Analysis
-
max time kernel
1152s -
max time network
1156s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
27-11-2024 01:39
Static task
static1
URLScan task
urlscan1
General
Malware Config
Extracted
quasar
1.4.1
test
10.127.1.151:4782
6ad6d219-14d0-45fc-bc95-cf3c78799528
-
encryption_key
0FA38A3015CB7FF12D0B18A28ADA4A3D2F290B41
-
install_name
Windows Updater.exe
-
log_directory
Logs
-
reconnect_delay
1
-
startup_key
Windows Updater
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1440-2302-0x0000024000570000-0x00000240006A8000-memory.dmp family_quasar behavioral1/memory/1440-2303-0x0000024002460000-0x0000024002476000-memory.dmp family_quasar behavioral1/files/0x0003000000040d22-2710.dat family_quasar behavioral1/memory/5780-2873-0x0000000000DD0000-0x00000000010F4000-memory.dmp family_quasar behavioral1/files/0x0003000000040d23-3456.dat family_quasar behavioral1/memory/2920-3473-0x0000000000590000-0x00000000008B4000-memory.dmp family_quasar -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
screenrec.exeQtWebEngineProcess.exescreenrec.exeQtWebEngineProcess.exeQtWebEngineProcess.exeQtWebEngineProcess.exeQtWebEngineProcess.exeQuasar.exeQtWebEngineProcess.exeWindows Updater.exeQtWebEngineProcess.exeQtWebEngineProcess.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation screenrec.exe Key value queried \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation QtWebEngineProcess.exe Key value queried \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation screenrec.exe Key value queried \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation QtWebEngineProcess.exe Key value queried \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation QtWebEngineProcess.exe Key value queried \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation QtWebEngineProcess.exe Key value queried \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation QtWebEngineProcess.exe Key value queried \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation Quasar.exe Key value queried \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation QtWebEngineProcess.exe Key value queried \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation Windows Updater.exe Key value queried \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation QtWebEngineProcess.exe Key value queried \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation QtWebEngineProcess.exe -
Executes dropped EXE 23 IoCs
Processes:
ScreenRec_webinstall_all.exevcredist_x64.exeSetup.exevc_redist.x64.exevc_redist.x64.exescreenrec.execrashpad_handler.exeQuasar.exeWindows Updater.exeWindows Updater.exeQtWebEngineProcess.exeQtWebEngineProcess.exeWindows Updater.exeWindows Updater.exey7KyUGcH7zQk.exescreenrec.execrashpad_handler.exeQtWebEngineProcess.exeQtWebEngineProcess.exeQtWebEngineProcess.exeQtWebEngineProcess.exeQtWebEngineProcess.exeQtWebEngineProcess.exepid Process 2524 ScreenRec_webinstall_all.exe 5660 vcredist_x64.exe 6000 Setup.exe 1740 vc_redist.x64.exe 1252 vc_redist.x64.exe 4616 screenrec.exe 3192 crashpad_handler.exe 1440 Quasar.exe 5780 Windows Updater.exe 3024 Windows Updater.exe 1952 QtWebEngineProcess.exe 5504 QtWebEngineProcess.exe 3256 Windows Updater.exe 5240 Windows Updater.exe 2920 y7KyUGcH7zQk.exe 5536 screenrec.exe 1388 crashpad_handler.exe 5736 QtWebEngineProcess.exe 112 QtWebEngineProcess.exe 3868 QtWebEngineProcess.exe 6004 QtWebEngineProcess.exe 5712 QtWebEngineProcess.exe 1420 QtWebEngineProcess.exe -
Loads dropped DLL 64 IoCs
Processes:
ScreenRec_webinstall_all.exeSetup.exevc_redist.x64.exescreenrec.execrashpad_handler.exepid Process 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 6000 Setup.exe 6000 Setup.exe 6000 Setup.exe 6000 Setup.exe 6000 Setup.exe 1252 vc_redist.x64.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 3192 crashpad_handler.exe 3192 crashpad_handler.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
Windows Updater.exeScreenRec_webinstall_all.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RAT = "C:\\Users\\Admin\\Pictures\\Windows Updater.exe" Windows Updater.exe Set value (str) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ScreenRec = "C:\\Users\\Admin\\AppData\\Local\\StreamingVideoProvider\\ScreenRec_app\\screenrec.exe" ScreenRec_webinstall_all.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Updater = "\"C:\\Users\\Admin\\Pictures\\Windows Updater.exe\"" Windows Updater.exe Set value (str) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\New Value #1 Windows Updater.exe Set value (str) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RAT Windows Updater.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
Processes:
svchost.exedescription ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 43 camo.githubusercontent.com 44 camo.githubusercontent.com 45 camo.githubusercontent.com 46 camo.githubusercontent.com 47 raw.githubusercontent.com -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241127014011.pma setup.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\74248075-fbc2-42fa-95db-46d15c493769.tmp setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Setup.exevc_redist.x64.exevc_redist.x64.exeScreenRec_webinstall_all.exevcredist_x64.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenRec_webinstall_all.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exeSetup.exedescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid Process 1916 ipconfig.exe -
Processes:
explorer.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe -
Modifies registry class 64 IoCs
Processes:
