a285d6f92bc9701c984d23738e1877332b06c58c690c3c4666d7ef19ddd538a6c57420
SSDEEP 3072:sQboBWR4jxw4c570csihKUJs+iOYmoIDT4LPd2ZeYNscm:9oBWi2570csjUK+iOYmr3yY3m
TLSH
T13CC312FB58A89632F2AA0AB4355A73515DA3762F034C4BC597B130D16AD2E80D2B6F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 24KB
SHA256 7e170ea7f2ac873c595b9f72cf35b8c15af17b5bfd3488b101bb5aca034d07cf
MD5 85cec2f36640165630285fcfde07831a
SHA1 680a959b7128688ec8201e5af72ab129474f7b4d
SHA512 74167696ce9516f43be0bc2a75524910e3193ae47ff75ffc339c33eb68594c09873099966a22701ec66978b5e7cfc372e257065387c0619860acfaab0da53170
SSDEEP 768:n/FWnQ1G+lImP9UJSz5TeKFMI6Nc+n820:qQ13IuSJSzFeKtU820
TLSH
T1F0B2E1346D581B27F1D251B57AE48EE8E1A31A05B4521E653F8E02002EC13EFE2E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 102KB
SHA256 b3872b22bbd31a251930d167d0a58d2e7caa8f81e6d9dcd636b01ac4f2ac8982
MD5 226c9c614d3cb21262ce545da7f7fdd5
SHA1 b9d89307d468aa84d23a67b94549e02a657c379c
SHA512 e6dc257f0a0ac0c9c33836729d79300bd6290edb6cef9864240aa6c7aa468e48b2be1aac0dfb466b21df5515689f125cd06516a50966292d3ea03226de771cba
SSDEEP 3072:67SvKCy+OUdKhsh2Yx/A5g/cEaqUBgCkRd:SSvKoO8KhepiEyZ6Rd
TLSH
T12AA31298BD47B9EE2402744D30211265B207D92F1DBC05F24EF790D61AA9956EAFFC2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
Size 256KB
SHA256 89e71afa48e23a9204680907c2d02a2688d4c484c167da0d1ef7f2273bbcff92
MD5 996bb68476d231e6eb0b41137231ad56
SHA1 b7b3e514028f8d1645d76864a29f8f6605a8b8a6
SHA512 f4dd4b23fc91d9fb2fb2b34b9e55af79c4b4503a3d81c8e329b350a24cd53d0953bf6909784b2bb4b20ba13319de05ffea824fe335f748d892d48015c4472438
SSDEEP 6144:aXL5VqTN0F/beT+ti1F0RBf171FSUalPrl5zdd:aXLGTWyTMA0ryNxd
TLSH
T1EB4423C6E8E7DD2DD631E9AF39023D02FB899DE6D8818F62D6D0A519D700E5F4091A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
Size 20KB
SHA256 fab436a127c29499e0ddbe96f33c5547b050fd49092ceaf6bad0dc1e04b36935
MD5 64d0df3dbc368144bc339f4b10141fe2
SHA1 8071f9d63f207f838ffe5521afaaa7406bf7a3b6
SHA512 4df86d13bb0d38cd3934d46b6ebb2b657c75146281524c1e94797e3aaf11c6ec05b95d19bba4cf8e5771b17774bc29bf73c44949a9980c1e09f21703754dfbcf
SSDEEP 384:501QE3bbzD7K6FGrRmOGEuKIbZb91uMqy11sPV2gERykhv2BRiWi9hrwc45BztKt:8QE3XzPrUR5GdZI3yqV2gERlvORzYMcN
TLSH
T16F92D0672DA34B6B0821302AFF816B65AA2D23419D37975775F4F5E8C8028F21A39B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
Size 16KB
SHA256 337e833eeec5d082813ced903aa54622827f234f3dede039ff9214db457f1fd5
MD5 791aad127c501fa802bad7abfaa10c89
SHA1 6618a6123fd22e3662783402d1a4c49b26805a7a
SHA512 9b8f62e7a98e8d20b8b274c0f7cc06704717573e155c512cd2e3ae8bc0ba70fb8ed954663793c1319b2d1cdb18cc5da49aae6ea964b406b716795fd2006cfdbc
SSDEEP 384:CMGpcjgv7iP40u0b9DCTxP+OS/lkxUx3jBSsP0B6kp9P:C/pcUv7iPZdRkexzcscV9P
TLSH
T1B272C0B2499CF9581C2BF95A5A5F1ACF551CB087091C52E380264CE87E43D02F5B6EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
Size 36KB
SHA256 daee2012cf5e38a54053ea9bb33e687e6a7fbf1199f6681ef2180fcabacbae97
MD5 cb7a34ac7ceff3a8b7db2a7f6f3d0dcb
SHA1 d443b1e502203af3a284c2f3522cc58303ef7641
SHA512 ea974f26061d62eb6d9a0d4ec21bf31529e44af8794f5d5f403c618c6b061eed3fb8416addeb1aaf641027bd8daa73c89f30865fae4b3977936bd4b87dd66e7a
SSDEEP 768:3tI9ZSixT8lI1JibnWYt+Q6eUIHEXhUPWUR26COqR3MOh1u+r8RBzms96:3inS0aWY4peUIHERCR2JOqhNhg+rN
TLSH
T148F2F1B92D28510FB8CFF4B6D398C4C069BBC53307257A5CE6E6B847DAB464440BC3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 128KB
SHA256 76a74eddc7f828166be99760f097a56b17960f577127a033fa85e78b56a16da3
MD5 71f142aa6e2a23a21d32e796b6ab1d90
SHA1 dff8d3feff43b9bb8c7f99fe9d9e41da63e5aff1
