Overview

overview

9

Static

static

1

QuarkPC_V1...02.msi

windows7-x64

9

QuarkPC_V1...02.msi

windows10-2004-x64

9

Analysis

  • max time kernel
    247s
  • max time network
    260s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-11-2024 14:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    QuarkPC_V1.9.0.151_pc_pf30002.msi

  • Size

    216.3MB

  • MD5

    4507d0b4b388162362dfcf53cc262ad9

  • SHA1

    c559c7ec90968a896f99acdd64cd7e073152173d

  • SHA256

    794a83579d11639d51da839647145a1a4b5d9a3e893fe09c0f56f7b7c5d64c69

  • SHA512

    927bf11c12efc4dc53ee3486da87b1fec03f33fdfd151e4f2715955a749af87b904499a048676301cf0461d955f9f2f04293a4bb5d786739075b279f963b63fe

  • SSDEEP

    6291456:0Ao/2PVmZrDQalQVdvLQtqF5BUgbE5MXtBUdbyv:0c2DQFdQ8F5PuMX/Uov

Score
9/10
discoveryevasionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Identifies Xen via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare services registry key. 1 TTPs 3 IoCs
    evasion
  • Looks for Xen service registry key. 1 TTPs 5 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 10 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 4 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Executes dropped EXE 41 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 19 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Kills process with taskkill 6 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\QuarkPC_V1.9.0.151_pc_pf30002.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:5100
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding FE5B95D352C6B48C3BAD292414F45C02 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4128
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1752
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding D0DDFC16411A9D9BC6050C242796394E
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2980
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding D402DB2E04D97EA1A7AC850A7027A525
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1552
        • C:\Users\Admin\01B31047-436D-409B-B973-00002FA31E8C\down.exe
          C:\Users\Admin\01B31047-436D-409B-B973-00002FA31E8C\\down.exe
          3⤵
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1164
          • C:\Users\Admin\01B31047-436D-409B-B973-00002FA31E8C\down.exe
            C:\Users\Admin\01B31047-436D-409B-B973-00002FA31E8C\down.exe /aut
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1860
          • C:\Windows\system32\colorcpl.exe
            colorcpl.exe
            4⤵
            • Enumerates connected drives
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:2268
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2264
    • C:\Users\Admin\AppData\Local\Temp\{441DC270-E1AC-4df3-816E-87D874F7859B}.exe
      "C:\Users\Admin\AppData\Local\Temp\{441DC270-E1AC-4df3-816E-87D874F7859B}.exe" /s "C:\Users\Admin\AppData\Local\Temp\{00C62CB0-2BE0-43c3-9FF4-1973359A76B0}"
      1⤵
      • Adds Run key to start application
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2608
    • C:\Program Files (x86)\QuarkPC_V1.9.0.151_pc_pf30002\QuarkPC_V1.9.0.151_pc_pf30002\QuarkPC_V1_9_0_151_pc_pf30002\QuarkPC_V1.9.0.151_pc_pf30002.exe
      "C:\Program Files (x86)\QuarkPC_V1.9.0.151_pc_pf30002\QuarkPC_V1.9.0.151_pc_pf30002\QuarkPC_V1_9_0_151_pc_pf30002\QuarkPC_V1.9.0.151_pc_pf30002.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Users\Admin\AppData\Local\Temp\is-52D2M.tmp\QuarkPC_V1.9.0.151_pc_pf30002.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-52D2M.tmp\QuarkPC_V1.9.0.151_pc_pf30002.tmp" /SL5="$901DC,219803070,1206784,C:\Program Files (x86)\QuarkPC_V1.9.0.151_pc_pf30002\QuarkPC_V1.9.0.151_pc_pf30002\QuarkPC_V1_9_0_151_pc_pf30002\QuarkPC_V1.9.0.151_pc_pf30002.exe"
        2⤵
        • Checks computer location settings
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2464
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c taskkill /f /t /im quark_swap_util.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3540
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im quark_swap_util.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4324
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c taskkill /f /t /im QuarkUpdaterSetup.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4912
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im QuarkUpdaterSetup.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2752
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c taskkill /f /t /im quark_proxy.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4464
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im quark_proxy.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3384
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c taskkill /f /t /im quark.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5060
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im quark.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2816
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c taskkill /f /t /im quark_host_client.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4344
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im quark_host_client.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1728
        • C:\Program Files\Quark\1.9.0.151\Installer\QuarkUpdaterSetup.exe
          "C:\Program Files\Quark\1.9.0.151\Installer\QuarkUpdaterSetup.exe" --install --silent --system
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          PID:4812
          • C:\Program Files\QuarkUpdater4812_1112788214\bin\updater.exe
            "C:\Program Files\QuarkUpdater4812_1112788214\bin\updater.exe" --install --silent --system --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2,*/chrome/updater/quark/*=2
            4⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • Checks processor information in registry
            • Modifies registry class
            • Modifies system certificate store
            PID:4456
            • C:\Program Files\QuarkUpdater4812_1112788214\bin\updater.exe
              "C:\Program Files\QuarkUpdater4812_1112788214\bin\updater.exe" --crash-handler --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2,*/chrome/updater/quark/*=2 --system "--database=C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\Crashpad" --url=https://pan-api.quark.cn/monitor/crash/collect/ --annotation=_companyName=UC --annotation=_productName=QuarkPCUpdater --annotation=_version=1.0.0.6 --annotation=app=quark-updater --annotation=app_bid= --annotation=app_channel= --annotation=bizguid=ZztRsAAAACkDAJDkqkWviKBx --annotation=dcheck=off --annotation=guid=ZztRsAAAACkDAJDkqkWviKBx --annotation=official_build=true --annotation=platform=win32 --annotation=prod=QuarkUpdater --annotation=sver= --annotation=ucVersion=240822210044 --annotation=utdid=ZztRsAAAACkDAJDkqkWviKBx --annotation=ver=1.0.0.6 --annotation=version=1.0.0.6 --annotation=xtm=1731940820014 --annotation=xtoken=b31776 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff66511aff8,0x7ff66511b004,0x7ff66511b010
              5⤵
              • Executes dropped EXE
              PID:1840
        • C:\Program Files\Quark\quark.exe
          "C:\Program Files\Quark\quark.exe" --quark-extension-install --install-from=quarkinstaller --quark-make-default-browser --launch-from=firstinstall --quark-pin-to-taskbar
          3⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Identifies Xen via ACPI registry values (likely anti-VM)
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VMWare Tools registry key
          • Looks for VMWare services registry key.
          • Looks for Xen service registry key.
          • Checks BIOS information in registry
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Drops desktop.ini file(s)
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks computer location settings
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Checks system information in the registry
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4716
          • C:\Program Files\Quark\quark.exe
            "C:\Program Files\Quark\quark.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Quark\User Data" /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Quark\User Data\Crashpad" --url=https://pan-api.quark.cn/monitor/crash/collect/ --annotation=_companyName=UC --annotation=_productName=QuarkPC --annotation=_version=1.9.0.151 --annotation=app=quark-windows --annotation=app_bid=999 --annotation=app_channel=pcquark@homepage_oficial --annotation=bizguid=ZztRsAAAACkDAJDkqkWviKBx --annotation=brand= "--annotation=cpu_model=Intel Core Processor (Broadwell)" --annotation=dcheck=off --annotation=gpu_model= --annotation=guid=ZztRsAAAACkDAJDkqkWviKBx --annotation=official_build=true --annotation=plat=Win64 --annotation=platform=win32 --annotation=prod=Quark "--annotation=rom=Windows NT_10.0.19041" --annotation=sver=alpha --annotation=ucVersion=241031172851 --annotation=utdid=ZztRsAAAACkDAJDkqkWviKBx --annotation=ver=1.9.0.151 --annotation=ver_electron=24.1.3 --annotation=version=1.9.0.151 --annotation=wpk_auto_collect_flag=true --annotation=xtm=1731940818514 --annotation=xtoken=181f4b --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2b0,0x7ff873d56910,0x7ff873d57138,0x7ff873d57960
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1204
          • C:\Program Files\Quark\quark.exe
            "C:\Program Files\Quark\quark.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2908 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:2
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2116
          • C:\Program Files\Quark\quark.exe
            "C:\Program Files\Quark\quark.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=zh-CN --service-sandbox-type=none --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --start-stack-profiler --mojo-platform-channel-handle=3800 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:8
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system certificate store
            PID:4884
          • C:\Program Files\Quark\quark.exe
            "C:\Program Files\Quark\quark.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=zh-CN --service-sandbox-type=service --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2792 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:8
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4520
          • C:\Program Files\Quark\quark.exe
            "C:\Program Files\Quark\quark.exe" --type=renderer --start-stack-profiler --first-renderer-process --lang=zh-CN --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4996 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:1
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1180
          • C:\Program Files\Quark\quark.exe
            "C:\Program Files\Quark\quark.exe" --type=renderer --lang=zh-CN --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=5008 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:1
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:208
          • C:\Program Files\Quark\quark.exe
            "C:\Program Files\Quark\quark.exe" --type=renderer --extension-process --lang=zh-CN --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=6520 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:1
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            PID:2476
          • C:\Program Files\Quark\quark.exe
            "C:\Program Files\Quark\quark.exe" --type=renderer --extension-process --lang=zh-CN --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=6708 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:1
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            PID:3996
          • C:\Program Files\Quark\quark.exe
            "C:\Program Files\Quark\quark.exe" --type=utility --utility-sub-type=uc.wpk.mojom.WpkService --lang=zh-CN --service-sandbox-type=none --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=6684 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:8
            4⤵
            • Checks system information in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks processor information in registry
            • Enumerates system info in registry
            PID:2864
          • C:\Program Files\Quark\quark.exe
            "C:\Program Files\Quark\quark.exe" --type=renderer --extension-process --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --app-path="C:\Program Files\Quark\1.9.0.151\Resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --lang=zh-CN --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=7192 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:1
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            PID:5780
          • C:\Program Files\Quark\quark.exe
            "C:\Program Files\Quark\quark.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=zh-CN --service-sandbox-type=none --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=7404 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:8
            4⤵
            • Executes dropped EXE
            PID:6052
          • C:\Program Files\Quark\quark.exe
            "C:\Program Files\Quark\quark.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=zh-CN --service-sandbox-type=none --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=7552 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:8
            4⤵
            • Executes dropped EXE
            • Modifies system certificate store
            PID:6128
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\Software\Tencent\WeChat" /v FileSavePath"
            4⤵
              PID:5128
              • C:\Windows\system32\chcp.com
                C:\Windows\system32\chcp.com 65001
                5⤵
                  PID:5232
                • C:\Windows\system32\reg.exe
                  C:\Windows\system32\reg.exe QUERY "HKCU\Software\Tencent\WeChat" /v FileSavePath
                  5⤵
                    PID:5244
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\Software\Tencent\WeChat" /v FileSavePath"
                  4⤵
                    PID:5256
                    • C:\Windows\system32\chcp.com
                      C:\Windows\system32\chcp.com 65001
                      5⤵
                        PID:5408
                      • C:\Windows\system32\reg.exe
                        C:\Windows\system32\reg.exe QUERY "HKCU\Software\Tencent\WeChat" /v FileSavePath
                        5⤵
                          PID:5412
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKLM\Software\Tencent\WeChat" /v FileSavePath"
                        4⤵
                          PID:5312
                          • C:\Windows\system32\chcp.com
                            C:\Windows\system32\chcp.com 65001
                            5⤵
                              PID:1748
                            • C:\Windows\system32\reg.exe
                              C:\Windows\system32\reg.exe QUERY "HKLM\Software\Tencent\WeChat" /v FileSavePath
                              5⤵
                                PID:2448
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKLM\Software\Tencent\WeChat" /v FileSavePath"
                              4⤵
                                PID:5496
                                • C:\Windows\system32\chcp.com
                                  C:\Windows\system32\chcp.com 65001
                                  5⤵
                                    PID:5604
                                  • C:\Windows\system32\reg.exe
                                    C:\Windows\system32\reg.exe QUERY "HKLM\Software\Tencent\WeChat" /v FileSavePath
                                    5⤵
                                      PID:2464
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKCU\Software\Tencent\WeChat" /v FileSavePath"
                                    4⤵
                                      PID:1384
                                      • C:\Windows\system32\chcp.com
                                        C:\Windows\system32\chcp.com 65001
                                        5⤵
                                          PID:5808
                                        • C:\Windows\system32\reg.exe
                                          C:\Windows\system32\reg.exe QUERY "HKCU\Software\Tencent\WeChat" /v FileSavePath