Quasar.exescreenrec.exemsedge.exeexplorer.exemsedge.exesvchost.exedescription ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" Quasar.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags screenrec.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByDirection = "1" msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Quasar.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239} Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\IconSize = "96" screenrec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000900444648b4cd1118b70080036b11a030300000078000000 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000030000000200000000000000ffffffff msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 msedge.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6 Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" msedge.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 02000000030000000100000000000000ffffffff Quasar.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 66003100000000007b59ce0d10005155415341527e312e3100004c0009000400efbe7b59bc0d7b59ce0d2e000000030d0400000004000000000000000000000000000000c2c8bd005100750061007300610072002000760031002e0034002e00310000001a000000 Quasar.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\3\MRUListEx = ffffffff Quasar.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1669812756-2240353048-2660728061-1000\{BDDF9497-EAB0-4CC4-8C4D-3D5977C4E580} svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" msedge.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" msedge.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1092616193" msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Mode = "1" msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\3 = 14002e80922b16d365937a46956b92703aca08af0000 Quasar.exe Set value (str) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 14002e80d43aad2469a5304598e1ab02f9417aa80000 Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000900444648b4cd1118b70080036b11a030300000078000000 screenrec.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU msedge.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8} screenrec.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202 msedge.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\5 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 000000000500000004000000030000000200000001000000ffffffff msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff screenrec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Quasar.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0" Quasar.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell msedge.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202 screenrec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e8005398e082303024b98265d99428e115f0000 Quasar.exe Key created \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\3\NodeSlot = "6" Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" msedge.exe -
Processes:
screenrec.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD screenrec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f screenrec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f screenrec.exe -
NTFS ADS 1 IoCs
Processes:
msedge.exedescription ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 921838.crdownload:SmartScreen msedge.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid Process 1688 schtasks.exe 2164 schtasks.exe 5416 schtasks.exe 2740 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 3 IoCs
Processes:
screenrec.exeexplorer.exescreenrec.exepid Process 4616 screenrec.exe 1296 explorer.exe 5536 screenrec.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeScreenRec_webinstall_all.exeSetup.exescreenrec.exemsedge.exeQtWebEngineProcess.exeQtWebEngineProcess.execrashpad_handler.exemsedge.exescreenrec.exeQtWebEngineProcess.exemsedge.exeQtWebEngineProcess.exeQtWebEngineProcess.exeQtWebEngineProcess.exeQtWebEngineProcess.exeQtWebEngineProcess.exemsedge.exepid Process 4404 msedge.exe 4404 msedge.exe 852 msedge.exe 852 msedge.exe 4580 identity_helper.exe 4580 identity_helper.exe 5220 msedge.exe 5220 msedge.exe 5220 msedge.exe 5220 msedge.exe 4292 msedge.exe 4292 msedge.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 2524 ScreenRec_webinstall_all.exe 6000 Setup.exe 6000 Setup.exe 6000 Setup.exe 6000 Setup.exe 6000 Setup.exe 6000 Setup.exe 6000 Setup.exe 6000 Setup.exe 4616 screenrec.exe 4616 screenrec.exe 5996 msedge.exe 5996 msedge.exe 5504 QtWebEngineProcess.exe 1952 QtWebEngineProcess.exe 4616 screenrec.exe 4616 screenrec.exe 3192 crashpad_handler.exe 3192 crashpad_handler.exe 2400 msedge.exe 2400 msedge.exe 5536 screenrec.exe 5536 screenrec.exe 5736 QtWebEngineProcess.exe 5452 msedge.exe 5452 msedge.exe 112 QtWebEngineProcess.exe 3868 QtWebEngineProcess.exe 6004 QtWebEngineProcess.exe 5712 QtWebEngineProcess.exe 1420 QtWebEngineProcess.exe 1556 msedge.exe 1556 msedge.exe 5536 screenrec.exe 5536 screenrec.exe -
Suspicious behavior: GetForegroundWindowSpam 6 IoCs
Processes:
screenrec.exeQuasar.exeWindows Updater.exeWindows Updater.exescreenrec.exemsedge.exepid Process 4616 screenrec.exe 1440 Quasar.exe 3024 Windows Updater.exe 5240 Windows Updater.exe 5536 screenrec.exe 5452 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs
Processes:
msedge.exepid Process 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AUDIODG.EXEscreenrec.exe7zG.exeQuasar.exeWindows Updater.exeWindows Updater.exedescription pid Process Token: 33 5316 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5316 AUDIODG.EXE Token: 33 4616 screenrec.exe Token: SeIncBasePriorityPrivilege 4616 screenrec.exe Token: SeRestorePrivilege 5568 7zG.exe Token: 35 5568 7zG.exe Token: SeSecurityPrivilege 5568 7zG.exe Token: SeSecurityPrivilege 5568 7zG.exe Token: SeDebugPrivilege 1440 Quasar.exe Token: SeDebugPrivilege 5780 Windows Updater.exe Token: SeDebugPrivilege 3024 Windows Updater.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe Token: SeCreatePagefilePrivilege 4616 screenrec.exe Token: SeShutdownPrivilege 4616 screenrec.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exescreenrec.exe7zG.exeQuasar.exescreenrec.exepid Process 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 5568 7zG.exe 1440 Quasar.exe 1440 Quasar.exe 4616 screenrec.exe 1440 Quasar.exe 1440 Quasar.exe 1440 Quasar.exe 1440 Quasar.exe 1440 Quasar.exe 1440 Quasar.exe 1440 Quasar.exe 5536 screenrec.exe 5536 screenrec.exe 5536 screenrec.exe 5536 screenrec.exe 5536 screenrec.exe 5536 screenrec.exe -
Suspicious use of SendNotifyMessage 38 IoCs
Processes:
msedge.exescreenrec.exeQuasar.exescreenrec.exepid Process 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 852 msedge.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 1440 Quasar.exe 1440 Quasar.exe 1440 Quasar.exe 1440 Quasar.exe 1440 Quasar.exe 1440 Quasar.exe 5536 screenrec.exe 5536 screenrec.exe 5536 screenrec.exe 5536 screenrec.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