SHA512 67cef24e889f3bbe839c6ea7f5af44de19fb0eb398ede4e850abb6623364b6f4abeeaed03d80a062088f81f512d68eeed647241fd09078ddc1c9f5cad597a21f
SSDEEP 3072:ugJx9micwvbdWNXH5OMhM9dn8PvPBcUj:uyx9mygNXH5zYcBcU
TLSH
T14ED35A78F7C3EB92C7132ABD503D3EB30B7142C162D1091348936E616469F75966BA3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 61KB
SHA256 300ab06fa3ab93bf62406e4c6f56950cbfe38716910a90e8d68a05daad52c6e2
MD5 7088bba2c986ecea3ad754d835666d1c
SHA1 065b000a0f370c39295cd8d064d7fa5a495933f1
SHA512 29ecda82668f039ae1306caff44fab2442a0e965a8b962998e72f4e96f2cac8d0eb6c74e63d436c6e34682e1ee9ea481b319057d182a1f7c2f0f38a4e7ac4c67
SSDEEP 1536:ec8R0HWk8YHa/32tRok58aKuTHYkmmRECDpaXtPp:1g/2tRjKuTxmoXDwtPp
TLSH
T1D2530270744C44AE843D07711BE11455AF9B602EFA03FCA94D7BB4BD94B5CA25BB60E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 68KB
SHA256 2033d4c0dcdab8b765e78c9c1845742d2589b0f1c56a06b701e91f536035f85c
MD5 047bb9fd0930eca58ce326cdca8634c0
SHA1 b9fa0a8cc2fe5e274bb20d28ba8581139949cec1
SHA512 c4e022dcfd4e98313189200eba4b545a65163a7365107d082085b4c49a2f57402fc1480c95984acbfbaef179dbdcc11895dc7fea875d3783a7c5d2a99743b07d
SSDEEP 1536:7WiFK/+t3/ZhLVxdengIiVyWT2tiuwqVMfNidV/yd2db:7MMZhLVxQnqVyWTVfNid5pdb
TLSH
T1C8630262AF4CAB7E25CC41839FD2A335D0E8DD19481B407C36549BCFBA549712B39E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 75KB
SHA256 f0b2216568bb538a00ee14c13ad49ea15b1653044a219a698889610edcf9bf05
MD5 13b147a683af38608f9c22ee9d66a832
SHA1 f9291cd3a214674a186f4be85cdc655a6b3a31fa
SHA512 1c4deb1cf689906dd026c6fe7383cfac8f1beabac05dc65309a35f60cb70ebed45d265351b8b6d35382c5136815e0809772a48e242608e309becb9b7078cab17
SSDEEP 768:986uWt+5MaZ+sefChTFh7g58k0D5ChKt/w976PZM+dfWXNWfGh22m9oCcQhS9Chx:W6uWy/fW8k0kcPySW9mFbiIZ
TLSH
T18773D89CB2D3F02143D3F175842F2506F2BA6965608EC451F239D9D6BC9894AE237BF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 45KB
SHA256 44c44c5e9cca81e4e3a8b88e6c45ef531d9ec84d198955739a4e3ca82e76f0f3
MD5 afc7d5b0c3d21def3418a9fc43858f83
SHA1 bf9c629cc33dd8475f36005870ea625624acc7b0
SHA512 04cd55b52af530e7c411b4cddb385a34304cdcaeb84b8b2e9e912f7089a125c61cb52b7966707d9fe74c986034fa6f53b1626eb0caf1f163d6ec9044462fb3f2
SSDEEP 768:zAr5A78yAtyYOzjMPHwIVoveCDn4mSE1NNJi8AlLaTmPXrnr/WPY165c3KfHJqma:8FAZAjOzjMoOy5T13Ji8EaSPjrcMgfW
TLSH
T16123E1975618B5E2D5A97B351AC3718F5F9BC0D884EB22CA258B604BE0D0CF791860EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 40KB
SHA256 d4665d5756df16476c773faeb19d336c996fee26eb4d501016576473723d94dd
MD5 fd226e165c889f04fee8e4b8433ece5e
SHA1 9cad7e5f64779b531067273080b05548528a28f3
SHA512 f49f761f278fef6c91cdeda75dbeea836fc14e980d037c57528a34cfe9fedcdfdcffa59009567c57247ca3100a30d810bcb4c3e5209c7e79f610b9565cbe737f
SSDEEP 768:oflqFFAFb3Tpbt9+A25zSHDSVYn0L9A269BccLQPvLgq23Lg5jWaQ:oYAFXpb+ASSHpG9At9BccE3B23L8CaQ
TLSH
T1C813F27053B2C15FB7DE9966E6DDA9B88E5F4943D4C0FEFB08A48BC2253A3608458463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 a3223794a0624a755c5a4f634a3c967c1036e603f50b2f6b0a6b108eb607a065
MD5 8a04c6ad7b27631e8745dc4244e48d04
SHA1 a6ac8229b0e388841656ea11c0b3d312eff1304d
SHA512 fc3f340f90b3fbe7c60cf6c0658aa48d54cea51eef7300561232a37b83d7ea8e2b7c94370c08c11bdf71ef22e19917134017ee756c1b56522de41fbe82f3a07a
SSDEEP 96:+6BACbreMvJOUUHe6goXLnST9ctp2amMJZZBxMqvh:8PsIUU+Jo7STytkavvh
TLSH
T1D2D16184469D2068FF5950B4D2D239927678A8F23CB33F0301D0F87A959B7CBAC1B676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf8e0b50-81e0-478f-b290-682337e776bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cf8e0b50-81e0-478f-b290-682337e776bc.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