                                          5⤵
                                            PID:5812
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\chcp.com 65001 | C:\Windows\system32\reg.exe QUERY "HKLM\Software\Tencent\WeChat" /v FileSavePath"
                                          4⤵
                                            PID:5892
                                            • C:\Windows\system32\chcp.com
                                              C:\Windows\system32\chcp.com 65001
                                              5⤵
                                                PID:6116
                                              • C:\Windows\system32\reg.exe
                                                C:\Windows\system32\reg.exe QUERY "HKLM\Software\Tencent\WeChat" /v FileSavePath
                                                5⤵
                                                  PID:6120
                                              • C:\Program Files\Quark\quark.exe
                                                "C:\Program Files\Quark\quark.exe" --type=renderer --lang=zh-CN --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=7848 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:1
                                                4⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                PID:5740
                                              • C:\Program Files\Quark\quark.exe
                                                "C:\Program Files\Quark\quark.exe" "C:\Program Files\Quark\1.9.0.151\Resources\app.asar\dist\server\index.js" --type=electron-node /prefetch:8
                                                4⤵
                                                • Executes dropped EXE
                                                PID:5796
                                              • C:\Program Files\Quark\quark.exe
                                                "C:\Program Files\Quark\quark.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=zh-CN --service-sandbox-type=none --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=7648 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:8
                                                4⤵
                                                • Executes dropped EXE
                                                PID:5292
                                              • C:\Program Files\Quark\quark.exe
                                                "C:\Program Files\Quark\quark.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=zh-CN --service-sandbox-type=none --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=624 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:8
                                                4⤵
                                                • Executes dropped EXE
                                                PID:5124
                                              • C:\Program Files\Quark\quark.exe
                                                "C:\Program Files\Quark\quark.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=zh-CN --service-sandbox-type=none --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=7780 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:8
                                                4⤵
                                                • Executes dropped EXE
                                                PID:4316
                                              • C:\Program Files\Quark\quark.exe
                                                "C:\Program Files\Quark\quark.exe" --type=renderer --lang=zh-CN --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=7672 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:1
                                                4⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                PID:3608
                                              • C:\Program Files\Quark\quark.exe
                                                "C:\Program Files\Quark\quark.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=zh-CN --service-sandbox-type=none --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=6932 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:8
                                                4⤵
                                                • Executes dropped EXE
                                                PID:5364
                                              • C:\Program Files\Quark\quark.exe
                                                "C:\Program Files\Quark\quark.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=zh-CN --service-sandbox-type=service --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=6620 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:8
                                                4⤵
                                                • Executes dropped EXE
                                                PID:5448
                                              • C:\Program Files\Quark\quark.exe
                                                "C:\Program Files\Quark\quark.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=zh-CN --service-sandbox-type=service --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=7484 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:8
                                                4⤵
                                                • Executes dropped EXE
                                                PID:5192
                                              • C:\Program Files\Quark\quark.exe
                                                "C:\Program Files\Quark\quark.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=zh-CN --service-sandbox-type=service --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=7124 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:8
                                                4⤵
                                                • Executes dropped EXE
                                                PID:2848
                                              • C:\Program Files\Quark\quark.exe
                                                "C:\Program Files\Quark\quark.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --start-stack-profiler --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6496 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:2
                                                4⤵
                                                • Executes dropped EXE
                                                PID:5336
                                              • C:\Program Files\Quark\quark.exe
                                                "C:\Program Files\Quark\quark.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=zh-CN --service-sandbox-type=service --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=6556 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:8
                                                4⤵
                                                • Executes dropped EXE
                                                PID:5708
                                              • C:\Program Files\Quark\quark.exe
                                                "C:\Program Files\Quark\quark.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=zh-CN --service-sandbox-type=service --standard-schemes=main,uccd --secure-schemes=main,uccd --bypasscsp-schemes --cors-schemes --fetch-schemes=main,uccd --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=8076 --field-trial-handle=2912,i,14878871660942618634,13681338008198580688,131072 --enable-features=EnableTabMuting,WinrtGeolocationImplementation /prefetch:8
                                                4⤵
                                                • Executes dropped EXE
                                                PID:4724
                                            • C:\Windows\SysWOW64\regsvr32.exe
                                              "C:\Windows\System32\regsvr32.exe" /i:"--reg-to-hklm" /s "C:\Users\Admin\AppData\Local\Programs\Common\Quark\quarkshellext_20241031183131.dll"
                                              3⤵
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:1456
                                              • C:\Windows\system32\regsvr32.exe
                                                /i:"--reg-to-hklm" /s "C:\Users\Admin\AppData\Local\Programs\Common\Quark\quarkshellext_20241031183131.dll"
                                                4⤵
                                                • Loads dropped DLL
                                                • Modifies registry class
                                                PID:2752
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /c taskkill /f /t /im quark_host_client.exe
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1360
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /f /t /im quark_host_client.exe
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                PID:1608
                                        • C:\Users\Admin\AppData\Local\Temp\{8A03C066-5651-4070-8FA1-83478369FD03}.exe
                                          "C:\Users\Admin\AppData\Local\Temp\{8A03C066-5651-4070-8FA1-83478369FD03}.exe" /s "C:\Users\Admin\AppData\Local\Temp\{1E0FC6C4-8059-48b3-9DCD-09746A6B3588}"
                                          1⤵
                                          • Adds Run key to start application
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:5092
                                        • C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\updater.exe
                                          "C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\updater.exe" --system --windows-service --service=update-internal --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2,*/chrome/updater/quark/*=2
                                          1⤵
                                          • Drops file in System32 directory
                                          • Drops file in Program Files directory
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Checks whether UAC is enabled
                                          • Checks processor information in registry
                                          • Modifies data under HKEY_USERS
                                          • Modifies registry class
                                          PID:3776
                                          • C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\updater.exe
                                            "C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\updater.exe" --crash-handler --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2,*/chrome/updater/quark/*=2 --system "--database=C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\Crashpad" --url=https://pan-api.quark.cn/monitor/crash/collect/ --annotation=_companyName=UC --annotation=_productName=QuarkPCUpdater --annotation=_version=1.0.0.6 --annotation=app=quark-updater --annotation=app_bid= --annotation=app_channel= --annotation=bizguid=ZztR1gAAACkDAJDkqkWBZpzj --annotation=dcheck=off --annotation=guid=ZztR1gAAACkDAJDkqkWBZpzj --annotation=official_build=true --annotation=platform=win32 --annotation=prod=QuarkUpdater --annotation=sver= --annotation=ucVersion=240822210044 --annotation=utdid=ZztR1gAAACkDAJDkqkWBZpzj --annotation=ver=1.0.0.6 --annotation=version=1.0.0.6 --annotation=xtm=1731940822932 --annotation=xtoken=d56b23 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff6bfe3aff8,0x7ff6bfe3b004,0x7ff6bfe3b010
                                            2⤵
                                            • Executes dropped EXE
                                            PID:2228
                                        • C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\updater.exe
                                          "C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\updater.exe" --system --windows-service --service=update --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2,*/chrome/updater/quark/*=2
                                          1⤵
                                          • Drops file in System32 directory
                                          • Drops file in Program Files directory
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Checks processor information in registry
                                          • Modifies data under HKEY_USERS
                                          PID:5508
                                          • C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\updater.exe
                                            "C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\updater.exe" --crash-handler --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2,*/chrome/updater/quark/*=2 --system "--database=C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\Crashpad" --url=https://pan-api.quark.cn/monitor/crash/collect/ --annotation=_companyName=UC --annotation=_productName=QuarkPCUpdater --annotation=_version=1.0.0.6 --annotation=app=quark-updater --annotation=app_bid= --annotation=app_channel= --annotation=bizguid=ZztR1gAAACkDAJDkqkWBZpzj --annotation=dcheck=off --annotation=guid=ZztR1gAAACkDAJDkqkWBZpzj --annotation=official_build=true --annotation=platform=win32 --annotation=prod=QuarkUpdater --annotation=sver= --annotation=ucVersion=240822210044 --annotation=utdid=ZztR1gAAACkDAJDkqkWBZpzj --annotation=ver=1.0.0.6 --annotation=version=1.0.0.6 --annotation=xtm=1731940824862 --annotation=xtoken=9c8c84 --initial-client-data=0x27c,0x280,0x284,0x21c,0x288,0x7ff6bfe3aff8,0x7ff6bfe3b004,0x7ff6bfe3b010
                                            2⤵
                                            • Drops file in Program Files directory
                                            • Executes dropped EXE
                                            PID:5524
                                        • C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\updater.exe
                                          "C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\updater.exe" --system --windows-service --service=update --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2,*/chrome/updater/quark/*=2
                                          1⤵
                                          • Drops file in System32 directory
                                          • Drops file in Program Files directory
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Checks processor information in registry
                                          • Modifies data under HKEY_USERS
                                          • Modifies system certificate store
                                          PID:5672
                                          • C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\updater.exe
                                            "C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\updater.exe" --crash-handler --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2,*/chrome/updater/quark/*=2 --system "--database=C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\Crashpad" --url=https://pan-api.quark.cn/monitor/crash/collect/ --annotation=_companyName=UC --annotation=_productName=QuarkPCUpdater --annotation=_version=1.0.0.6 --annotation=app=quark-updater --annotation=app_bid= --annotation=app_channel= --annotation=bizguid=ZztR1gAAACkDAJDkqkWBZpzj --annotation=dcheck=off --annotation=guid=ZztR1gAAACkDAJDkqkWBZpzj --annotation=official_build=true --annotation=platform=win32 --annotation=prod=QuarkUpdater --annotation=sver= --annotation=ucVersion=240822210044 --annotation=utdid=ZztR1gAAACkDAJDkqkWBZpzj --annotation=ver=1.0.0.6 --annotation=version=1.0.0.6 --annotation=xtm=1731940851670 --annotation=xtoken=7ce2d8 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff6bfe3aff8,0x7ff6bfe3b004,0x7ff6bfe3b010
                                            2⤵
                                            • Drops file in Program Files directory
                                            • Executes dropped EXE
                                            PID:5720