screenrec.exepid Process 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe 4616 screenrec.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid Process procid_target PID 852 wrote to memory of 4936 852 msedge.exe 81 PID 852 wrote to memory of 4936 852 msedge.exe 81 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 3224 852 msedge.exe 82 PID 852 wrote to memory of 4404 852 msedge.exe 83 PID 852 wrote to memory of 4404 852 msedge.exe 83 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 PID 852 wrote to memory of 3348 852 msedge.exe 84 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/quasar/Quasar1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fff23b146f8,0x7fff23b14708,0x7fff23b147182⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:3224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:3348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:82⤵PID:2160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
PID:3116 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x114,0x110,0x25c,0x11c,0x7ff6490d5460,0x7ff6490d5470,0x7ff6490d54803⤵PID:4572
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:12⤵PID:2748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:12⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:2800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:12⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:12⤵PID:3820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:4408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵PID:3128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6908 /prefetch:12⤵PID:1008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:12⤵PID:696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:12⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:12⤵PID:4648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:12⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:12⤵PID:5428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:12⤵PID:5572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:12⤵PID:5588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:5840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:12⤵PID:5928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:12⤵PID:944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4944 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:12⤵PID:2700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2728 /prefetch:12⤵PID:2984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:12⤵PID:3980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:12⤵PID:5576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:12⤵PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:12⤵PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1184 /prefetch:12⤵PID:6056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:12⤵PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6884 /prefetch:82⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7104 /prefetch:82⤵PID:5536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:12⤵PID:5540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7404 /prefetch:82⤵PID:540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7464 /prefetch:12⤵PID:5452
-
-
C:\Users\Admin\Downloads\ScreenRec_webinstall_all.exe"C:\Users\Admin\Downloads\ScreenRec_webinstall_all.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2524 -
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\vcredist_x64.exe"C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\vcredist_x64.exe" /passive /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5660 -
\??\f:\fec4dc67d701dc7b27b65cc673ff19\Setup.exef:\fec4dc67d701dc7b27b65cc673ff19\Setup.exe /passive /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:6000
-
-
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\vc_redist.x64.exe"C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\vc_redist.x64.exe" /passive /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1740 -
C:\Windows\Temp\{38E8C18E-A091-4B4A-90A6-2644EE4F83B1}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{38E8C18E-A091-4B4A-90A6-2644EE4F83B1}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\vc_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /passive /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1252
-
-
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\screenrec.exe"C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\screenrec.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4616 -
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\crashpad_handler.exeC:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\.sentry-native --metrics-dir=C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\.sentry-native --url=https://o83388.ingest.sentry.io:443/api/4505567339675648/minidump/?sentry_client=sentry.native/0.6.1&sentry_key=d4ad0b68f5f5425ebf1a6e2f0a31638c --attachment=C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\.sentry-native\cd87b988-fd6c-4200-a618-17e509211871.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\.sentry-native\cd87b988-fd6c-4200-a618-17e509211871.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\.sentry-native\cd87b988-fd6c-4200-a618-17e509211871.run\__sentry-breadcrumb2 --initial-client-data=0x768,0x76c,0x770,0x764,0x774,0x7fff13733708,0x7fff13733720,0x7fff137337384⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3192
-
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe"C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --first-renderer-process --disable-speech-api --enable-threaded-compositing --disable-databases --disable-gpu-compositing --disable-blink-features=EyeDropperAPI --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=1848 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,EyeDropper,InstalledApp,PictureInPicture,WebOTP,WebPayments,WebUSB /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1952
-
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe"C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --disable-speech-api --enable-threaded-compositing --disable-databases --disable-gpu-compositing --disable-blink-features=EyeDropperAPI --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=5140 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,EyeDropper,InstalledApp,PictureInPicture,WebOTP,WebPayments,WebUSB /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5504