1e981180-f524-429b-a13c-0f7468e8e909.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1e981180-f524-429b-a13c-0f7468e8e909.tmp
Size 210B
SHA256 53325fc21c6a02ea79367317169a0ea25c2750681e35a4fda4bc4c3067261f62
MD5 1c03b422c7c9f12530ea89b17aecf89c
SHA1 33704e4b5b7b6878543f16f0c5c6d21b24a320db
SHA512 cce000bf90370b1da6a8229dcde3ef401f1d42fa67b6e560196b98317797e1d8379a68ab38bd9cc694a2ea33ba6c692810ec3bb9174e205ed00a679e6e344abf
TLSH
T143D022732241F271822C3AB55029BC8BC3A30028088BD1E418D8F64CADBAC2F050B0C8
MD5 SHA1 SHA512 TLSH

Submit Download

8c8cfa60-7874-4bbd-986a-e4c1fe3251bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8c8cfa60-7874-4bbd-986a-e4c1fe3251bb.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b6791fdd-1616-4b3b-9f5b-13a2577637f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b6791fdd-1616-4b3b-9f5b-13a2577637f9.tmp
Size 5KB
SHA256 891a83c411e3d69a081e3dd1e7e68274e51776383da46f76872c467bc7997773
MD5 bb7826643135799313e8cc699cf6a25d
SHA1 f39fbbd93056378618a2c6c212bae2b854046604
SHA512 c60190611537a1b446e5f3cccf8c682fe03c41c4ba7c545364080e281add9a1b6270d96473aac9164ee3d8bfef094abbde9cadfb8ca368e6aed9bcfa6c68f6df
SSDEEP 96:D1yOd9e6xC8R/LazzmLamt0GO5AicEZzwKofG1Ak/Qx:D1x3NEkjazCLamt075AicszvofGek/Qx
TLSH
T188B1DDF7C3E5862DDA1196F0AA186F1FCE1C0455836C3D5A84E4AF1BA3F2471E181B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bcd23c7e-6f48-4328-99d2-133ddb3ea312.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bcd23c7e-6f48-4328-99d2-133ddb3ea312.tmp
Size 3KB
SHA256 b106d322244f7c6cad1e7d2858a8b68414bb431c05d8b2ac26a4a5162f6a1678
MD5 c50832a1c58f89b2d49e8e69f756f016
SHA1 178e1e45d0dfcdb176b36259c2d15b1875b48d8e
SHA512 53d0495d5a1d4b586d6b584094ae5fffede6e484b8e31bf9789fad8386e7c33c33284faa352a798af95124765cabfbd138dfcfe9d1cf14817224a5843b8b87f4
TLSH
T1C071DEF783B4856DDA0195F0AA186F1FCE2C0552436C7D9A85E46F1B93F2871E081B9F
MD5 SHA1 SHA512 TLSH

Submit Download

c0b6e223-8279-4ec5-9c11-e1818f990a89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c0b6e223-8279-4ec5-9c11-e1818f990a89.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0eb7f6d3e69700d9fa51e5a0917742f09cd5e15924a4c7371cc8ecc3cab34a03
MD5 0cb846cd55d9100a01e27643dc0405fc
SHA1 4f1baa8a81f90aa6962253676d686bcc6e9cbbdf
SHA512 ab87daf3192d36b535827281a3aaf66dcedfa0086ae200f2ee2cd40e0b1cbfe068037f3ac835d3051b54d778b093accf5e4af792b5326b61d2f618c4ea6be05e
SSDEEP 768:0RyktjU7pLuLbvnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBwLWLlMC7fnroX:0RyktjYEbvnWvDBltu1ja4wLWLywf0Lb
TLSH
T121E2EA3F780CCB7E4FC04E9DDD6A7E8B6DA802CB9598894047FA945C02C67EE511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b772edb7-cc08-438e-9075-14ed450bcf81\index-dir\temp-index
Size 2KB
SHA256 cbc338b758e397ec4b57a196f498a91131c750a62d02363efd5d2d2e9e553764
MD5 715b5b299dab7dd9e89860bfb14f7807
SHA1 d4e27d9c609457a8cc5e5504d959a8098bafe535
SHA512 265ab73ef5e472d72882e5dd40e148c90a03f43f275fec0e31f331513a08e7a572dc7f7ace5345066cb4e1a2c3eb45469ee0a4184df3b9fa32de14302ec4a9a2
TLSH
T19C5186CF9C4D69ACD55C15F639F90842337E1CED6E998C431AEE4334A4D30AD1D0A24D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b772edb7-cc08-438e-9075-14ed450bcf81\index-dir\the-real-index
Size 48B
SHA256 82e39a5ece0a0c668478defcdb3365e8eab6f6700d99847ae83e2a39112dd32d
MD5 efe4e8981b10dd09675f0aae555e73ce
SHA1 b3a3d826248c69fa7216921ec6f87d77aa74a8ef
SHA512 5b215abc9d5c757d63136be7af00e6176b2d1554ba121e2d10cf55c75e8106e13d07bc935b33d40099d43b60ffe96dd72cc3b5d92622b1b10899aaf616081e58
MD5 SHA1 SHA512