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Event Triggered Execution

                                        2
                                        T1546

                                        Component Object Model Hijacking

                                        1
                                        T1546.015

                                        Installer Packages

                                        1
                                        T1546.016

                                        Privilege Escalation

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Event Triggered Execution

                                        2
                                        T1546

                                        Component Object Model Hijacking

                                        1
                                        T1546.015

                                        Installer Packages

                                        1
                                        T1546.016

                                        Defense Evasion

                                        Modify Registry

                                        2
                                        T1112

                                        Subvert Trust Controls

                                        1
                                        T1553

                                        Install Root Certificate

                                        1
                                        T1553.004

                                        System Binary Proxy Execution

                                        1
                                        T1218

                                        Msiexec

                                        1
                                        T1218.007

                                        Virtualization/Sandbox Evasion

                                        8
                                        T1497

                                        Credential Access

                                        Credentials from Password Stores

                                        1
                                        T1555

                                        Credentials from Web Browsers

                                        1
                                        T1555.003

                                        Unsecured Credentials

                                        1
                                        T1552

                                        Credentials In Files

                                        1
                                        T1552.001

                                        Discovery

                                        Peripheral Device Discovery

                                        3
                                        T1120

                                        Query Registry

                                        16
                                        T1012

                                        System Information Discovery

                                        11
                                        T1082

                                        System Location Discovery

                                        1
                                        T1614

                                        System Language Discovery

                                        1
                                        T1614.001

                                        Virtualization/Sandbox Evasion

                                        8
                                        T1497

                                        Lateral Movement

                                        Collection

                                        Data from Local System

                                        1
                                        T1005

                                        Command and Control

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Config.Msi\e584736.rbs
                                          Filesize

                                          27KB

                                          MD5

                                          75a03e5b86b68478d5526483b6ef2b34

                                          SHA1

                                          269153c239b2b9a68c83defd19cd1bcb588ee699

                                          SHA256

                                          f2387b146c1c7665ee2b112c21f94db935b24df4891491af51c9685766bc46e3

                                          SHA512

                                          2d659c7afb38c44b7e54b298b1739090611566886b376b93644953aeadfa120887a94d1f84feff951754de7240dff60797112efa33c9ce34f806d79375a35cb7

                                          Download Submit

                                        • C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\Crashpad\settings.dat
                                          Filesize

                                          40B

                                          MD5

                                          2424426166f41cb0889b4770b08a483c

                                          SHA1

                                          adc87ad6d1ec78190759dc0303460c8829989552

                                          SHA256

                                          9da1617e50742e45261956891079138c9f247c70eb17ff0e02b9e9035210ed54

                                          SHA512

                                          0fa33e42d36923efe6eb0175f2ae44652fa3d6549c80e47193dd8c2b2746c081da05eeae34f9e2c6599d3dc8b4c6266b88c1817c18e0c7e6457bfb8a51e3aa4a

                                          Download Submit

                                        • C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\hc
                                          Filesize

                                          452B

                                          MD5

                                          630d12095092ee11bc82a1d44515ceea

                                          SHA1

                                          289a7ebdc7cc80ccc51536bf7d05d0946b84e3c4

                                          SHA256

                                          d1a3ae6c18ba8fdec2b00e8876c48397dc6f916d5ec3b42d2aab30f185ea39c4

                                          SHA512

                                          ae4074af790641c20ae47a76b75230eec5660a132093267a47ebeedad17e8012d67ee00668ecbaa91349d539c3a677adf6dfac980b38441e62529676634d7bf8

                                          Download Submit

                                        • C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\hc
                                          Filesize

                                          836B

                                          MD5

                                          1ace394765e8f43da067893654753c07

                                          SHA1

                                          1af001fc3a5280bdc035bd593f69942fa6b5187c

                                          SHA256

                                          2df1de59f12720efb3180a31c7e4becb57f0cccddd96a206353bee33c398fecc

                                          SHA512

                                          4fe898e67c7ac4aaa8af80e8adc0402ba0daaa2692516ca841900cfd3fe38ce2713b66891d707ee5fb254082f8736f1a7a5b39064067d4daa3794abae7c1027d

                                          Download Submit

                                        • C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\stdb\evt\CURRENT
                                          Filesize

                                          16B

                                          MD5

                                          6752a1d65b201c13b62ea44016eb221f

                                          SHA1

                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                          SHA256

                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                          SHA512

                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                          Download Submit

                                        • C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\stdb\req\CURRENT
                                          Filesize

                                          16B

                                          MD5

                                          46295cac801e5d4857d09837238a6394

                                          SHA1

                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                          SHA256

                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                          SHA512

                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                          Download Submit

                                        • C:\Program Files\QuarkUpdater\QuarkUpdater\1.0.0.6\stdb\req\CURRENT
                                          Filesize

                                          16B

                                          MD5

                                          206702161f94c5cd39fadd03f4014d98

                                          SHA1

                                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                          SHA256

                                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                          SHA512

                                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                          Download Submit

                                        • C:\Program Files\QuarkUpdater\QuarkUpdater\prefs.json
                                          Filesize

                                          332B

                                          MD5

                                          c7a982d2aa6a379358f275e58e975be6

                                          SHA1

                                          3fda6be201c24d39a40dd66f4d4b0a32168921b8

                                          SHA256

                                          fef4279f3ffb1b5a80653b462f856c9b763e6eb280a2cf40144118b36f6f6265

                                          SHA512

                                          f507dcb10df86c3fd889d132baf2f3603c6db13cbce32d198e1048d67c5e3339de71c1817479e41a8ffc6ddc713d3d0a95009848a1d0dcd268515539bc099d7e

                                          Download Submit

                                        • C:\Program Files\QuarkUpdater\QuarkUpdater\prefs.json
                                          Filesize

                                          626B

                                          MD5

                                          950afd062bb8ccbdfa1f2f4a69c90c82

                                          SHA1

                                          1755e34c07e75b63f9685900ea603e55137e0af1

                                          SHA256

                                          b3e82bb76547e1db36041a08c1fe1be36d6889b64ca4a4896f6f63e6fdce2222

                                          SHA512

                                          e99f695a82acbd274a0187651a95b5c42148f8695dd155c25ee9bb84d508c065341ef0c5b5d76684430cc464aa8a35e3b381565f71cdd8f6bc51860731dd3069

                                          Download Submit

                                        • C:\Program Files\QuarkUpdater\QuarkUpdater\prefs.json
                                          Filesize

                                          314B

                                          MD5

                                          94aeb46fcc3fe9e3e3434cd3b306b48a

                                          SHA1

                                          731594178bcccbb354ecc37a47bdbe2969f922cc

                                          SHA256

                                          6dcb1e1ec866873a4db18d9a9b0c304d30098f78933e29b2435c44ec585ce2ca

                                          SHA512

                                          ac993382d18433d9fb4365cd81888fb3f7bf854d9da282c9e958cf42b643bf54c07d994ee53ce8aa61d73722a26aea33059d9537a143fe2926d8bf55600baf0e

                                          Download Submit

                                        • C:\Program Files\QuarkUpdater\QuarkUpdater\prefs.json
                                          Filesize

                                          594B

                                          MD5

                                          b48957660cc75c8cbf9dc2472e96f20b

                                          SHA1

                                          1daa512f6821eab13a239a7c3a2fd23648746410

                                          SHA256

                                          3581fcfdd5e6861affe7a525cb8dfde7407f74ee223a492564b3c30b2e88421a

                                          SHA512

                                          55ac239ce8ab78871bf7dd204fb0d17b061a7ccdab89abe078685676debe3700ade2e9da9737e396baa0c9ff8915bda93cd742606d904f22f112c6afa4df5d78

                                          Download Submit

                                        • C:\Program Files\Quark\1.9.0.151\Installer\QuarkUpdaterSetup.exe
                                          Filesize