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:12⤵PID:1076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3104 /prefetch:82⤵PID:348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:5516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:1796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:12⤵PID:4872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6148 /prefetch:82⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:12⤵PID:6128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:12⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:12⤵PID:5168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:12⤵PID:4216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:12⤵PID:1108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7748 /prefetch:12⤵PID:5172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7832 /prefetch:12⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8044 /prefetch:12⤵PID:1252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6752 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7952 /prefetch:12⤵PID:1972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2732 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:5452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:12⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2812 /prefetch:12⤵PID:1348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8288 /prefetch:12⤵PID:2212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:12⤵PID:2312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:12⤵PID:5984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7677880397984160708,15264615446584025769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8664 /prefetch:12⤵PID:772
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:32
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3808
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x3381⤵
- Suspicious use of AdjustPrivilegeToken
PID:5316
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"1⤵PID:3236
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2492
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap25667:88:7zEvent58301⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5568
-
C:\Users\Admin\Downloads\Quasar v1.4.1\Quasar.exe"C:\Users\Admin\Downloads\Quasar v1.4.1\Quasar.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1440 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe" /select, "C:\Users\Admin\Downloads\Quasar v1.4.1\quasar.p12"2⤵PID:4100
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:1296
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:4456
-
C:\Windows\system32\ipconfig.exeipconfig2⤵
- Gathers network information
PID:1916
-
-
C:\Users\Admin\Pictures\Windows Updater.exe"C:\Users\Admin\Pictures\Windows Updater.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5780 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Updater.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2164
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Updater.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Updater.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:5416
-
-
-
C:\Users\Admin\Pictures\Windows Updater.exe"C:\Users\Admin\Pictures\Windows Updater.exe"1⤵
- Executes dropped EXE
PID:3256 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Updater.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2740
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Updater.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:5240 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Updater.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1688
-
-
C:\Users\Admin\AppData\Local\Temp\y7KyUGcH7zQk.exe"C:\Users\Admin\AppData\Local\Temp\y7KyUGcH7zQk.exe"3⤵
- Executes dropped EXE
PID:2920
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:5104
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\screenrec.exe"C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\screenrec.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5536 -
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\crashpad_handler.exeC:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\.sentry-native --metrics-dir=C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\.sentry-native --url=https://o83388.ingest.sentry.io:443/api/4505567339675648/minidump/?sentry_client=sentry.native/0.6.1&sentry_key=d4ad0b68f5f5425ebf1a6e2f0a31638c --attachment=C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\.sentry-native\6ec16797-44c3-4f49-9bff-14d7868aaa8c.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\.sentry-native\6ec16797-44c3-4f49-9bff-14d7868aaa8c.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\.sentry-native\6ec16797-44c3-4f49-9bff-14d7868aaa8c.run\__sentry-breadcrumb2 --initial-client-data=0x754,0x760,0x764,0x750,0x768,0x7fff13823708,0x7fff13823720,0x7fff138237382⤵
- Executes dropped EXE
PID:1388
-
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe"C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --first-renderer-process --disable-speech-api --enable-threaded-compositing --disable-databases --disable-gpu-compositing --disable-blink-features=EyeDropperAPI --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=4608 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,EyeDropper,InstalledApp,PictureInPicture,WebOTP,WebPayments,WebUSB /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5736
-
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe"C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --disable-speech-api --enable-threaded-compositing --disable-databases --disable-gpu-compositing --disable-blink-features=EyeDropperAPI --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=5748 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,EyeDropper,InstalledApp,PictureInPicture,WebOTP,WebPayments,WebUSB /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:112
-
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe"C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --disable-speech-api --enable-threaded-compositing --disable-databases --disable-gpu-compositing --disable-blink-features=EyeDropperAPI --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=5756 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,EyeDropper,InstalledApp,PictureInPicture,WebOTP,WebPayments,WebUSB /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3868