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 484B
SHA256 6079a8e6d742241ffcb9f305a503e0f399c4d61ef34245e45f7169c85f1be2bb
MD5 9413d7bc5c6973fe189a3c2295a4d631
SHA1 2c2f29ca063f9dcd10bae583a763329f40f2a69f
SHA512 e39ad9f05a953b7606367b32ac32046e440fc74bcca6ac6b6ebbbbdfe7ea2830743ea2f16badd8f90db36fe277bbdfb3c72f354f5bfb7db9d02977d4d22111d7
TLSH
T11FF02EB75DE71D24F95F53DA187160B84505BD58D485AD4F2417668340B13153909C25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 488B
SHA256 04f8e442672ca299a959258278cacb8381dd448c5175b0c8ae3d1107f2f99973
MD5 aaf131539fcbb9603734ba4512b90c80
SHA1 01694dcc630f8487bf727562432fc2eb94dee006
SHA512 f0203a13e655e09ab843577c9b81223441af890ccb47f03315840867cbfee046ea6748ceb367616f3bb95efd98a5f8815336fe8baefdfad970fbec5cce43ba60
TLSH
T1BFF097B7ADFB1C24F99F52C62830A0FC0409BC28C484AD8F2027BA8300B23083A09C25
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 e0c641ea8cae77d9ceb0bf4e137a7bfdd4b356f5c169175ba568ccecd2bc3d3e
MD5 c549ecc4921bfc99c14e8ac54f3a837d
SHA1 a83c302db1028f3713e3d020ea48ba5064f4dd69
SHA512 a9e7e0642923d0513c8164879720cc9584a2a250103c3e01ac5f8404f76fcecd94171a45491208f4c4f3f64dfbc37c801f9be87a5e53c72cfe1ba52322f4eb80
TLSH
T1DCA002E04146500FD64052F661530BF86259DE5487053322D0A00456E8B9141C307001
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 86f4caf1962d5cf05c0bf31793599a06567ea72f9b627356080a9640a16f88ff
MD5 4aef0cf0715363fab1d03774da9c9b0a
SHA1 b30c6619a70c87097dde42a62389d0822443b1af
SHA512 c15f6637a76cb4bca02661442de6fb22a7462aa5932cb50a88477b73ba76277cb3c48db82494d318fe2944fd3da3c3306f77318372f7f7e8bbd567dfe1f8505f
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 83ce62ba757d6f9832868bd94aa16097cb9bc46056a7f9a9bc74126bc1c05a8b
MD5 d94269068dd0b393239a235320eff4b5
SHA1 13070007aa5849812b92e05109e3da784bc9ad89
SHA512 074ef8addd85df0dd80b31311aab21523a118d59843f2018225f870efa55272e16dc62dbbe1a263a5680f37dffb020acd78b3f93a1931e6a57b0a3957b2e4f4f
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXsfFlDg:OtfFvpopPxrB4Rhfs9l8
TLSH
T1A9B2451571BA021038FE290C81B6972F464232B37159E63B7FBD44A69E6BF045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3f55278-03dc-4401-9873-449491d66354.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3f55278-03dc-4401-9873-449491d66354.tmp
Size 17KB
SHA256 c1d9a038edf30a03c2d1c08d563fd2a62e04c2cadd253ef34d545756d89665cb
MD5 b114c7dcd5e14a89e21d7eb1b918d91a
SHA1 6550ed74f6ed0dfe36ff7fa0f38f427a28d6742c
SHA512 cfffad573c6e77c97dc6ca70168beb550e30445f8e7bfd58e9cb02dd1e8e95cc0b9863d8cc7f3fcfa134385563f78edcc7a824782859f7fe48a493e1c49adc74
SSDEEP 384:sxZ7HmWG/frshOZNrDSLiQ3XIHbyOg/FYYPeNZfG:sjHmWG/fYgTHbypFYfe
TLSH
T1DC82F8169924993BCCCBD519EE35BF52E7FD10239C851E8CAAFCCA1C04EA5ED220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ad5f64b9fc56aba14d97c744cfd63ff5fb67fa2aa94a9a203a95812d65939c25
MD5 7c476bc0cddc09c28943f17a0c54cfe0
SHA1 2aa004644b075fa7bea9bef3247c0f7eca20de6c
SHA512 8143a10996103c18f4ac54c7490c2927731842921bd274edb97b457c8eba68a8307558886c45051c9fad11058625fc9ce17e07f9f355735fc617fbe5db81b404
MD5 SHA1 SHA512

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.159\manifest.json
Size 177B
SHA256 53147dd5510a91e0211cc4e693e3a41a321a1dfeec1a85a3a931f4f8e056186a
MD5 7f429d2422b099274165110352a894fc
SHA1 f1eaec6c13b9622db5583bc5f10b15fbbf0976c4
SHA512 24ad252e392eac7fd698df9574bbcd370fb400489de8fde6bab530ec7a0a2b620fe52ab3f97ddc93cb61b881161cac3949d5cc1e1ff5e427642debcc28e9173a
TLSH
T13FC012DFDC509DF115EB4722156D43C4D733CF4B1546451935F766082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

bce8464b-bd98-41bd-b6d4-a5b89f663cb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bce8464b-bd98-41bd-b6d4-a5b89f663cb7.tmp
Size 27KB
SHA256 c0c676c31e8d86c464dc6a05e7b8ec8fa524a94a61b7bd1bd0d2c75761058e9e
MD5 1b117474aff92ae3b8b7f2caf7834ef9
SHA1 d82814c61d70dc511a86664feb05eaa064af4e3e
SHA512 c92012c28bca6fea026da6a2916ec3b729903b82027b144b740e9e7f920300692054f78fb5d6ed5e1c99c75a4045cf44307be4319f19365446c30dc0fbedfbcc
SSDEEP 384:n3iFKQkUSv9sN18TUNTUlI4bFF5mg5DhMK2fLBVR8+cnDIrH7vBEj6gL/7Iz6IIn:yFy9Qwgl+h4BVR2DIrH75EjDLn
TLSH
T1B1C23936E894DABBDDFB8E95B30A7A57EEE05253859C4AC4D9D94D1C00C32CE134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1afefe0-87cd-4fac-9514-dd921b2fa620.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c1afefe0-87cd-4fac-9514-dd921b2fa620.tmp
Size 27KB
SHA256 892a773280ac9160d2097eb9fcf062510ffb748ba352570d68c698b17d0a3821
MD5 d85391f9ecdcddec56f65ef46414a810
SHA1 a446f34a2bdbfa0c495655c8d8c09ee46fd085e6
SHA512 2e0d9f37eb3e7ea490726699c552b5e55ee6fa9f43ffcc272a23cc9f3649b2b50af936837eea95ace035af8a858c53da6bd3d8f3a3b7ba17792ccbc094e15778
SSDEEP 384:nRiFgQkUSvwisN18TUNTUlI4bFFTemgqzDAd24+JfCpZrrVR8+cn6IrH7vBEj6gV:4FIVQwgaxAdK6rVR26IrH75EjDLn
TLSH
T159C23A35E884DEBBDDFB8E95B30A7A57DEE0621395998AC4D9D94D1C00C32CE1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a49b0c0-5c48-4721-a8f9-e19c447d984e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\3a49b0c0-5c48-4721-a8f9-e19c447d984e.tmp
Size 2KB
SHA256 a7174910a986d785b0917b3ac7ed131ad9cd0d5cad599ec940a985182a5d4d4c
MD5 fbe8355007d33af65f9e12d2b2b96e6f
SHA1 2aa4dc0857e5654f4c55ef66f71a47bcee2c2c0e
SHA512 3b6a9246dfefdf79977e6058ae590cebda3784ed7613c1e5c75f742f5353effaeb9077879e80a369c58f2c67e25fd232b53cf7e361abeab980618ab0cee1b343
TLSH
T1AC513FD04C385AE5D1BD0E7EB09B35ECD0EC9722B590383D7859E99C8A7E61D714483E
MD5 SHA1 SHA512 TLSH