                                          13.9MB

                                          MD5

                                          56dde3c70854d14d2cd66af0f4de1b3e

                                          SHA1

                                          74a1f753a7d4916b070f5c4dd198334d90af4714

                                          SHA256

                                          4d1a0171e7f4b18c864282c5a9ea8077777f1a46330df9511f3922ea83de0c96

                                          SHA512

                                          c78f23cd1b316635fe5e6dbd7120a2fb91966ccc6e6cb97bea4e7f8745e32947b6ba95ae4f635fd1aff7d82e15aa9678910b7b1da9a18293af79cd869034fa8f

                                          Download Submit

                                        • C:\Program Files\Quark\1.9.0.151\quark_elf.dll
                                          Filesize

                                          2.1MB

                                          MD5

                                          50e1cc38762d502decede80c35ebf5c0

                                          SHA1

                                          5a39045e8549dbb718a57e9fc9c8c7bcd786b24d

                                          SHA256

                                          0a601fc23a329de771ed22c81006fd60d90193b430d91d5a8b67d6074116d38a

                                          SHA512

                                          391c30fcd389dee627edf0f8b0efde47926451868d07929fff3538e494ec371bc5c4a7b8ee4b6e38f41b2975f29bc4b8f94669c2c11b9a4043fad1c975d76011

                                          Download Submit

                                        • C:\Program Files\Quark\quark.exe
                                          Filesize

                                          6.1MB

                                          MD5

                                          596161d315f0d702c9a978f3d55b27eb

                                          SHA1

                                          7d4ae091643af968656438d578777fe974509ead

                                          SHA256

                                          3fe472c2dcd795ca4b96927e7a93280f646f0fcecd67e6f3c8baaa166272d287

                                          SHA512

                                          aab235af3dd4bf426f5ca43790b050d7f56ddc20365539a9dffa0421b97f79eb80959b1ee270548e62b30a98aec39cdc9a860d8ba4acf3169389c265c497a586

                                          Download Submit

                                        • C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping4716_1402420648\manifest.json
                                          Filesize

                                          85B

                                          MD5

                                          084e339c0c9fe898102815eac9a7cdea

                                          SHA1

                                          6abf7eaaa407d2eab8706361e5a2e5f776d6c644

                                          SHA256

                                          52cd62f4ac1f9e7d7c4944ee111f84a42337d16d5de7be296e945146d6d7dc15

                                          SHA512

                                          0b67a89f3ebff6fec3796f481ec2afbac233cf64fdc618ec6ba1c12ae125f28b27ee09e8cd0fadb8f6c8785c83929ea6f751e0ddf592dd072ab2cf439bd28534

                                          Download Submit

                                        • C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping4716_1663886892\hyph-as.hyb
                                          Filesize

                                          703B

                                          MD5

                                          8961fdd3db036dd43002659a4e4a7365

                                          SHA1

                                          7b2fa321d50d5417e6c8d48145e86d15b7ff8321

                                          SHA256

                                          c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

                                          SHA512

                                          531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

                                          Download Submit

                                        • C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping4716_1663886892\hyph-hi.hyb
                                          Filesize

                                          687B

                                          MD5

                                          0807cf29fc4c5d7d87c1689eb2e0baaa

                                          SHA1

                                          d0914fb069469d47a36d339ca70164253fccf022

                                          SHA256

                                          f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

                                          SHA512

                                          5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

                                          Download Submit

                                        • C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping4716_1663886892\hyph-nb.hyb
                                          Filesize

                                          141KB

                                          MD5

                                          677edd1a17d50f0bd11783f58725d0e7

                                          SHA1

                                          98fedc5862c78f3b03daed1ff9efbe5e31c205ee

                                          SHA256

                                          c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

                                          SHA512

                                          c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

                                          Download Submit

                                        • C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping4716_1663886892\manifest.json
                                          Filesize

                                          82B

                                          MD5

                                          2617c38bed67a4190fc499142b6f2867

                                          SHA1

                                          a37f0251cd6be0a6983d9a04193b773f86d31da1

                                          SHA256

                                          d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

                                          SHA512

                                          b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

                                          Download Submit

                                        • C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping4716_1763550563\manifest.json
                                          Filesize

                                          114B

                                          MD5

                                          3ee731d0e5bfb74cacb3d9e2dfdc7768

                                          SHA1

                                          ee15cb60213bb402fd90308f0f67d7b6160c9751

                                          SHA256

                                          5dbf79f09d999ea982d90df45eb444ebf66a0c700e51d4c9856afbe7326e9d69

                                          SHA512

                                          f38e3fedd392f9b273565cbe321a56051edaf48db75a0ebb539d57e8d1238d4bac41e973f037395f9c5d4a189df5e68726ed2c000134fc36bb7e7295c9a779c1

                                          Download Submit

                                        • C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping4716_244917570\LICENSE
                                          Filesize

                                          1KB

                                          MD5

                                          ee002cb9e51bb8dfa89640a406a1090a

                                          SHA1

                                          49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

                                          SHA256

                                          3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

                                          SHA512

                                          d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

                                          Download Submit

                                        • C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping4716_244917570\manifest.json
                                          Filesize

                                          80B

                                          MD5

                                          077da41a01dde0173ebbf70d3b7210e2

                                          SHA1

                                          4b3c3deeb9522ca4ef4e42efcf63b2674f6a5c07

                                          SHA256

                                          23bed5c8ebea0c376483374bad7baf633a7e52f3e0a609371c518e06e645bda0

                                          SHA512

                                          2822d02e2b3c6306e6d71fa62e7f472b4c3cdf0cbe499b70ac60a0a50e547ed47c394d7de88bbef2e6015920442b9d30cbc0d6869d154e02ec251712f918deec

                                          Download Submit

                                        • C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping4716_315645126\manifest.json
                                          Filesize

                                          300B

                                          MD5

                                          01f3de10093b3b262105724e85817fa6

                                          SHA1

                                          97dee66ece41b53a27cbd4579f44c204e35d19d6

                                          SHA256

                                          be1b2d4b5880584961c46ec8ed276b6ee43ea595da56720268e05bd3d5c95340

                                          SHA512

                                          9646b13e23c4214bcc45715fbc60eb9afb29f934d5d33b3471ee89a6f399a68d83b5bdff14748f73ce6a7c2c9fdce782a4ce849f855a900514636b529e9b400f

                                          Download Submit

                                        • C:\Users\Admin\01B31047-436D-409B-B973-00002FA31E8C\MSVCP140.dll
                                          Filesize

                                          613KB

                                          MD5

                                          c1b066f9e3e2f3a6785161a8c7e0346a

                                          SHA1

                                          8b3b943e79c40bc81fdac1e038a276d034bbe812

                                          SHA256

                                          99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd

                                          SHA512

                                          36f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728

                                          Download Submit

                                        • C:\Users\Admin\01B31047-436D-409B-B973-00002FA31E8C\VCRUNTIME140.dll
                                          Filesize

                                          116KB

                                          MD5

                                          e9b690fbe5c4b96871214379659dd928

                                          SHA1

                                          c199a4beac341abc218257080b741ada0fadecaf

                                          SHA256

                                          a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8

                                          SHA512

                                          00cf9b22af6ebbc20d1b9c22fc4261394b7d98ccad4823abc5ca6fdac537b43a00db5b3829c304a85738be5107927c0761c8276d6cb7f80e90f0a2c991dbcd8c

                                          Download Submit

                                        • C:\Users\Admin\01B31047-436D-409B-B973-00002FA31E8C\aut.png
                                          Filesize

                                          1.2MB

                                          MD5

                                          0b846c766cf68e97186768f90a6f1dc3

                                          SHA1

                                          4eb4d6e71010a6271b0069b987810af309cc435c

                                          SHA256

                                          938612173627510e1de7307f0b43aab14a68db2431cd20a5146ddab5f51fe162

                                          SHA512

                                          211dfdd38f4dca38bafde4de0b0f6ddd2a059f9227ee0e383b732be053cf7f463c472bd6a73ced6515478d45c504b47efc590fb49aade24d4020542c21e08957

                                          Download Submit

                                        • C:\Users\Admin\01B31047-436D-409B-B973-00002FA31E8C\down.exe
                                          Filesize

                                          2.1MB

                                          MD5

                                          f336e647ce054d13fd1e42cc21863964

                                          SHA1

                                          25add856849dbf8fd97184a4419a9e4b4da8cf99

                                          SHA256

                                          cf9cf2b8584c3b38d345f4aa681f3a381d017f2f54690813937a9a7b77388080

                                          SHA512

                                          24b8597ba42eea158452dd6b8873ed585dd5a168d40fb3a7380a34af81534ba70aeb1b728e0fda971f8654c8ca0416655d3f8a2299d74fb57e79430d59f7a47b

                                          Download Submit

                                        • C:\Users\Admin\01B31047-436D-409B-B973-00002FA31E8C\vcruntime140_1.dll
                                          Filesize

                                          48KB

                                          MD5

                                          eb49c1d33b41eb49dfed58aafa9b9a8f

                                          SHA1

                                          61786eb9f3f996d85a5f5eea4c555093dd0daab6

                                          SHA256

                                          6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e

                                          SHA512

                                          d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6

                                          Download Submit

                                        • C:\Users\Admin\01B31047-436D-409B-B973-00002FA31E8C\view.png
                                          Filesize

                                          656KB

                                          MD5

                                          c7fcb87d72e42e2afea521eefc18c307

                                          SHA1

                                          aebf2826d9eb14bf7321292b11771f5b6d00f46f

                                          SHA256

                                          4f6df300a860f9b40099817f1390d9bd777e63ff6cbf17199d0dd58f871c4bea

                                          SHA512

                                          713eb6069dc2e805c66106112554b39751ca7ec3f8344cfa7cc1e681fe15a0de6ecbd5d78a391c1e12e796eb9f2e135aa9c024b96d12a17bb918de83390c47c4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Programs\Common\Quark\quarkshellext_20241031183131.dll
                                          Filesize