-
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe"C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --disable-speech-api --enable-threaded-compositing --disable-databases --disable-gpu-compositing --disable-blink-features=EyeDropperAPI --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=7052 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,EyeDropper,InstalledApp,PictureInPicture,WebOTP,WebPayments,WebUSB /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6004
-
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe"C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --disable-speech-api --enable-threaded-compositing --disable-databases --disable-gpu-compositing --disable-blink-features=EyeDropperAPI --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=6988 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,EyeDropper,InstalledApp,PictureInPicture,WebOTP,WebPayments,WebUSB /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5712
-
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe"C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --disable-speech-api --enable-threaded-compositing --disable-databases --disable-gpu-compositing --disable-blink-features=EyeDropperAPI --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=6980 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,EyeDropper,InstalledApp,PictureInPicture,WebOTP,WebPayments,WebUSB /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1420
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1944
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b9fc751d5fa08ca574eba851a781b900
SHA1963c71087bd9360fa4aa1f12e84128cd26597af4
SHA256360b095e7721603c82e03afa392eb3c3df58e91a831195fc9683e528c2363bbb
SHA512ecb8d509380f5e7fe96f14966a4d83305cd9a2292bf42dec349269f51176a293bda3273dfe5fba5a32a6209f411e28a7c2ab0d36454b75e155fc053974980757
-
Filesize
152B
MD5d9a93ee5221bd6f61ae818935430ccac
SHA1f35db7fca9a0204cefc2aef07558802de13f9424
SHA256a756ec37aec7cd908ea1338159800fd302481acfddad3b1701c399a765b7c968
SHA512b47250fdd1dd86ad16843c3df5bed88146c29279143e20f51af51f5a8d9481ae655db675ca31801e98ab1b82b01cb87ae3c83b6e68af3f7835d3cfa83100ad44
-
Filesize
20KB
MD5605a24ea5ae4fa0f8051b84d26328c68
SHA1d572e921bd4713340d901dc4f2622be2445c472a
SHA2566815e6b3390b4cf3d4fe1307a8486555006a6297563557e9788ca93e6de26672
SHA5129fee8fad21a16ec32e15e24148d0252dc68e87584aa47428b75f1c3f58b0841c7f79f83daa7bac4ab9f22671848cc01a405cfbab50e1e9edb19466b71416b491
-
Filesize
180KB
MD5a6af186801e50aef470661df54d1cc7d
SHA1ce3658f136819379ba2c984a5c46353112addb46
SHA2562965989527f6330077447c9e73ad2ad669ee7d0e09186d2fc2da2d250e98d715
SHA51265d000858e9ad0e39188a678d76dfeaa26a033df6c3d0a153edab3cca593581bdd4307fec43d67460e66cdf67e84b02766ceca3a3e73653aa8dd68561ebf9bb7
-
Filesize
448KB
MD5f451de5cb75fb5c9e6de9b86f23f1d38
SHA176d031db09dc9c702e2fc23a269a2d89944663bb
SHA256c126da047fca3254112decaa260dd3e3dfba10e82a07b6adb154691ae8f863b7
SHA5128d29a57b7e0ce5adcfabf1f35a57a184f465c9eb408b9b4eb2a655101f9d9813afce61046e08f1186aa6c34c3a94be7a381a226a03690996306e69e86112ed64
-
Filesize
223KB
MD5d97d1c2be723f04ba19d9d3d83c40467
SHA1dca414e5910e7eb35841a2d53805894789bcabc4
SHA25638185c23b81720ea2ad50e72bb6def974af36174d4b90ec64590cf14734a1d15
SHA51292a9844d68b585117e42b90580019913d280d54f5ab1858246e8903d5ae698120f4fa1cd7f63d258f0b92fd167534e3a2c3ecb4873dd72617e229ef43c71bcd6
-
Filesize
411KB
MD50c43c165738e3b8623ba2fa4c6133c09
SHA1284855fe0cee55d8d3669833b61cc7439c00d980
SHA256be6ac3e4d93b7fdc32a99bc17a39c791e5a00b74a3ac37c8cdaa50f80d839b37
SHA5124a1903c6fc2216d5359158accd1a6feb252edcf1356d1fbffd4789b4f6cb744daa49e6ae7df04123554cabd9cabad4dde62e72a1346e827e02dc70403b1a9018
-
Filesize
234KB
MD549599636445de1e660f812cd25070c25
SHA1b078ea24d0368d6a41c78195ec6d33c7c1222334
SHA256c5a98e28cfb21e700246e97e89053aa04cee945cb301ea789976ae7816b8c038
SHA5127223079bca5c83fc3a09314e634a9277c8cae54a3d6c34c25e98fa8ae36bdec5d309f3019d34c49383beadbcabd41549903903834ff7edfc61b88b63dc9fd91b
-
Filesize
22KB
MD5778ca3ed38e51e5d4967cd21efbdd007
SHA106e62821512a5b73931e237e35501f7722f0dbf4
SHA256b7e1bfadb8d9c061f17a7234df012df7842ab1aa8fb6f9579fa3f0a3b4a75bc0
SHA5125f6f02099ca8079305fb7e7f43ae4344d522271fe30379c0854d6a81b7d8adf408a50a4b799b5f52e6ed162ba6ce7fe97e24a2b9719df780e75683d3aa103d09
-
Filesize
1.5MB
MD573ce03783a4268d1f0a0f709d832443d
SHA10c1b029406def89b1fe5cf54ad02e7a3006f97b6
SHA256fdc28dc28c7883b02fc12cef41f7c16890cf26e337e760d01bf3b48e691e4a23
SHA5122ede022e3569178d5627e7ec717058be428b3b8b39731492caa52e60e405fac5ed3ffef76f13d58a9c32cc7ef47d140bd4b1c37b473244d2661bfac0004c6c11
-
Filesize
18KB
MD58eff0b8045fd1959e117f85654ae7770
SHA1227fee13ceb7c410b5c0bb8000258b6643cb6255
SHA25689978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
SHA5122e4fb65caab06f02e341e9ba4fb217d682338881daba3518a0df8df724e0496e1af613db8e2f65b42b9e82703ba58916b5f5abb68c807c78a88577030a6c2058
-
Filesize
18KB
MD5c83e4437a53d7f849f9d32df3d6b68f3
SHA1fabea5ad92ed3e2431659b02e7624df30d0c6bbc
SHA256d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb
SHA512c2ca1630f7229dd2dec37e0722f769dd94fd115eefa8eeba40f9bb09e4fdab7cc7d15f3deea23f50911feae22bae96341a5baca20b59c7982caf7a91a51e152f
-
Filesize
18KB
MD5115c2d84727b41da5e9b4394887a8c40
SHA144f495a7f32620e51acca2e78f7e0615cb305781
SHA256ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6
SHA51200402945111722b041f317b082b7103bcc470c2112d86847eac44674053fc0642c5df72015dcb57c65c4ffabb7b03ece7e5f889190f09a45cef1f3e35f830f45
-
Filesize
20KB
MD54460d36c327eff10c9b57f5b7e9f74da
SHA1ec6b6ce85640e2ce0f167d45fad07a018248dae7
SHA256946ce5c74b79a601e1cea929e3ffcdcdfbd98172cea2c1c43635e2c96901c48c
SHA512c7a836ca638f5efca9182d5459ff4d20673f6c6ebe468995be65119c162a919cd0c036bfc3c2700c38ae4b2aa4f29f2d994cf5e4f064b7986cf0bdba564b72da
-
Filesize
49KB
MD59c03982e4ed2efc93a65fe9fdd3b5991
SHA1d7c31690a7b4b861f7fa36158bd5fd336ed7c459
SHA2562b23bfa90d84307a27d61b1d4f3d9b14141ffa249d0cefe2ba3b68330cbe5f97
SHA512d2e6cd7a605c2a377a4a5c80116273c242cdc1e5c6b36683024d12af59a7dc518dab826a39bbc665a822baf53d817d60d019803f3816abeaa9029c4b67bb3f06
-
Filesize