Submit Download

831d6395-bb93-4812-ad9a-519d1d7c076c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\831d6395-bb93-4812-ad9a-519d1d7c076c.tmp
Size 2KB
SHA256 df06b43420873d9b7394888336b99d50614bdff1f84a79b45ce85cbae11c3a70
MD5 be820b11391e031c8a81936cf30b667a
SHA1 f96ce3dbf0e13a1cb1264efa1ed9e9c167e94045
SHA512 626acaccdebfee291b2ff50106b1d9be75e93593c17ff8f81ae58c5331b4eef22f45019c4d2439eb45eee16c1e713053a6c5ffd084a9ddf21c54c5f38c403009
TLSH
T192511EE05C386AD5D1BD0E7EB49B35EC90EC9721B4A0343D7898ED9C8A7A61E714083F
MD5 SHA1 SHA512 TLSH

Submit Download

cdba7fbf-25dd-409a-96be-0154c35625af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\cdba7fbf-25dd-409a-96be-0154c35625af.tmp
Size 2KB
SHA256 1e94ad32a8a67baa5b6c1fa98edbd0de53db43b9f5aa2bbe263fe16f9b1a7bf5
MD5 e733d15d7837cebfd49c208be9a562fd
SHA1 707e6c010a42b5db3d759cc80c82b2d2c1cb1eb8
SHA512 991c7b766e568403ea118dd937fa1abbb6fe6104aa836fd2e5f958cd8187c36308c3aba6f8ab3d24c233efba598572465365a52763efd124f132370008163ef2
TLSH
T17E512FD04C396AE5D1BD0E7EB49B35EC90EC9722B4A0343D7898E99C497E51D714083E
MD5 SHA1 SHA512 TLSH