                                          588KB

                                          MD5

                                          8cabdbed684fd3a173ab5f49836742a5

                                          SHA1

                                          3c488e132fe1585023264cb966d8bdf09d3cbfcf

                                          SHA256

                                          6edc358490c5d4ea6e2213e6b079d18fe8f8be32db1843ca17feb6373f017313

                                          SHA512

                                          dee12456054f9659e2cc2a0ef83e421ed5bab142331ccfacb7ee2d326d249a69de7bd19200470a29c9bbd03696a9802970e0b498d574437095a0336d248939a0

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Programs\Common\xdrive.node
                                          Filesize

                                          2.3MB

                                          MD5

                                          ebbfe9365f58738bfc21f49d21ceba63

                                          SHA1

                                          f976fa0657d0c21f6c82c264d44e7bc94c804853

                                          SHA256

                                          229ebec17a4fe928c1fdf29c5e6d63d7c47a8645f24df9c593009387cb11beb1

                                          SHA512

                                          19870a3bb6dde7c0e09bb44df146da3389e8b1dd61aeb12ff5750ab8133b680e829bbd4d4f4655b595cfaa0884cdf5a5088e492e80865da8c0ad71f3aed8899d

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\2f3c38ee-2890-4830-9281-c43f0dd84d51.tmp
                                          Filesize

                                          59KB

                                          MD5

                                          1c401a151e6d330e2bf6e292da32e059

                                          SHA1

                                          003ab73426e5c01675d3e2fdc091b6d058bc6c51

                                          SHA256

                                          85810a6b32eddf72bcaef636d023d2be7f791a971f24c1290f7810a2526d0283

                                          SHA512

                                          ab0820715fc319d87a19f37b5c4ca93aeef852fddeb65e9fac40da33a086f9589ed51563f94631ca2c40eb86ac3978478f0d07be026782e38f927a921b6a7e3c

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\578d656a-782c-45f3-b402-cf6dfd204835.tmp
                                          Filesize

                                          187KB

                                          MD5

                                          c20fa6784b1b6c1395e6e5329da6e663

                                          SHA1

                                          47de380e798d1e34bab14ecfe47363c7a7c4e7a8

                                          SHA256

                                          ff7b0837a9fff093d7be023e3ae2207660a27bf9d2ccc403342cdfd2504baaf4

                                          SHA512

                                          acaac91ba574a7635c90cb423c574999c7da28b80444e7ebc66eb40f0796a97a34ceed690929ff9b3ce8600e091644070f6e5f91b0bac1203feb5360df0bf62f

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\Cache\Cache_Data\data_0
                                          Filesize

                                          44KB

                                          MD5

                                          d981bbbf68c8bf538d4f2e014bc8ca97

                                          SHA1

                                          f6165fcd58ebd6aec79e5d5d9d2b7de728a8cb14

                                          SHA256

                                          0f5c6b610414a3ba12d45a8400a73d5fc2354e8a33cdc43b8948a69d8ac61545

                                          SHA512

                                          629d337cceaf82344326980b7dc2226e2b652dd617b272c2505c34d537e67d2430a58b61c76a7b19567b0637c7dc02d5feabaf80f208f042c9e8ab03048845c4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\Cache\Cache_Data\data_1
                                          Filesize

                                          264KB

                                          MD5

                                          af1a5e023fa9cde3a097f839155296ad

                                          SHA1

                                          bf01242f97864edfa1b30a645b21bd16826114ec

                                          SHA256

                                          a62c831ac8de840f9b6aea6469a8cf6b542ca8a89e9a384dc16853247e267e98

                                          SHA512

                                          e24f50b57a191bb570cba3635c2bda67871dad9d6a8529d8ee08de29619a262b294f8e8102a694fafcac585519bc1411cc65fa5172d0c240c3f4b05bbf348d59

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\Cache\Cache_Data\data_2
                                          Filesize

                                          8KB

                                          MD5

                                          0962291d6d367570bee5454721c17e11

                                          SHA1

                                          59d10a893ef321a706a9255176761366115bedcb

                                          SHA256

                                          ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                          SHA512

                                          f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\Cache\Cache_Data\data_3
                                          Filesize

                                          8KB

                                          MD5

                                          41876349cb12d6db992f1309f22df3f0

                                          SHA1

                                          5cf26b3420fc0302cd0a71e8d029739b8765be27

                                          SHA256

                                          e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                          SHA512

                                          e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\Code Cache\js\index-dir\temp-index
                                          Filesize

                                          48B

                                          MD5

                                          63dcd8b7f2001b41c0674686bdbdbb43

                                          SHA1

                                          138178330fd68d484bdb250d418640b6ba1e4507

                                          SHA256

                                          9f0a0dc76db7b00fe8a68f5b66a27afb7fe7e7c718b28f71afcc119f306544fc

                                          SHA512

                                          21031ac68e4dd6eff9ec845f3d5d8adff03d3ffedfd0fe3a8f7cce798dd1e613db2e343ee91502a3e454462731d8f68597a7a7957f501e2449086110beee0fcd

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\Code Cache\webui_js\index-dir\the-real-index
                                          Filesize

                                          336B

                                          MD5

                                          5ac70869f25d95160b7da2996b699e54

                                          SHA1

                                          35c03bbd9c1a8ca7fcce139a8d06194911d10446

                                          SHA256

                                          69e0afe6ea318d6b3f5c4c97bb86eb6563fd39e311c841fb9b8a612d705ff362

                                          SHA512

                                          cf3cca23a35017c1ff95f10b04e01f6d7667856d968561be5c5d3561cac5fbccbc577f57f326ff6fcd8c1bba3cf53141819cd97f302978069620d72ac2df619f

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\Preferences
                                          Filesize

                                          5KB

                                          MD5

                                          e97fe4a87a867934ce4ebe8853f57be3

                                          SHA1

                                          ca5976f84b9bba88cf3c7d5c63c226d7db5ee4a1

                                          SHA256

                                          30ef3d0d23f8840e82df7597fd4a66ccb5feb5ea7f25eadb641930f14e3f3455

                                          SHA512

                                          d142d584c181049a2932bb82b1cc05142b913b503b335c9f454803e1c616038482f03a802f6c93ee6cff247510303f3177b0a49ff268c1c1b3414fcf593a90ce

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\Preferences
                                          Filesize

                                          5KB

                                          MD5

                                          82b82c3ad8aa8831cb47efbc783770d5

                                          SHA1

                                          46570a5dd19fa61d0a9e0f90c50d26b44da56fe5

                                          SHA256

                                          5b72c83fadab0ad1f3a2e753a991afb9b9a1ebe5ba0eb6a8958bba7c20b6a8cc

                                          SHA512

                                          0c2fdc3b8985c4511ec13001216e5f9146b78551c2ea76ff73fb278e67bb39dfe7088e055587d87ad3ff3ab382e6cd04ea3820a5277e8cf287bef2ec758c51fa

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\Preferences
                                          Filesize

                                          5KB

                                          MD5

                                          00f75c86bb2d5493af4c8ab319b5f6f8

                                          SHA1

                                          4bb6b9bf65f889abb24846e063969a8b1352a299

                                          SHA256

                                          1a9d0ad30a41522b8c310c8dccc156cfe9b61fb80c31490e1aad62e9081f2c6e

                                          SHA512

                                          b21ba87aceffb76e3fb4b758db0189dcfd4c9bb17e0b4283f5a29fffaee329a3eab98f5c054a3d86caf37a652b12ecc4db5092652c4f1a167004d51172d3b040

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\Preferences~RFe597258.TMP
                                          Filesize

                                          5KB

                                          MD5

                                          65711f109b1eb1e84e1e98d5091fe947

                                          SHA1

                                          d7738d0f9638be12646cbb627d0400398b054ddf

                                          SHA256

                                          cfcc52a2ffda97d2ed462de7efd8ff4e72cefd9b31fc7809b88778c63b4abb23

                                          SHA512

                                          f24e052d79417d55e8b2a79c546f61b4dbd39bfe2f50c48e62b97be31c851c2a77fb8a84a8e6a6000dce3854ffaec3d7c5e9d38bd92fc19815fc2ea1186fe8d8

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                          Filesize

                                          96B

                                          MD5

                                          eacdc5a17d20a1092c692f8310ad3c85

                                          SHA1

                                          2c073b6c3b8b6d4fcb753bcb8c15af6deeccdf90

                                          SHA256

                                          3464b24e2a1717842ca44783ab4235d614a96f616aa636c36506ba7cb582f1a4

                                          SHA512

                                          74f1d5bfa9a4332469efa76447a3e44573534a34fedad9239eb0c63202bc2b040cc349a937d5d1c4f5d5bae334d787999948634233574a3d384b983c19f446fc

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59ad3e.TMP
                                          Filesize

                                          72B

                                          MD5

                                          38cb3a9979ed14255f546bc4b18c8161

                                          SHA1

                                          a73000021ea2923e38af5de44bffacbe4a60327b

                                          SHA256

                                          8ab580f36498f4a08ca2a809610a584b370db120c70966501db1c1771b81ac77

                                          SHA512

                                          6ddd18cb933c9d97386f713cf74434962a6347e89711a3464c5560a3c64b89e535b94783f97c503969538faa80f15734f573ef184f09ea0b0e22fd81f82a9210

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\Site Characteristics Database\MANIFEST-000001
                                          Filesize

                                          41B

                                          MD5

                                          5af87dfd673ba2115e2fcf5cfdb727ab

                                          SHA1

                                          d5b5bbf396dc291274584ef71f444f420b6056f1

                                          SHA256

                                          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                          SHA512

                                          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Default\a30024d2-bdf1-44bd-91bf-45846e2f999d.tmp
                                          Filesize

                                          20KB

                                          MD5

                                          ed5831ec46f4ddc2f39a56e237d8ea4a

                                          SHA1

                                          221736402ce68d0d673825a68d6f03d7b94bb7c8

                                          SHA256

                                          2e43c8487c826d50d0936a748a843b80e0b7e349d31065c193884e1e2e10c2d6

                                          SHA512

                                          51ef41a9c11b9215b1110557085c0c8894f430fe35f6702a55b23ed309363b436ce75935356ba1f121b0b227863a85b794b7df9886d21df4027aac0250c79a8f