617KB
MD55f68de3a9fe2532aa4ff04097df4f272
SHA1fa0801ad789220ac5f93c1cb1a0356cc157792b2
SHA256e1117461878eb28381c0777eef1bf8ec226826056e631ba72006a67c07aceae2
SHA512df92065a0105e3718efa066bddf3121ce586b69d3dde4e64293ed483d34e162d3d567b01a934a2750853a4a161ec7d19ac41753feed44431d6d9f634b79ab6bd
-
Filesize
33KB
MD5383b0cf9c1ad6f185bcae0daadd3a542
SHA1a4d3ec3ae12e9586c62ff18bb8311ae697f10c3e
SHA2563aee4b10da5eb1bd91dc1ef2d158e4984659dd164a5250f3944710c610caa62b
SHA51253ff30f96d32f6261b2063ab723c2e17feebf1a259d96263db8f923550bf813ba7d90118d81c43dd37e250487d709f8909ee61fbd6e014d4ed6c198ab9cd387c
-
Filesize
32KB
MD5e8caf9aa03a76568d4dfb4bce1c070b2
SHA1929a63300cc8b20e5d06dc052ec862b9b5df3a1f
SHA256d6aba74a90bcbe4a59e6d0d336f0354327449ceb67ad46dc1cd0ac0b8258173b
SHA5128e9f6d753624a0370581340612ace94e8c1c62bc64b0b4c39035721c6d088bf77b544b9f0e380c5038d0a101e8500ca8fab589c38ba1d1137df9d3f3bf140658
-
Filesize
24KB
MD5789fd4f17cc11ac527dc82ac561b3220
SHA183ac8d0ad8661ab3e03844916a339833169fa777
SHA2565459e6f01b7edde5f425c21808de129b69470ee3099284cb3f9413d835903739
SHA512742d95bb65dcc72d7ce7056bd4d6f55e2811e98f7a3df6f1b7daef946043183714a8a3049b12a0be8ac21d0b4f6e38f7269960e57b006dfec306158d5a373e78
-
Filesize
86KB
MD578639ac8d7925426395cb1f4e6f16ebd
SHA12e3ea6d44ff9d8052dd1f0a7f749bfc38171c7ac
SHA2560c0fea49aed91cf194a5b18e8ae98137df90438fb71efd898426b8742402ed2b
SHA512f64d2702e8034f7c6e378bcf38183b3ecca1cbf0337b5b83abb7c8642eedf0410fb43d0fb78312529e853e7ddc4a4e33543ec899150515f9d81e54cfbbd671dd
-
Filesize
1.7MB
MD552790c7d139f3728dd28b19af2ca10b4
SHA17d18cd714670beee2623a4226590d22fc913b7f4
SHA25675380f0f7bb3f837ec1cc0be267aa3532f02b1f2e5530268af4012016cf271b2
SHA512b71b8d99a6db5c7483e6d0c3e96d2b67b0216f0f5ee263455ceaf1d9de46ffeeaf3c5415e9e21d4ef3cd584394ae718cf6b1c7efae5e39da0a12f3e7c7b076a5
-
Filesize
38KB
MD5cb5a611c29e54b35700e15ee1b2b2324
SHA10ea9a7477f90bb5bdb5be8462ba84bd479cc62da
SHA256f728e6672ebc5b9c31aba1caa0d93bbebd3e210522d411956e99f24d25e70b7f
SHA51294e0fba97ebe61f099bf2231459b484f2c358b5a94a4304be70cae6e7be52af007d315f4da191d169e02874ee7624a74c71e0eae879228680e66092e93f5b657
-
Filesize
22KB
MD58aef0f580ff9f55fe0b1b9a5dd501b3b
SHA119c4d54bf56066ea8a734a123d07e2d524c5f2fe
SHA256723ad13100de3f4451a7bbe170674bf02db0c08a0f19fb2ae0059a8fcbd7149e
SHA5120b501e4c1f535ddead3f5714f96c3c1b36800c5dd28250c912f81e7f8f3114deb707b8c41a929398e011e4e64d28adba7e0fd5c3ece31a127866729027d2ed44
-
Filesize
127KB
MD5f4b09923eecdf83712f69b20d405e5eb
SHA12428a0678f3993e1f39dfa985f7b89efd991b3e6
SHA25624cbf884618d970baf117cb0995bdd82de2e37971bf33082e479266e22e28011
SHA5122325aa0286c5996f6b736d191de55bebc44368405ff6aaedbde3c7eb39556817fa34a83bf1655827f490262c542d76fba6956dc47a06516b440079e766697deb
-
Filesize
25KB
MD59222217ea98c35e71acd00dfe056b030
SHA142fc786d7b865bdba84117ff15357fada69d3b35
SHA2561bbd4cf227b3645dccb3d9e3e03736d4e7612326ef09126cf18fccf00b1aac4f
SHA5127aaaa2031579bdbc89a31201613e26f4a1b67998cafc0d2372438beb22f11ba0bcc13d41c6d6e074b3e5a8d87a15dee42747b796c92d619549e83bb117362780
-
Filesize
487KB
MD51cccd78445231f3867099c625cdcb5e2
SHA1c1f1abe3a5a670cbba78445b71a26666b4fe3cab
SHA256220aca9a6317a9b32659295fc350488e290ea32b1b36c7e51f4ef26c692ef969
SHA51281d34c2dfbe433f55289c00dc5e8f9a4fb856c32ef281ebad19add19ea64c0e3f1a49faaa94a86881306406e801d744cac8d090cd894756acbc546f3bc3f5e01
-
Filesize
268B
MD50080aa0653bdab96541e09d2edc2380f
SHA10d41830e002564de41db2bfe5405ce59cae37dcf
SHA256153cc706630f782e3245b6afc8e7efce1ea2b8bd415388dc20ea96e37112759a
SHA51235c35594c5dc97dd6dd2666fea9b8d052ad702ca88b563100d9226bc54fa343a58f6c1f3b305cd68e483f6066175f494126610902e42a76f0e83e87fa2a91871
-
Filesize
14KB
MD509e3e709c232406adfeb473d9205921f
SHA161db5f5a7e704741cb188316a5d1c7a4cd11c5a7
SHA256ef383e3538138da10d1051a65a4ed88c68fddedefce0c95cdccd75d85e2c3e0d
SHA5121aed104b169d68757ddae622633a7389cdc28385dcf19baaba2f8ce3136d91b98c96f014f394bb0c962a8f42a27387327f92a980533c29ed29ea10bf622e3d14
-
Filesize
237B
MD56e24b5f24d6aa65cfe1b139261eca987
SHA17f5dd2a30de922550a82e20bc28e2fcdd3dbd1da
SHA2560b428cfd9fb35bfd2fdfe5c061845ab034feb1800542203eeb64e345283387a8
SHA5128766f4e4079742fec752405da7a1480aa3f920199d48d6dc052f0ed0d9869ea0236503dde2d7ea7ecfe73c8564a681e40f6c819f0524d0fa12f508810b134957
-
Filesize
60KB
MD5a9821bc523c708ff65de506c89da4afc
SHA1f8dbc135337c4c2ecf199238cce0fb1088960e93
SHA256697a026a06a34dd5024384ffb48e281d24372dd09a758c94457be0b9e3c1aaef
SHA5123b1c925523998a80a6accd9f45d5e8274f80d3badd253be28854c90cdb84b7376b13a4475ec68e14fa3b14ebfc303aae5bc3ab78e67e4b128bfbdc4b47a0b9f6
-
Filesize
388B
MD565e7407cfc337fc0d0145f580872539b
SHA15575e98a9d6d74d345f698bc133eea1c018f099a
SHA2569d181870ce3df346be3a4f7feb98f0cec6d35f2606da5f07ea529775c1b6d615
SHA512486f0dd7a587a7d9311d29c898d348c1705eb056abef0ef496472a3d1086c3ee09c456d979886706c754bc18ad09718b2f9457349c3b45cd5178afd64803227d
-
Filesize
26KB
MD53625db86eeb411989929e07f19ea81e7
SHA1f1754f1d9a2a45ad9f569df2f0f3952091b53610
SHA256895d48c5b65a91ee75173bb4d796ed810dd30a9c9a640b38902c21821bfca394
SHA5127dbdd939ee5dd1c94c7b9443f1001d813fa7951e8afdc92b79f48240280715836dab0d50f724292a5fc96d9e326d33449bc1430e32b19c9b4acfa966cb038430
-
Filesize
104KB
MD5ab2e8c382b16465a5d8b9f7b5a9556f6
SHA14f61d0d098eb6c6d04d77f52b60537cfee5bae95
SHA256fb5438029ab60e4d70a181fe3c065d4f8d6dd28397f81b747a7bc19f8dce926a
SHA512568c58e57c4cbbf26d66a0559cf4abdd624afbcbda5390aabf025a1f06fe8ea643d1561f6ad48d9f3cb3a659e51e033d7106b70c6f77b1687da3365027e4f105
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD58c1d0cdbdc24f78828c7e674cb2d5d05
SHA1bde0586d562f2a34bbe3e518819030a16812a494
SHA2569bd6cd490f25d0eece387a5b2566abda841fddd1decf8959b3069d7e1ad49b1e
SHA5129923f27822c580d227af0add01b431e650e5bda81b359dd73f0724f5d657910070733c50ba7c294b2b4d453f15cee908ef6a2319fe0251c4210b497e96ea4c05
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD5f518cb7fd4d027382b26c94195fa0419
SHA163dc455961b1f1a7e284ac106e58a0b78e7ae3e3
SHA25669fb040ae68341ae0f4eea54fde0e2a9ffecf86925976249c3bdcbceffd8b7ba
SHA5127f88e3bad9698011305883ff8cfaaba9d2a7b396a13fa0d209bd1beca4c1bc31c8bd92f69f16c0811542d5164af17c08d60185dc374b6a6886fc8d0613761663
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD52c692715428ad64579a0944db4d8fef5
SHA140ea059753a9cac3d42a6c42871530d7d5fa30b2