Submit Download

d82833ae-5225-4fe5-ae6d-856d51d9e001.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d82833ae-5225-4fe5-ae6d-856d51d9e001.tmp
Size 27KB
SHA256 0fc65af3451532d7f8d379583ad6585cc67336e7b22395474f6b41c27463db86
MD5 81950eb354d370e959ed71e660d19f88
SHA1 af69c5f81fd6a927c0a95bbb637d5706666f9299
SHA512 1b5f2771875ded7adac73342a7d919454909af4e9fc6faa8ceb2802579fe6dd6b6618b9a002a3158e07dc98837656798426a4645e1b4ecdfc18e42d6bc41d1c2
SSDEEP 384:n9iFKQkUSv9sN18TUNTUlI4bFF5mg5DhMK2fLBVR8+cnDIrH7vBEj6gL/7Iz6IIn:0Fy9Qwgl+h4BVR2DIrH75EjDLn
TLSH
T196C23936E894DABBDDFB8E95B30A7A57EEE05253859C4AC4D9D94D1C00C32DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddce71bd-7ef6-4be3-b43b-efa596f331ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ddce71bd-7ef6-4be3-b43b-efa596f331ca.tmp
Size 32KB
SHA256 f64fe9cb0edd741b1754354818c09174f77c7a78a6a1a321bc36de28c33fbb2f
MD5 c8613c85cea3cd9914b22e52a2ca661e
SHA1 2b8d82d6783bf2a4237a8e20e525e3414a020267
SHA512 55c344721459d5cd896b14ebdffc5d8455846f955ef8af2ffaab7745d2aa0a92644d0e040ef0e1b5a06f4631024eee719113dc2a0c3d856c845ec2c01e843861
SSDEEP 384:nRiFCQkUSvw8sNi78TUNTUlI4bFFTemgqzDW4KTfbBVR8+cnRIrH7vBEj6gL/7I+:4F6TT7wgaxW3BVR2RIrH75EjDLn
TLSH
T163E29FF598D79A7AD8AE4B57A33D2E469AFCD113B5984984F7C40D1CCC822BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e152d2b5-0989-4b17-8eca-6d8d8ca62967.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e152d2b5-0989-4b17-8eca-6d8d8ca62967.tmp
Size 25KB
SHA256 2c2b901a82008440221c6b39d053e6fe0e621ba46029a18c24eac826b4d18f22
MD5 f2d6661f0fca0843ae9c125d2db21354
SHA1 b02c029be39453edcc868d082467e8ad268d8718
SHA512 259ed8a4ea8055c871fd3e91a3ddce577db3744a81dbd989846a6697d1c0dd7ef49cff14c81922e1752f9ea1d4bc672fb92e44a16d289859635392853eca9433
SSDEEP 384:nriFiZcI63sNV8TUNTUlIm25mg51nK2fLBVR8+cWIEsa+VY9gL/7IzIop:GFQ63YwgS+3BVR2WIEhgfC
TLSH
T15DC23A32EC94DABBECFB8FD5A74ABA07DEE01163849C99C4DAD45D1D008769D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45867a37-6937-498d-9a84-2726d62c32b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\45867a37-6937-498d-9a84-2726d62c32b7.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 998c513f36b2b0a1f425a83ce631ed0771c0dfbd960f850f3b18787abeccec5e
MD5 db56397ab78bacfdc4542d20c8728d47
SHA1 437b870d845f31c359d488bf1c96f7392f7bd17b
SHA512 af528cb4e65d1eded26d2d8c55912f52ab9e7a821d15744380cd1a14fa49e7fa10ed0e2cefed40590aff5f256d93973f5cdc008e8506d0872a7ee3884fd7e848
TLSH
T123412969B6EE1148B3B76F5AABF6686D587A7C772E06C49D00010D4F0663E40CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\_bz2.pyd
Size 85KB
SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
MD5 207d4a4b7a113ef494514918f2dccdf3
SHA1 74b59453b5bb6194e0d2587d26d499d0f7e1aed5
SHA512 f7e5a2608ee19fd400d4bfe27e8603289a219af6a4a4a9e65ebb76c715d926fb9b08293fc2a3fed2195784804764265fa0b356547f23c501ec8ff9487c948b27
SSDEEP 1536:xtMtz7eksNCb6YVVEFxO2RqOyuzotWw8pRbIiQIG3VTy1Ni9QfIY6utw:PMtzSqurjOqqfgotWrplIiQIG3VtKtw
TLSH
T14A837E86B3B462B6F59B81B496910353F730FF960710A3BFB25482863F13B91AF58365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\_ctypes.pyd
Size 139KB
SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
MD5 eeabc0c7756ed7a29e33e467c398737f
SHA1 ec5c401946a9df4e4ab764ddb4639e4e33e1ce40
SHA512 5e1e93545e1be34880fc680ca12004792076e88baa6cac4512fdbbdb90091a9ae441a16b8d24f64c6b03bf14903babddecfa783ce5c016759ed790c0eabc189b
SSDEEP 3072:G/n1qQ8/27N56EBZrGwrb1OzIJswKRW2r7rw8IGGPzoGc:wn1JDT6wrszIJfUDwtc
TLSH
T1A3D38F4B336841E6DA678138C6739E47FBB1F4511A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\_decimal.pyd
Size 283KB
SHA256 8d41a84db20a9b985e98c802ad6833cf9625c744ad35478dd346f54f81488706
MD5 4bebc4da7d6319283a8c664bfc55408e
SHA1 4dc69a8105272711673afa5f712af982a18532e1
SHA512 411cd0ee4189654e836579efb4df509a02cba39cd9793e6d7250aa4e239449dafb6936ac57cb8ee7bd97cf2fb178beea17f658bf6ae7149ed8ed927a7c47bdf3
SSDEEP 6144:ASM9SUWXvOOiSx1u8llV6zeGqqM43fIWeA9O8O8OOT6MPgz/:ASM9SUWfQSx1ucapLIz/
TLSH
T1D5547C52A3490CA4EF7384388A479A57F7B2B8414360D78F47A48A972F933E3677E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\_hashlib.pyd
Size 67KB
SHA256 36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2
MD5 dcf15b3e1858d9324be2c719e4e990c9
SHA1 8311c2fb0bb75342367a83fcca7161a0f7fadafb
SHA512 fa2783d0cbbba477a08bf4f2fa3df21d6d0bf5bd5bc7cef25254a3d29fc7d01229337ad5dd54c2f0e67b956fd43953aa98586240102511ddd48d04c674b7ff93
SSDEEP 1536:KXwAzOYBQca7JKs2+C5oIGDIUy1Ni97BfIkxd8:0J/yJKs2+IoIGDIm6o8
TLSH
T1EF635B8AA6984092DA2382B5C9E34F43F974F252271197DF6678C18E2F233C3573B756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\_lzma.pyd
Size 157KB
SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
MD5 cada2b240b280f172aeb32a1666b21e6
SHA1 c15dc39329444433c255309eb89bae188aae1b22