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\EfsReports\.e80ffe33\.95c2fa37\.61863cb7\2864\.1`pctrace`1731940831058638100`none`1
                                          Filesize

                                          101KB

                                          MD5

                                          2a5fe64faf4a33ad3346a51f1a4cde93

                                          SHA1

                                          91a742dddeebf77c9511b80de5d4d904715bef60

                                          SHA256

                                          71a36f4f7bf75eddd22a847101a9bf665776f5229a9d2ee2d0015f3429a4ca51

                                          SHA512

                                          0cd9c516fee628f61470344879770ef4807021c9ddd4a76fc2ca36759af68c12a87d829578cb73cffffd21b7921a17b806d993bd8e15e72b83bda3abfdd4dfd3

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\EfsReports\.e80ffe33\.95c2fa37\.61863cb7\2864\.1`pctrace`1731940831076009400`none`1
                                          Filesize

                                          18KB

                                          MD5

                                          e323701d97f7ff32804988b9563e7c4b

                                          SHA1

                                          8b11ee3fe0c1551de8df90ab915d21662404eeec

                                          SHA256

                                          3c05ec654536054264428c083550b3ca6dd5be66b825f7b97790756f62f908ed

                                          SHA512

                                          9669e4b8b40fe61f3a0b96eb6f02e1e6d4cb787e8f3bc9656305c1245d2d32e2cd953b0ab48c412b50066d72cc73f4cf7128fcf4c9a5aaaf25ad836a65df6a1b

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Local State
                                          Filesize

                                          4KB

                                          MD5

                                          cab45a16231b441eb6bfa1da58f10d6f

                                          SHA1

                                          d3d04ef5ca55660e2c0e5649530e9026936d61af

                                          SHA256

                                          e23b6d7329176f5252d716ae25dc347c6effc7aa89a5d56f4cb1257f2e26fb04

                                          SHA512

                                          d8109cd53ce374e50a2dd9823a2ed1b9ffad9b8e16416a425dbbc0a00633833aca59e167ec2041a01eb86093adada661b43daada93b0e519c5487eb80ad1f735

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Local State
                                          Filesize

                                          59KB

                                          MD5

                                          552d22784707acef4d81f0f9c57193ae

                                          SHA1

                                          05b485343a5c12ebe1e29e7507addf93d13cd835

                                          SHA256

                                          a56c66eada95933adef848400f1de9f931cb902c9e5bcccfeed1e116199518e5

                                          SHA512

                                          db8fa7dddbc4a5f85ca24b2983ce717d2798dd80d30a5815bb726891790c1b4c3027042fc159eb18dbda8f28284bd325cd3c7fb21475913a1b6dd1a69d106052

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Local State
                                          Filesize

                                          7KB

                                          MD5

                                          69ca47cd3736832226465fea65640692

                                          SHA1

                                          afb01148e454bd6ef51a367977bd7a705508cdb3

                                          SHA256

                                          63255ec90c5978622f30de7e9ef2a93771991c46eb1dd4936011126fc21d149a

                                          SHA512

                                          3037eda06afd55db837c96fbc4eb7c7235d37aaf40ce81cfd0dd5adb39f5a2d4fc980f1a6768673b51f6265980f7da6148559b986c1bd2142906f19ac0b1252e

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Local State
                                          Filesize

                                          4KB

                                          MD5

                                          01185680ef8ab60c362dd215d6222f37

                                          SHA1

                                          fd368ebe9a692f54534ffa524cd2344f9deca349

                                          SHA256

                                          52fb016034f6b3f6ceebf0267a26168823b237c34dda35cb59991d349c68f895

                                          SHA512

                                          e23c3a6939bf95755778dabb2a23b6388a744230e5effaa1a267c7b382ddf0bac994165bb2e71706ea1c86985338eabe404f40fc77cd3ba8ea6d2f318c38a6b7

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Local State
                                          Filesize

                                          4KB

                                          MD5

                                          fd96c73659d84e031f21c0502346db6f

                                          SHA1

                                          a3bea93053e11e6156bcdfc07d12e6e621184e1e

                                          SHA256

                                          42009c3b9f43f3b7d99e08e89964a87c82b218ee6821c6a26e4641ad9fb3bd94

                                          SHA512

                                          0ed76c731abc3457b7698d94e7237410a7f563fcb33a7e1cf42a5af5779fbd5eaacacd4346d450d260c4219a8bb4b531ed76dc9e989ebf9ce960da12262f9e33

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Local State
                                          Filesize

                                          59KB

                                          MD5

                                          06e5e87cbe90ea9a0f204982f490048f

                                          SHA1

                                          637a1f1c02dde6e98d3d2b8e63e901b2a207c95b

                                          SHA256

                                          e8568565d12159f7af987a7106d919ddef32f0399dfd38cea9da622431e96643

                                          SHA512

                                          71f0ca6e96ace840e5ee962b6b2ef6c3ef367fb004191c3e9dde23a057f0cc271f1f105787f895f294a3d0c8b19d5fe9445615f362d64cfb1c313a81ab5dae23

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Local State~RFe59478e.TMP
                                          Filesize

                                          1KB

                                          MD5

                                          e85314b49a19d0f38bfa94eb7a1ffb42

                                          SHA1

                                          400499533635c40d939d5992630e0b0f3327165b

                                          SHA256

                                          2dc5ec389b72e5e74a0c53e019cdf043a620c06edb714a089fa678ad12cb9765

                                          SHA512

                                          3de5ea042ab8589590040854cfa0c16e3995814f62e1fd8c9fe2752e167bc2819eb1b668805d1abdf585283b65ba789fcefd2023d965ba93335d7ddaba38ac18

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Module Info Cache
                                          Filesize

                                          124KB

                                          MD5

                                          5041ac5494838d24c156a7e1650acce5

                                          SHA1

                                          419238e3d9100f7a04cba78c9d1eccc8ac67050f

                                          SHA256

                                          693e5cada37aa970e801549a9ee08c37a73dbe6cdb657f69632103c6e03a5e28

                                          SHA512

                                          f4dcf600f8685fcdf3b0d86d3e18bf4f51fc6b1aacc85610aab2d59c342c9e72e9db070139f325ad1dded3423753a49ce3103a85146456a025a4700865708a41

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Module Info Cache
                                          Filesize

                                          125KB

                                          MD5

                                          e1f73710246bc2dec2f04e1fa46d3ba5

                                          SHA1

                                          e5560cbefa2da483ad7392c19e5630c9bacd7ff3

                                          SHA256

                                          3bad0b5927ceed0217b4b9b3eaea6a385255bebdf7bd9d17bea9e8147bb92472

                                          SHA512

                                          0880bf28b2dbb5184b4760a8845afe40beeac77c0aa735a9bf961ae3d086e172ac7d3ed13767357274c4dcd70b5ebbc6bca66e61b6e76c3aea19a52c95f81a58

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Module Info Cache~RFe59c1df.TMP
                                          Filesize

                                          123KB

                                          MD5

                                          54e4f9605ff1e0f522a7c709ca915521

                                          SHA1

                                          ed1f0f62d74b5651f211b7a5d74d213b71fb8e4f

                                          SHA256

                                          98f60e54759b91a50c3dc8b53a685bfc4dfea7eadb22895ba658ecc1a5466323

                                          SHA512

                                          0fe128a4a504cc2a6c2a8375cc5a9749cb5bbe09b1a35ab5a3e070e505408c85b4f5c5406f87784213fcb001df8115b399868d9d1a6daa6126b87ad8f69b6a31

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\Subresource Filter\Unindexed Rules\9.52.0\Filtering Rules
                                          Filesize

                                          72KB

                                          MD5

                                          c6af15da82a8a9172fc9cafc969de4f9

                                          SHA1

                                          81f477e181036d551ef6f09cb875c6b280bebe00

                                          SHA256

                                          782009d9765c6104a1b4d1eac553834e7e399d749a082ead42bb47abb42895b5

                                          SHA512

                                          f541cb1703a0bd31fcb6e293acbc6e20f73b365ff8d2270a6d44780e9d5731b8d7803aecacd49d73e0da065dd1026c9fa95f9cad2bf0776ce1e2c3c9fca052c6

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\TrustTokenKeyCommitments\2024.10.11.1\keys.json
                                          Filesize

                                          6KB

                                          MD5

                                          052b398cc49648660aaff778d897c6de

                                          SHA1

                                          d4fdd81f2ee4c8a4572affbfd1830a0c574a8715

                                          SHA256

                                          47ec07ddf9bbd0082b3a2dfea39491090e73a09106945982e395a9f3cb6d88ae

                                          SHA512

                                          ed53d0804a2ef1bc779af76aa39f5eb8ce2edc7f301f365eeaa0cf5a9ab49f2a21a24f52dd0eb07c480078ce2dd03c7fbb088082aea9b7cdd88a6482ae072037

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\b299dd5a-d63f-4f3e-a6ee-530c4179c608.tmp
                                          Filesize

                                          4KB

                                          MD5

                                          2137706586b7060c622be60b5a4bd10a

                                          SHA1

                                          4a57d525f9a8847d7eefbcb79bc872b790a0abe2

                                          SHA256

                                          f125f12afd796bc1c03be43b11e3952f9aeb4e649ac3232c43a4b73c85082dd9

                                          SHA512

                                          e97fcfdfb3cd75cdd9dec7fecf22e6df0e5a0f03252d6b89a812851cab5d6c578f5a86585ed764f7946d079563a302368190583ee4f913c5393ebf6517786f0a

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\unet\hc
                                          Filesize

                                          4KB

                                          MD5

                                          ec052e0ef9a8402fa924b2a8b027505f

                                          SHA1

                                          aefa379f16cdf52ab2e49d4ba373dfc4e893fa73

                                          SHA256

                                          dc4ad146d70984a1214b448ea709dfcaf924c02c4dc7759981d30d8019b4b3b6

                                          SHA512

                                          f1500b1a06073ba71261091ab91f8c347a355af939c77338615164f184d797bf4dd682fbab5a654ae6b8cd505227495348ecc110f07095fddba6649b27476cf8

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Quark\User Data\unet\hc~RFe5abaa6.TMP
                                          Filesize