SHA2566ff6e393f4b0c7702a32629e2a8a1599cc507db60a2ee53eff61971f80d4f85d
SHA5125d4896a88b5a24a811ab28cde6481178e286a92b1c1d0329c6f2e72cfe50a2c0c6cf5cc6388addb237394d41f779bf523f843b5d599f02d2956e317b2d6481e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD58e2e4199c5a9babedab4199d801bd655
SHA1e2d6499330933faca1549adc7574e12f03a757ac
SHA2562933f4b6801b0caaf5a7d0bbf1cc9ab1fd63d1cf0dd41976d3f03aa1a2ea0238
SHA512051e18dbad0003456285d63fbb081060ea064c9c11234446230f750809affe3af24d0db925c458a72f25fb39493c23ca1740897a8f132f0963d2a94593683af0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD57c0662fea3a2c944db685cab2e9fbd5e
SHA1c46c0df7e3f3a40f41558a6238b6574e3fdcd63a
SHA2567c5730f4216080aac61390ea51ce0e05b3c52ea0b3009db5873bcb794d4fb6f3
SHA51257624f2bd6b484e5a375922db51f7d62a36ca1aae9a8959787fe2a98251fa57c9ae2f70fb5879adcbafa7b5fca7872406d46311c48ae7029bb383d7edbde6fdc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD580cfe6415ab81e6d23cf2041e98019f0
SHA1f1f7e60d7f7650960ca5dab0a13ef021cde4ee71
SHA256f5823eebb033b13dbea39640f3b4869e8e9439e55cfe2487c1af636016bc0b88
SHA512865b6c43f4b62ff0690465f95dcb63095886f1d79101ee831694759a200c734a2acaee0e49a73264c18a73fa77162e5c36047a778cac6082334ced4cd9f0c794
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_studio.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG.old
Filesize4KB
MD55f5411fc90163aa52771c86c563f108d
SHA10440b0ac9e45cf19536ddd2109e75b23f1d58f00
SHA2565ed2e0349d189035cf61ad5a788c5bd1a67683fcfab8f6f0743fa146c8be8a52
SHA5123ddb44a4dbc9093716577e8edf8c7b103f37a38ede07f1916254c4b61da9acb59ace7c9a3cab31b04c5e13859f161196b20abd0979a580181c2b8aa3277d6e99
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG.old~RFe683611.TMP
Filesize351B
MD59d8dbaea0e9b756c2e3adda247e7ca9e
SHA1f93c453af5fd5fc34e4beae0313f56611abc5bad
SHA256788aef179fdc040937b44fb59463f63262975d1ec1445eeb8bfa78e0a3dff5f8
SHA512aa47295518e4f4832e113d3ccf21154d8207fb4a3de12f987bc86152016a7568327bbb680b06f03b6afea5a94be9987092050a2129c17e542fa3168dc41db136
-
Filesize
1KB
MD5413e52607501b1f863e7526186277561
SHA1377bf3a3c28be84ee003fc299c3cd593a6c1c0de
SHA2568d121564fd92cdf1c8ae9a80b88b695edb5a063f75004347c1a7ac62049ac124
SHA512d5cfc13616918d7486a5ba26f5d39cc8b06dfb3416e0eb30d978ca5d5de364e06c20436de6a3dc7bbb60269638d9829ac99138c718bf1d5da12bbc921afd6b88
-
Filesize
1KB
MD580930770ee51884bb5d4d575a9d8caac
SHA1b7bd10006d63d633a8f5ad7d8293dd466eee8b01
SHA256ab68456d349f7723852ba22bbedc42438a75bb6d83d8bae441920561357205ca
SHA5126ac92dca7bda05c9fed0cedf47010fbed820e01c76ab363eac8f6e606ce48b7b5056162a9872ed1feb5baf18fa3045a97cf4fe04f90ca5b0ad95196086f75705
-
Filesize
10KB
MD531fd266aa6481d22febbb7d48a789153
SHA171914b98be971db4e62b0fa4e116c2a2ba2b82fa
SHA256eb9cd349a3a1310bbf4567d59869854a64c3583a1651005b5d0c3becd6aa38fd
SHA512404bfbcc699bacad9e3e7af47f7c45963edad25cad97161e02ac1ad4ae94294dc73839483284ae86e85b5cef6811199f3e0732a3ae58890121795175688371d0
-
Filesize
8KB
MD54cc8b0d5930058ac5183318a7fab54c3
SHA1ceca6897ec6a38e1ef5001e1cb682e209ec96afe
SHA256b1ca96e52d893e803fc8b772036e97007af26d844e0647c7c2138dafc00c8fb8
SHA512b46f945e960573c89aa6020e59837c2eae93d5404301f5c6046f49c826c3b7266d7ea39a130acf35f2ac3e53b62340b30ad232324c54c4ca191a5433d93456f6
-
Filesize
3KB
MD5a608d1d109b35d4bf7c4c94293919428
SHA1c4aa4730f815cecc1b197d344dbbbc4b9cf4473b
SHA256dbf05218f606ee5ecd1fbe3b6eb86ae51f467cc2219e52c8928e1607fe87ccaf
SHA51234eb17db90f105cd24c304ac908952968f2f7bd56d2552442d43b965e9b0acefd4e7256b69d42bad0b89ab32d77cb5172d0f23ce4dd9615bbe04a2fa09fe8dd0
-
Filesize
3KB
MD5beca728515dfdc7c91af06eb14fded30
SHA1034f726d9026b5051804634e95e2065b643e1f25
SHA25639a3a9a13c04cb72c9cfc8d55f1cd75def2c5513e45d5e00022883c325c4c53b
SHA512bfcecf981373a12292168080ea57a897275ad33642560d6c7e7cfebaac2b10a6edc54af28a1d9b572da4de8522b5f3d8e4800e521235a2fc1102416e70a50091
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe589277.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
5KB
MD50c93f235544e7508ec752cc93553b728
SHA14720bada796d3ad2a9d5d8861e31cea0c06af784
SHA256a5bb7da229ea02f60c13cb347a0343b5239d6b2d686384a0f90522b45f27b668
SHA512349122223cb2d93cf1f9d39f1e0a71a5c182be2405422c4444b29e7df8b380b5127312c669b6d1e7692fb3365690097fce7ef1ba351b6bf8fa8159c417a0377b
-
Filesize
6KB
MD5fab5d3539900e713523aefd4c692f6d8
SHA12627e590a40a829dde9e619a2c205ff60e1a2de4
SHA2561958c87e55c45a286cfa4539bf91d63cac0506a90eb2a2ea92448ff031e93a7b
SHA512e265a1bf05d203847406a6713c8ad170337eae092808c5207dae58390628071d82355118510efb211c5f712f6312767f51ef44660df9461d20ce960d2b8d58a7
-
Filesize
7KB
MD504b7995b8c121103a3c371a88d7cebde
SHA1b0fa167ab77588d60ad6224d769466844455fa9e
SHA256316232ab8e730eb9a8afd37305ef17b211b1145355152d750baa5b5afef1a437
SHA5120529130fb2f4a18bc10811cc8c4f44f5ea492dcf5fe99c8603a025f66709798e5eacdafa6e21403e4fc4e497a19c0ff0994d1c7e3c4d6d27fbf6355fc8c1411d
-
Filesize
7KB
MD5c376e20ab4553467f6cf2a9c3bb9a612
SHA1871286066319b4605fe0aeaba7d05958042f1b6f
SHA2562580df8264cad55a4032b3f0012e1d581cb1ad0ec3f11fc110fdb4adf8da20ab
SHA512c6c5534da5fb22b32427627acc91bde6319d1e5652ce39f07987ca9d7c5085d02272d771282f01fb0768c19d84d92432a853e2e6e112c5d1ef02b175093fcb4a
-
Filesize
8KB
MD5f5988beb9082b11c576147557c3a1d40
SHA170d9c2754e8093c7db3e8820968d9e7c6961d0d1
SHA256f4e2c41aecb20cbf930b819da8982e1a8c1c1007e98caca7ea314db4b01bef52
SHA512495eb4e1877d4513246549c624e6c34269ac77e0ff46137f4fb48a35e529eb35815f85e5f526c078ebb0caef68f3d88c41e8c5c07f2c6ec9e4d986d82e1100a1
-
Filesize
8KB
MD5e8ae0ead09908484cb9873b16ef23549
SHA14090f7b19984d16e2e061e6e4f03f12c2292291c
SHA256df398314f13c52b883b6fb33d9c5736a05f9a3e6470d1c07a229e03db28f75c8
SHA512f6a11bcc39d312195af8d14962aaea57a9e9d5845118d623f7e717f9a2a76f022598bce069506d906a7404c0c459b25c271d64a465808fa0d316e61f76367be5
-
Filesize
10KB
MD5d976b1c02f793f2b2eb767ce447dfcff
SHA15d5faa4d8ea41cc1334bcde8ae03b1eaa8347747
SHA256bd38dfdb173129afcda13da387a629e1231ba6cfdf6ebefdaae1a313f9859f02
SHA512c82ed36390c14f8f2a268ac5e1d209386d069c981aec14b88b4ce5e5ab5258449c60ace3a785dd8573904da2522196155ae3d07544fd548d10722291d9fe9894
-
Filesize
10KB
MD56cf3cea3841b8df200c57c1b65fe4a52
SHA1d43ff5e8c18fb5feaf6782f1b6999ec7cb6765f1
SHA25661ee67cb5d5292572085da584f7bb88e141d27bc96781d0c7066cfa0d408ac34