SHA512 8b12298efd28549d46e2c48cff94b07039cf513bbac25063ebad8bae57b96e07eefd7df82229441af142c1b96dc837dec468263c0873d14da280e3ed6e42eb9e
SSDEEP 3072:BJ66g4T5QW7JfyjEqkSkA51b4pznfJ9mNopUpdbQIGI1HFk:BUR4Tp4QPZ8N4RxYOgbPa
TLSH
T110F34C86B794F0E6F7328C38D2624F57E6F578590320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\_socket.pyd
Size 85KB
SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
MD5 7a16a21ad11d3e9829ca3b379a2bb010
SHA1 90707b5c1662a1e4553f1cc10ba96c7452def7c2
SHA512 5e0268af7dad1646903ddb5e61fb38896a7ae964cadb38b5c28bc1524a69a87b7c09f501f3f570ec6bf78c8fa873b8fbe062bbe06cf839e32a2735f1efd0cae1
SSDEEP 1536:hcVuncT0XH3XAJtZypxm7XP+66wSzC/jAjI/Lb6NsQ3cs8PgMr8IGGwby1Ni9DFo:SEny2+jypxm7XPz6wSzC/jAjQOsQssV2
TLSH
T19B835B01A66040FAEB77C176C2639E63FBB4B5C01294A75F1466C55A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\_ssl.pyd
Size 186KB
SHA256 5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad
MD5 e4ba5a52f5fa2a64baec46486cbdcf82
SHA1 ff213b504a70d50871eb8432cea1b22563364cb4
SHA512 111c926a0157d46c48a26da30face546b065eb4afddb6dcf27442fd4f73432808de43978f78f5b297b22a63d82d0d5bf305701e137f6060f59cbd601012e61fa
SSDEEP 3072:FVpZeIk2MZ7IifVvQto7qrvYLrgp8VuMG4eJ9i1zktdsQ/3Omca45gMqTVBOrQII:Bxk2MZZVvQtmL4457qTVMrQ
TLSH
T1AD147B47B5446EF7D802E8BAC6234543FBB4F045331297DE48D6EA520F03746AE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\_zstd.pyd
Size 491KB
SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
MD5 035b0a033dd00dbe887556f4d4b852c3
SHA1 e86cf52d825f9b68177354c54edaa57e962012c3
SHA512 0b428aa10a9e977e07023918870368a9c00e0eb4ab4f7cf1e88950d4aebd2ba5774ebea9f3779d05e370bbe315da6634922834106077d511b710c6131d29dc65
SSDEEP 12288:KccWmYLKvveeFSeX0ro+Q2J5BCl9VNqdp:KccWJKvveeFSeX0roMZdp
TLSH
T143B48D43F29943EDE53BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\base_library.zip
Size 1.3MB
SHA256 03a5eb97dcb04dd819cfe2bc41a85257364aca06effda40b3bcb533e40110c8a
MD5 8882b9d9328b63b2cd3442b7ab9a188a
SHA1 9191132f7864926cd464b1c5d32ea7420f4655bf
SHA512 a84b5fdb0812a5e8593be254647d731b7d8da3d6d87c69b5de71cfb64074829264e44b66f31a96df4038ae236782ab8de6ca4a275db3c24ead855807c0883429
SSDEEP 24576:RL3Rpw2fHlbSQeOdP2m2dfMQZxuUF4GdgYOD:tR2/kyuUFRdgYA
TLSH
T16F552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\libcrypto-3.dll
Size 6.0MB
SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
MD5 4191d4288230515c5098cc07f699a604
SHA1 bd8b4d48b2f4513dc378bc5a4cf4a3abbc6998d8
SHA512 c110a89ebb5b58126d556ffea1bf01efb4a6dd295f7387665223741a171d9353315de4d361d3d02a186c1c659aee20f46c579efc51b4c41f7282e1b5b4d6d040
SSDEEP 98304:ybM11p6ZVTRwlFh7V6v73WyXTf0W+JJe1CPwDvt3uFA0CaI:ybM1T6ZlalfV6v7GyXbnEJe1CPwDvt3T
TLSH
T1E6566B5EA7A80188E4BAD13CC6534627D2F1F85A5BB097CF05A196790F33BDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\libssl-3.dll
Size 1.3MB
SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
MD5 d99207e7e513f87ad7571c4c2450771b
SHA1 b904eb3989c9a1ad77e3a541e40d84ae890e3df7
SHA512 bccd034e633b96c2c7dff6ca96c2bb8a8c0f90a872f256e8467e470ed57fc4b442c74da488b258b5a255feba26767a5c95293a636c94c754e2644ed91c5be7ac
SSDEEP 24576:gk2RrDo2iVOF8hXN1hyeWsoSvSZlRg5aYsC:gRFDo2uOKJ8sIRg5aYsC
TLSH
T11F556D5AA7B8016DD5B6C17CC6938B23D2B2F41623709BEF06658A790F23BD6273D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\python314.dll
Size 6.5MB
SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
MD5 006b0746b5abaf438d1bc753261c6d2c
SHA1 8f34714617f376cfa6e7e2aedc1e2a73de8c8fd8
SHA512 1c156c3f542de0a27e16ca5b7d6bbd34f2059b380ce85dbcfd5ae3a64de473fd160baba45ca30ad85dfe45742fdcb42aa969cbbaab26a569e324d4e65fb6d621
SSDEEP 98304:xVyDBH+ULEfi0VOuZd+FAX/uv3HDMiEEQn0rt:xVyD1+ULW5VrZRxim0rt
TLSH
T136669D26737901A5D9BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\select.pyd
Size 32KB
SHA256 fab1b4cee101359d82d72061b83cff1855337b3677b9fe01cd69f7548f4c496e
MD5 43a869da7432298fce80f8c163ad8e7f
SHA1 65d259ba8350561668706a563ee0800c1748c173
SHA512 26c57d276b82fcb9c4f971a8e74847e14dc1a3b942a62f442740d6244ee8f23ba29c9e56b5001c2734db3fd1ac52a6bda02926f47d12cf727e38703971fa9d55
SSDEEP 768:TB7YLZnCaqF8IGRGCy1KPuBL2Ip4pTxf1ml9dHu7L3:TB7C5CaqF8IGRGCy1Ni9bfIbHun3
TLSH
T17FE28CCAAB345047EA63C671C6A2CE83FA39F7E35611469F31B5918A1E237C1A337354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011f02\unicodedata.pyd
Size 741KB
SHA256 0d4f124b2d6622d276d777f7106972219f9b310edb5df8149c253da7c013d6d8
MD5 4df357dfce07299b9e6759583f41ca68
SHA1 d5810b7f7d05ac3a37592566ee898f428919cb53
SHA512 f741882d4444a4be4342f89932b2510c57fd943cf782079551c202c419805a90a06203464cdf1a209a8da3e56677426dc9af388b2077a5746b3daf0f2da1f69f
SSDEEP 12288:jIwYBAPtrZmDtBPcH+dEYJ5EYub+z70lDJPT36mwtyqt:jIwYS5ZmDPqO54lDJPTMyqt
TLSH
T11EF4E5F5BB838C16E69B767A48D3210F4E50C2B35F1A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d15d0811-b2e2-4d81-91ec-f439d542a04c.tmp