                                          260B

                                          MD5

                                          b84da03804e76b7ecf7e6697da7cfdf4

                                          SHA1

                                          5ffb507985298be31a9e36bf0f227f21e82d27d9

                                          SHA256

                                          d0a404848fc3985e2dfcd49c709eeb6bc6c3316e859c1c668a62cf0c5dd27f98

                                          SHA512

                                          9a74a5c1b3926437a2a89bb98333e1291bb95a8a0dbf8b6b0dc8fce6d648eccec64bb5149157d03c7bfec55ebb029917bb10de22b01eaa67b746a7bb38fc1bd3

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\MSIEB98.tmp
                                          Filesize

                                          557KB

                                          MD5

                                          db7612f0fd6408d664185cfc81bef0cb

                                          SHA1

                                          19a6334ec00365b4f4e57d387ed885b32aa7c9aa

                                          SHA256

                                          e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240

                                          SHA512

                                          25e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\RegWorkshop.ini
                                          Filesize

                                          2KB

                                          MD5

                                          ff0c7c2667dff4f3ed588f40d047c642

                                          SHA1

                                          1162c83bd0bb0d81b7ab7f616cb012b790aa4adf

                                          SHA256

                                          02af5cb061fd8075e9475c45ab20e86cf2bb4ca9511ddad348645ed5183b9fc7

                                          SHA512

                                          539b1d443232758b6c60a287f2a40200e6e3ba7353f11f18e29ba265c9569a4610e4a80910f79660368a916576ab9c486efa248bf3257e522ef5bfb3d42ef3c3

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-52D2M.tmp\QuarkPC_V1.9.0.151_pc_pf30002.tmp
                                          Filesize

                                          3.4MB

                                          MD5

                                          fbfd322c7e5cb761804964de560c0a2a

                                          SHA1

                                          fabfa92c011b2414feb3b6e3834675918821d29a

                                          SHA256

                                          d4014646153b10b3142be99366e4aa0c7097304dc9daffb505ffae7580d1efa0

                                          SHA512

                                          562424295999d52358f42590158545f51799f91dd323a2201a25e7d03ab7003efe398d07f7ba831d4ff7ac44ce091b1acc410ba02626e1881b7f7b8a3293ece0

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\background_welcome.png
                                          Filesize

                                          87KB

                                          MD5

                                          67ad03a5210049b0642c7a8bc0187a8c

                                          SHA1

                                          2c53b3894eb817249783fe88c12b8a30682eef38

                                          SHA256

                                          56346ca9f09f5601a05c7630e98538cece3ba2938c2fee3d1d033f5464cb7066

                                          SHA512

                                          aa02546d96b97224a3e0feca07855f60c4b229ff41748dca17ebef102945246ec1ace5234c13457c84c860ef452f7bf899eaf94a855833f9a5d26bca5c439955

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\botva2.dll
                                          Filesize

                                          37KB

                                          MD5

                                          67965a5957a61867d661f05ae1f4773e

                                          SHA1

                                          f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

                                          SHA256

                                          450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

                                          SHA512

                                          c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\button_close.png
                                          Filesize

                                          304B

                                          MD5

                                          b7f933ca07ab9728c1e7fdadba09b2db

                                          SHA1

                                          3f30a7f8d248d9ab633593d36cbaea039453c3ef

                                          SHA256

                                          5c9bf11674e9516ddc981bc4f8b17c73d644d14de6f25c2508ada90f144ae7d9

                                          SHA512

                                          fd8e62cd7066b314731fd59196d9eb09e58e461cce99297735d425943dcf3cdcc9b5c61668334ae49514239ca1fd05812f693a51d0a9f93ec3beb9d8fefd1048

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\button_install.png
                                          Filesize

                                          5KB

                                          MD5

                                          74657912da7a28747e355a5b5cbe92a5

                                          SHA1

                                          e54a98e339155b251e78a07110975a780c80bb47

                                          SHA256

                                          c7bce090573671491e5069e08c16eec9a7c5172352fbef56daf3267a84326f78

                                          SHA512

                                          1c02d5911947fd62d86e2691032530b357b78a52a5608b5a19257b75bce0af6265067cfc363c289c7b6cdfb70475ca57dbb13fee368e1847e6fde6910a4af15b

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\button_minimize.png
                                          Filesize

                                          155B

                                          MD5

                                          260f371a446b8ea2b11ee9ffc77ddde7

                                          SHA1

                                          8cf052827edfdfd1f98e69081e4bc29911ed709b

                                          SHA256

                                          9b01beef87d2f7775002a8142e8dd6fd8a1170f1b123c664529415d3b14f0d82

                                          SHA512

                                          59ee54c985392f997a0874e92ae22794f3dc82334f3b2a22ea3ca85aa011995d9b6bdf397934933aeaff4ea4fb31769136c8541265035c11ad005372e6db4c2c

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\checkbox.png
                                          Filesize

                                          4KB

                                          MD5

                                          5221a515f97fd72c19f3dbe875f27f50

                                          SHA1

                                          ff9c11e80998f9b81402d607ddd2b7ed202bf635

                                          SHA256

                                          1f5c1a6e78ae2faf6cf2ebef272b16bed000f8f3874acc713d8a84304cd52fd2

                                          SHA512

                                          e20f19265dd367d27eb93a1ac74f2541e316ecd53e92058bf12f94f83a760734601418de7592d6c43322d8e541957caaccfa83a679ecd592a6c4cb8b3489d53a

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\file_icon.png
                                          Filesize

                                          1KB

                                          MD5

                                          3340397e2d044c7de75b5db4c2a38bd4

                                          SHA1

                                          f7e6d708881f92dd0665561372fb0562b70a89dc

                                          SHA256

                                          80bc383f3fe7aa3b8ef75cdeaf7e67d0b46b599d2ca6197b516800c3e8e9fefa

                                          SHA512

                                          4db729e8ede6bb0fce12dacdcb1e43fa73d53c529d4f2321e44da6b6a47cf2313742b113aea21110f1f1a4082d125f8583eeb8542d3204504806660676115bb8

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\progressbar_background.png
                                          Filesize

                                          114B

                                          MD5

                                          9b00d43b506441e0e36b73b59232b70c

                                          SHA1

                                          60f4df0614ef3412069d9071c5602b50ae88ac91

                                          SHA256

                                          c319b74526493047af9540579cbbf23d492e42ccb9b2f617149d0f43f11fcf27

                                          SHA512

                                          d202979e24168efc1d76707dff91a9ca802cd686f78556969c13423da61807b4288adafc2fca6280d08de7e7a4ede2efb0b21aecd341a52c740dce2ca6a2a721

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\progressbar_foreground.png
                                          Filesize

                                          141B

                                          MD5

                                          e8fbfc95f374d35614e6f53b04c80a10

                                          SHA1

                                          1982e89c69e68cdae4074fd976c5df8845d6e485

                                          SHA256

                                          2aab71d17d1d2d10b76ca08ca80269366915a71241bf95fb87f1c4a4d4fc969d

                                          SHA512

                                          fe2b36754eba5b4dbe0f0071f3ba7c2d7d6754baa3e88a83adf07bea4cf7794c44393f9ff0af1487314de37adda4f6e63c4425b29c837dd6a817881f3eeb71bb

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\quark_installer.dll
                                          Filesize

                                          5.3MB

                                          MD5

                                          b31bea725314c3ec2f2ff23e118f5b0a

                                          SHA1

                                          97cd231ab71d677c52a7f6f5a75bfe26c557d2b1

                                          SHA256

                                          e28a8444cb8c0db045826c970ca3923777bb1cc4c1ce726d517c211b4d895f51

                                          SHA512

                                          3f25f24faed1e9ed10f837d735ad238e01aeac9e6bf88536ef1fb93535fa97f7711e2804e6f89d91842361c3fe2dd740b8cc9932c465f034d8ea2019d9a4362d

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\quark_tag_helper.dll
                                          Filesize

                                          892KB

                                          MD5

                                          bd37130928db4f8245d6d604434eae4d

                                          SHA1

                                          c3ab37d4d0051d538f022ccc06b22f0d151e3382

                                          SHA256

                                          5ae84c087fdafabb6ddcb6475b7c0d67e7d370311acad3eb9421b883e9156223

                                          SHA512

                                          9d4148c15375a804db8a5c6e2710854243c60278f45e10e9f7a98fe094d86515b129342ed677fde041f4589f7a890e6bc26fb0ab368cd3df8d3dba7cc6b3cc56

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\slide_pic1.png
                                          Filesize

                                          85KB

                                          MD5

                                          9ad365fbcc11a1ae42802ff37ab836ff

                                          SHA1

                                          ce8baf713eb4d4314f33eeba9f82864ac07bd099

                                          SHA256

                                          c223efa252363b5d1ed4256b46c77b0216beb424ed226f20decece3069d76e3a

                                          SHA512

                                          a1eb96f2c12bbecdd75a91488a2380e79c5fd378436cbd651440933bdaa1aef0fbb4bdaa1eaf75675f69c2a70933e6ec87656641bd8064ac3fea87863f80e93a

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\slide_pic2.png
                                          Filesize

                                          111KB

                                          MD5

                                          25e77dbaaab50721efcdde81187d7eae

                                          SHA1

                                          a0702c1adfce48eef1c8c6e76e68f8d43f4630cd

                                          SHA256

                                          d615fcdcb820c770fdff5980d2cc9998caf4f665a15c2e03e38fb5a6c75e63f7

                                          SHA512

                                          ecaaabee854ad21694ace09a69d9e2220df6e932b9d27e81057335238d30b2540685c8cae57120c827b6ba8c1eb13e0f67d0c2373bc13cc65cfce5225ea80fdd

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\slide_pic3.png
                                          Filesize

                                          88KB

                                          MD5

                                          e758224f31ffb7663030814547f4f809

                                          SHA1

                                          95d1c901348154f072cdb8b7cd610a4eb1528ad4

                                          SHA256

                                          a40645e8846fbdae981eaa55ca7d8a5680c36832dc87ba33c986608e897b3021

                                          SHA512

                                          28eacefbcc8e77b16c1f547b2ce8a2f6227c29f6201fe4036987f6895b24bf256e51c5561b0e57ff76f4efb1d1835b8f7f708908a8f12cd353f1a31b7ab70a20