Path C:\Users\Admin\AppData\Local\Temp\d15d0811-b2e2-4d81-91ec-f439d542a04c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1612_1913393847\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

7c98b94c-c9c7-4d2d-a0ea-0af02eaf99bd.tmp

Path C:\Users\Admin\Downloads\7c98b94c-c9c7-4d2d-a0ea-0af02eaf99bd.tmp
Size 14KB
SHA256 c8b49c794991251f71db5e65f9deebc33cd2887c76b1df22b6ce3fc3468f4a74
MD5 2898dedb4afc88732b449a6624735181
SHA1 5d4ee1e106b590e0b19a4565ee390d2cd9172f1f
SHA512 979a019ab44ebec50c139faf869af4c931d978299594a7c5a65f2239f02fc76af9f57772d22070bae24cfe7750193eba71229325d05f788cfc7caa48d6a5f2f9
SSDEEP 384:2SH8agu0TkL7jiAoTOn0eTxDMVwS4/huplurGrcP5RS:2SH8buwkveAoCn0qDMVwn/oncP5k
TLSH
T14562CFEC099CCB07C92DBBB445B62B4502436EE37AE7319014BD6C717A4FB3E682D919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87cdd5cf-68e5-472e-8ca4-a0091d66c326.tmp

Path C:\Users\Admin\Downloads\87cdd5cf-68e5-472e-8ca4-a0091d66c326.tmp
Size 530KB
SHA256 0321ec8e8b64887106e2c5fe1e29386513d87311d519b2c6911fd3f654fe9144
MD5 4c33411744dc2c797ad551477170b449
SHA1 08ab443b1df1641e188f01781a4458a840225ef5
SHA512 2c0fca752c4df6dff253043c7b22559bbbf9a026d2bc29cb609ead027f2a6d639f0fcff2a352cc54d27f11f99703f323460569c55f42169991a209b09e229bf7
SSDEEP 12288:qKEJqmkioZwFW6TxKPadad/CXE+56nH4aI7zMPX/f2i+:yJmPKFW+Cld/4F56H4P74Xf2f
TLSH
T15CB423E41AE86A3F9B3634ECD2D1E00F5AD44526085674BEE5238E9496D4F73EC0B90F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuasarTool.rar

Path C:\Users\Admin\Downloads\QuasarTool.rar
Size 38.6MB
SHA256 7bc8a2704497f893a865f04ef9d85c3da3432f29f787c0e56ec18edd39b28810
MD5 a5c39da090bd47dc17cec958b1eade89
SHA1 8e451fa6a53a76d8137f5dd99d12fbb0e57bc93b
SHA512 b3e23c65bc69e22a46ac7226f80dbbc3fc844573fbbdcde828ebae21788f948bf06ef9e73a340c384e7eca57839547cc1e954fa8e4fa2492810fe89fa9c27d6a
SSDEEP 786432:LV1IPoybcPcqNBrkVBZoxyqDVeaBndHsAF7A/T55rIeS4XBNeB/15W:vioy0c0OBcDVvdHszbzrIeVB0vw
TLSH
T1029733906975AA7D0AD37C26990B4DC658B33DDD5A16F3E30F93F3C8215AC23A026397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuasarTool.rar.crdownload

Path C:\Users\Admin\Downloads\QuasarTool.rar.crdownload
Size 78KB
SHA256 60983c30bfde53d4154a5447d23cf988e152f1e60dea4e054152cec4b7128dac
MD5 7079725b64db15c6ff2c12fa82d6440a
SHA1 70a78dfd4170eea2f1fde29de67fc161f521971a
SHA512 367ebbd7808e03a3c1182d3ca56ec0a14b1f25eb8a913748387acd7f16352dd2e5d9c5e5febe94260aefac5607bcbc97096c097bd53a181a1791b93f457b67d2
SSDEEP 1536:hob3cmKkxXlEcwibFBkARYPo8ibNZHMVJtcE7HH5oM0cS0qMKRDowjst:GbsmKkPE+ZBkAeFibktcEbZo2SspwjQ
TLSH
T1037312DFB98D968B5B1E3558F1DA041356498ECBEC8750FE34F11CC0A8B1758B89F44A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuasarTool.exe

Path C:\Users\Admin\Downloads\QuasarTool\QuasarTool\QuasarTool.exe
Size 19.2MB
SHA256 1e9cf875662f90eb84cb895d49601245fdcaab6a04c32c64d2f24988a9d63927
MD5 f0501133ec1ec62846f5baf58ab3feed
SHA1 4bf15f47aac60c1de1c59466791ec404fd8157b2
SHA512 7c221381b15caac06d518ecad690a594a1111c4a29528372819e1bbead844e3057083ce8a3ffa052fc51d5ad774fd177d816ca4a94c07ba2d2cebe09688fca72
SSDEEP 393216:UpJJ6DazTY0RlJKDN4yBdkxnZbvdjFlS0SAU6LJ06hJlQpIMazeJInky7L:UriWTSvOnx00pJ0MuOMvJInky
TLSH
T1B717337AF0F650FED40751B7EA8EBDF13999303A25190A75844DC6317F4B5A0AE3328A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuasarTool.exe

Path C:\Users\Admin\Downloads\QuasarTool\QuasarTool\QuasarTool.exe
Size 17.9MB
SHA256 7d35a9e9f490bc8e1a921efe0a867a3c2b583914b04e0d63437bc8f82f8e362e
MD5 5a1523197ccf87f4035298be05bac1e4
SHA1 b2549d8147b17defda302b3f2c29761f539e9d56
SHA512 fe4250c0d83ab5778220359ffb13937ed13659e0ccf2327dbf2d5d9e2fb10bc969623dc0fd626b1aea23d9d0e4c0608f0241937bad05f64f867ea0bea8a7dda2
SSDEEP 393216:UpJJ6DazTY0RlJKDN4yBdkxnZbvdjFlS0SAU6LJ06hJlQpIMazeJInkW:UriWTSvOnx00pJ0MuOMvJInkW
TLSH
T13217337AF1F645FED40350B7EA8E7DE23895343A261A0AB5844DC6327B4F5A0BE33185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuasarTool.exe

Path C:\Users\Admin\Downloads\QuasarTool\QuasarTool\QuasarTool.exe
Size 11.9MB
SHA256 08ef3db4cf7cd6e3f50f41c332b80bf874e849a517b3d13eab9c7dc826372467
MD5 eb03c011cf3852182691a32977129797
SHA1 b5e538c829cb093e6e5392a320fc4c84a78dfb55
SHA512 f7f2037105c03681f845f437708a75beae494ca7d7ec120522b6d9ea72654363e4b463d3598441ea4e88ac2fd290bae3a9627bd786cbd06f6df9aaa4efd79198
SSDEEP 196608:UpnJJ6o4aCoTFC0RdFlX5KDN4yBdkd9BnZbv4lqtjFQ2hJR+pZGQElOFoPeCWAUl:UpJJ6DazTY0RlJKDN4yBdkxnZbvdjFlg
TLSH
T12AC63363F5FA55FDD05360B6E7C76EF338E93438000A09FA848685266F0F4507EB669A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-1524-0x00007FF81DE70000-0x00007FF81E1A7000-memory.dmp

Download

memory/5352-208-0x000001FD167B0000-0x000001FD177B0000-memory.dmp

Download