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\slide_pic4.png
                                          Filesize

                                          128KB

                                          MD5

                                          9cffe028cc27113e168dec08a21fdafc

                                          SHA1

                                          2d18b4eeb007e7a445bbdb89d8d88d5146028ecf

                                          SHA256

                                          443680c7f48421c42018b6bb234bc841856ef90d3c565eed9a4490f68d33eb9e

                                          SHA512

                                          c06cf482f1574e35eacd831681fff0f71692c92505456d846b0c561d817356faa5e3a325819aba9e67b8e886c2e3e034f7f2b7417bf68cb3e4c91693d11526fd

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-JNIQ3.tmp\utdid32.dll
                                          Filesize

                                          2.7MB

                                          MD5

                                          fd44a952cb004915655747725b356f6a

                                          SHA1

                                          a74b55f947f67a908e9af3b61633a91cf0640e3f

                                          SHA256

                                          6c5683782d834e852807fc7a543c93ab4266af7b88bbf63dff78a69fbd4a748b

                                          SHA512

                                          57dfb261fdd19158eb8d417ff8f14fe70a5eec91f5eb588e751d18712451c584090efff4739646267fd481b63ad6fff02abb578577ace06855bbf531ff800b35

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\{00C62CB0-2BE0-43c3-9FF4-1973359A76B0}
                                          Filesize

                                          164B

                                          MD5

                                          81a71f6feec26723958f2364a4f1aefe

                                          SHA1

                                          3d4605cfd771aedb8ba51389074a60e5a38775ad

                                          SHA256

                                          f244b12a1e911c84dcfea45a49885cf48307d2ddc4c1ac7c1aa21bc310bebd80

                                          SHA512

                                          84f9f20e3a381f1c3cafce07bdfeffd77e19bf0007245e95a80a97fa71e16d877e12ec8d57e8a9e60d008e08b38c9fd670f5374a058980f019590ed1dafd59c5

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\{1E0FC6C4-8059-48b3-9DCD-09746A6B3588}
                                          Filesize

                                          196B

                                          MD5

                                          6e56b3e30482a02753201703f20a0cff

                                          SHA1

                                          517e8a398153923e44da2c3b42317c5ae817e0fb

                                          SHA256

                                          2616f3fbd3617a72f48b47973a39c3bd58d260ba4a62cbafd3935a5f14177a1d

                                          SHA512

                                          6a0f6829c9459301cafe75d70dfd531de44248ecd2871c96edb045c9a43571b81236cec91d9e6c0d1104b8c40b5af2f8aeb8b49ca82f7714a09823310019a05c

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\{441DC270-E1AC-4df3-816E-87D874F7859B}.exe
                                          Filesize

                                          1.0MB

                                          MD5

                                          217dc98e219a340cb09915244c992a52

                                          SHA1

                                          a04f101ca7180955d62e4a1aaeccdcca489209da

                                          SHA256

                                          27c8bd76150ddda5b09d6db11f67269cee2eecac345df67f93aab3e3aaabde7c

                                          SHA512

                                          dddc15992533c8c13000163c7dd59b20e2fbdedbf611338c04f6f9209ec1a95d1f93aaeeae2778890214d333320978f5d2554348722ea6c8489320f0ef1c4c85

                                          Download Submit

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\夸克.lnk
                                          Filesize

                                          1KB

                                          MD5

                                          098dd5e79a6cd3d7021a4100adbb8a41

                                          SHA1

                                          5914a745b74233d1f459cf14d3f04e2d2f658db9

                                          SHA256

                                          0babfb613812863cf87ca21896bd595fcaa7af686f948ac36047672c4a2f0a7f

                                          SHA512

                                          c50f861642f716d475c7e6d00ec4a6dad032fc3022d5e46f6d4e914814eaef2f047aa8b188168c4a65a30cc14c078d7679b2849fbb8f254a92e9a0075febab48

                                          Download Submit

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                          Filesize

                                          2B

                                          MD5

                                          f3b25701fe362ec84616a93a45ce9998

                                          SHA1

                                          d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                          SHA256

                                          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                          SHA512

                                          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                          Download Submit

                                        • C:\Windows\Installer\MSI5504.tmp
                                          Filesize

                                          25KB

                                          MD5

                                          81902d13c01fd8a187f3a7f2b72d5dd0

                                          SHA1

                                          0ac01518c5588eb2788730c78f0c581f79cf2ed4

                                          SHA256

                                          eef31e9195cfacde7b4e7eb7384c8178d8811063b375fd4a28ae897cc180c6a6

                                          SHA512

                                          04d6e2e937328477803084e0ef9da2c3636cdc9d34af74e2d1871d7190be21cbb2771ae835175e104e24eccba52add1ba6f58407bfd522ef82b81d76e977f24c

                                          Download Submit

                                        • C:\users\public\documents\all.zip
                                          Filesize

                                          2.6MB

                                          MD5

                                          be34bdeb6982a01cdfe6df3d6e206be6

                                          SHA1

                                          07e98b85ff05ceec5ef4b857da5b8e3e23780d75

                                          SHA256

                                          76ec04644cbad0eeb343ac7bed749654c8709b6491bf157a39a1230b922d68ea

                                          SHA512

                                          daee0be5417f7ee2f7a57781a9422432b6a775b103dbc6d64b8314c02b042ba84a5b64f329829fd2d3714c99315e611c314ee49dcea7142cbcaa9d87108a855a

                                          Download Submit

                                        • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                          Filesize

                                          24.1MB

                                          MD5

                                          44cdd7f78cde103d0e6ee01ebb171939

                                          SHA1

                                          bc96333720914680cf5448938114dd5730c629ab

                                          SHA256

                                          a43cd2d0138fb9662f284a7eb5ff0fac5f564c80982db6731d3c4a016d2aa5a3

                                          SHA512

                                          c155569fa632d01c0acd4614b765ca781cd7ab13aa2da478cea4ed208f593d34ec7abf7410ad5273e7b58191b1960766f1ef6d4f8ff563b302e6543d7922ed3a

                                          Download Submit

                                        • \??\Volume{612d9cf5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f6fc885b-55d2-48ce-96a8-ec6388df4bd8}_OnDiskSnapshotProp
                                          Filesize

                                          6KB

                                          MD5

                                          43f803f47cf51d9c99c72dfe597529a8

                                          SHA1

                                          57bc2685d267fc10f9422e14e2f1127641881aab

                                          SHA256

                                          a147a910a0a7846038454c5d9af8b27bf5c3b13a9aa3f559c5c8b15f84e17d84

                                          SHA512

                                          9a8774be595667625a720c32e179b3b24cf20c01323e0efc86fe33fe2efad09a43d48cba1e611600b009ac30de7ff3530ebf95ff6bd81290ff375f29541c89d9

                                          Download Submit

                                        • memory/2268-239-0x0000020852D60000-0x0000020852DDB000-memory.dmp

                                          Filesize

                                          492KB

                                          Download

                                        • memory/2268-236-0x0000020852D60000-0x0000020852DDB000-memory.dmp

                                          Filesize

                                          492KB

                                          Download

                                        • memory/2268-83-0x0000020852D60000-0x0000020852DDB000-memory.dmp

                                          Filesize

                                          492KB

                                          Download

                                        • memory/2464-524-0x0000000002510000-0x0000000002650000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/2464-494-0x0000000003020000-0x0000000003160000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/2464-421-0x0000000000400000-0x0000000000766000-memory.dmp

                                          Filesize

                                          3.4MB

                                          Download

                                        • memory/2464-607-0x0000000000400000-0x0000000000766000-memory.dmp

                                          Filesize

                                          3.4MB

                                          Download

                                        • memory/2464-1530-0x0000000000400000-0x0000000000766000-memory.dmp

                                          Filesize

                                          3.4MB

                                          Download

                                        • memory/2464-453-0x000000000C170000-0x000000000C17F000-memory.dmp

                                          Filesize

                                          60KB

                                          Download

                                        • memory/2464-489-0x0000000003020000-0x0000000003160000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/2464-479-0x0000000003020000-0x0000000003160000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/2464-469-0x0000000003020000-0x0000000003160000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/2464-499-0x0000000003020000-0x0000000003160000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/2464-1100-0x000000000C170000-0x000000000C17F000-memory.dmp

                                          Filesize

                                          60KB

                                          Download

                                        • memory/2464-464-0x0000000003020000-0x0000000003160000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/2464-1099-0x0000000000400000-0x0000000000766000-memory.dmp

                                          Filesize

                                          3.4MB

                                          Download

                                        • memory/2464-525-0x0000000003020000-0x0000000003160000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/2464-484-0x0000000003020000-0x0000000003160000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/2464-474-0x0000000003020000-0x0000000003160000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/2464-527-0x0000000000400000-0x0000000000766000-memory.dmp

                                          Filesize

                                          3.4MB

                                          Download

                                        • memory/2464-528-0x000000000C170000-0x000000000C17F000-memory.dmp

                                          Filesize

                                          60KB

                                          Download

                                        • memory/4520-1161-0x00007FF891CF0000-0x00007FF891CF1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/4520-1162-0x00007FF891F30000-0x00007FF891F31000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/4656-420-0x0000000000400000-0x0000000000534000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/4656-1531-0x0000000000400000-0x0000000000534000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/4656-247-0x0000000000400000-0x0000000000534000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/5336-2073-0x000001BD931C0000-0x000001BD931C1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/5336-2072-0x000001BD931C0000-0x000001BD931C1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/5336-2074-0x000001BD931C0000-0x000001BD931C1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/5336-2066-0x000001BD931C0000-0x000001BD931C1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/5336-2067-0x000001BD931C0000-0x000001BD931C1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/5336-2065-0x000001BD931C0000-0x000001BD931C1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/5336-2075-0x000001BD931C0000-0x000001BD931C1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/5336-2076-0x000001BD931C0000-0x000001BD931C1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/5336-2077-0x000001BD931C0000-0x000001BD931C1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/5336-2071-0x000001BD931C0000-0x000001BD931C1000-memory.dmp

                                          Filesize

                                          4KB

                                          Download