SHA51209f89484b0549fe82f2ad1ac968d63aadf0c0baaa44e0360a495ce43b91725f3ab450af049c7692f72517bda15ac1f68ad8b7875ff562f0dd0ee0b1778cc6da4
-
Filesize
10KB
MD5a33f5e65a988b4136b4085b726167010
SHA1bcc49d2eae7772a4781cb1c30530da0de8479758
SHA25657afa8a2b92048c0a357f498e0fc83a30f9a470a9b539735d85df0a635262652
SHA5125250c5be0708fd291449d59cd61f01cbe5992b5d4be80b06fa5387a97e8830f928ba5f46dff87d8644710f5273f394f56f3167af7e2a794a18319512399e07f0
-
Filesize
5KB
MD53f03f9a4eb128ce08b96296bc5c0a865
SHA19656cd8274f7b05a7740328c7ef164a03c721581
SHA256f751cd7d5f0a72ad8bbcd25ddff45ea1ec7de5dfeae3ce922a16939e9ef4a1c7
SHA51235df1f74b68331662df9caf1f60225cc1559237a8664ba877872cb9425f31b9fe8da8f86b48c257227194b3207e04c622f7f73d1dc50ed25c98af365cd0aac57
-
Filesize
7KB
MD5856c25087046eea421c1cc015e5fbc24
SHA18b27f79f62c2e6f3b41d9db2c80c40db0b649836
SHA2563f135140988cc92c2b973eb0a3eac52a647665b242b97018cfe6029e5cbf0520
SHA512f187185735ba418d9bb13491279a920085cfad5b7862508a40d693ec73801b343b48da8f756dde641f5816ffa82855a04a5ce6785fb11f58dd312e13eb4e544b
-
Filesize
6KB
MD5f87cb2cbe5a833a90ad294479d3fa074
SHA18dc694a4c9b7199a6748451f8aa945b4c9f65396
SHA25624cb2d5e87465d94b74bfd8857d41469afd909d5f1ee2c6aa79fc304e8a44fed
SHA5129a78d4bd6cc3d11c3f606fe34f704a1972af3185ee8ccac0e7bbf424221a3cd9b6314d2e65346a3e1c26be19d2783bf63a126ac31b27b209d52fe9262ef380e9
-
Filesize
24KB
MD5f9055ea0f42cb1609ff65d5be99750dc
SHA16f3a884d348e9f58271ddb0cdf4ee0e29becadd4
SHA2561cacba6574ba8cc5278c387d6465ff72ef63df4c29cfbec5c76fbaf285d92348
SHA512b1937bc9598d584a02c5c7ac42b96ed6121f16fe2de2623b74bb9b2ca3559fc7aff11464f83a9e9e3002a1c74d4bb0ee8136b0746a5773f8f12f857a7b2b3cb4
-
Filesize
24KB
MD5d3412a01d4c3df1df43f94ecd14a889a
SHA12900a987c87791c4b64d80e9ce8c8bd26b679c2f
SHA256dd1511db0f7bf3dc835c2588c1fdd1976b6977ad7babe06380c21c63540919be
SHA5127d216a9db336322310d7a6191ebac7d80fd4fa084413d0474f42b6eff3feb1baf3e1fb24172ea8abcb67d577f4e3aea2bc68fdb112205fc7592a311a18952f7e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\81e75bf8-f28f-46bb-b1a3-f1eb6d85258e\60ae9826e23d8a64_0
Filesize34KB
MD5f5d5dcac691b72896bc1b7ee07a0f8eb
SHA1fbe494e45ff9afe360949baaeb2694e3ba809107
SHA256168da978a8fd56b4337977d67a2aec6f693bcd72afcfcd9f6616858cd292ffb1
SHA51228a89babf25006362051ce80f3430427ccaf32d76d22bec19c2fdbce2b7483d1206e1488a7a1235909c47816ec19ffcb5ff68f15f7457dfb7b250a53bb0785b0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\81e75bf8-f28f-46bb-b1a3-f1eb6d85258e\60ae9826e23d8a64_1
Filesize59KB
MD5ae8b0bfcd3636495c3f71adde251ba1c
SHA189925b5bc60cecf3c4f53299613471f81248f42b
SHA256a575b94ca92bac8dc4feb2ce8fdf08b77cdbc055f26e138291211fd5aa3b6c29
SHA51238ba029de647f77c00090b1d2ce0210dea0998a96fbe4f78e12b73ee10a929fd44c39ef892a9bf46167f2739eeab2fd59d4ab31bf47b0dfd5725c811ff9cd495
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\81e75bf8-f28f-46bb-b1a3-f1eb6d85258e\b34aea5a3becb65e_0
Filesize2KB
MD5483568672a35e3d1026916af9a77a55c
SHA1448d5c2558859313f8321caf314a2126ae7c78dd
SHA256fe07d2cfb36c3eb85bff3dfd36f35d31060e7731d2fb546049779b7489254986
SHA512317d33d6fe811949500fcaac42912c6b4f5f79b93e18e7698c94bca1fb217afb0af122e54f3e2bd8f51735c9470971721ffea1645a778e59fca30cd4a44d9007
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\81e75bf8-f28f-46bb-b1a3-f1eb6d85258e\index-dir\the-real-index
Filesize624B
MD51bfff39ccceb3f7c3b272fd1fd346829
SHA153c2fb7d6ffd0b0491dee905fafe0f7991161288
SHA2568606f5ea9b36f6e69dc97fb31f9b21ffee50658e306fc0dade202e22f54a1abc
SHA512f7acff597a6a1379d937229e4d4cfff06d5b27e46a5f55682f570ac2a10e71a993992565ee3fc74db0ddcd444b007fd919be0c3e1404a83d126189346836a7ba
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\81e75bf8-f28f-46bb-b1a3-f1eb6d85258e\index-dir\the-real-index~RFe661861.TMP
Filesize48B
MD5d3989440bad51ff9ab1523fee34ef35c
SHA13f20817259030feb1d76c0aba229322c89195a04
SHA2561f4f9fb79f03d3b8fcb22f1b8f3a341390c0de0125883f9c89965e44a6e37a6c
SHA512872f0c6c5502f9cbee14ffa4ba8018f13e66d8673cb684e02f0191d955f4f6a82515a53d211827b888678f6368277295af9c5a11b78ebbb21d026324c60387e1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d870f204-38ce-43dc-98cd-10f5629bad43\index-dir\the-real-index
Filesize2KB
MD506d1a32a68ba9cf502bcbd75a2051347
SHA10f12011432fdd89c1e75ae7c0c13dc5040ef425e
SHA256c1101e422640845a9469a88e26f871689a5b41e2a3f2b78a1e2a624da252423f
SHA5124c5c9624aae6b143c717136fd1fd43cb06aa82591d151877a8070f3c6817633d9bce5d4ffcd3d727f5cbd86f35ba5a7a1724a33edcc62741f54a35fe3c75cfc1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d870f204-38ce-43dc-98cd-10f5629bad43\index-dir\the-real-index
Filesize3KB
MD5748abe14fcbe1690c005b8f848ed4df1
SHA137a39bbf3580279bb0c5e0f7d00bd76981c470c1
SHA2561c2be296054a9476a268955dfc87fd417d33553557c39dd7ce266d93a7901450
SHA51255fe0e50ab0ed61b401a5f65a90d8608a1c4f02fdb8487fdbb835ca9fd9307cd4ef4699241baf119996e72758c44f2b275a1e863e7736f0b869315aa14403394
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d870f204-38ce-43dc-98cd-10f5629bad43\index-dir\the-real-index
Filesize2KB
MD585368aee459a7849aca4b1d94452da23
SHA19cca740ec5adeadb80be9c2911405fbbde6ca768
SHA256087f52afbc3c9ad3840df0a979ee1c3b346c7a8dd11e3e4d3a921c2dcec4ebfd
SHA51243b340dca9349e4579f05d09e2aa6bb3d48bb6e004be2f6fedf0cfece6c98450f4bbe2986ece690219f91029c3158372a41e6cff6e7a53f39c46ceefdc682c8e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d870f204-38ce-43dc-98cd-10f5629bad43\index-dir\the-real-index
Filesize2KB
MD5eaca234057f385ccfb7d12a4cf1a4e7d
SHA16524d70253bc639ccf6e26dd5ce1aff9f070b2b0
SHA256aa88140edad538d13d691b47ab81fd38c30c4198d34732c0783ba19bc25429a8
SHA512f46d9ff0230d455596bb447e2c6e067f8e521a4404b73d00904a824bc476b2d151491e21fd6499e8674823912d4f8b59e1edfeb803d9c8fce533b76ced0d4f2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d870f204-38ce-43dc-98cd-10f5629bad43\index-dir\the-real-index~RFe658dc5.TMP
Filesize48B
MD5e6c3b5d520be09c6d3bfac070d94a652
SHA1cb41396411e1a88684d2470ead95e56d92ee0a3f
SHA2566d35e2f4d30fdbd5cb4917610db7d0fbe6dd68e1de17f834c12a3d31226d0b19
SHA512774ab74426aba559e7283a1fc6878afe2d8de1f575b2474032d229a1fe6dc3afd3c21d48159ee8f88526803c82668fb39b5a3d1dbbdb42f1afd6a6257035ef76
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ec96e9eb-c37e-4168-90fd-db91b7296a72\index
Filesize24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize217B
MD5d9725f6adf6d5ba08ff8271fced0f73b
SHA1114a817d5fa90cae56a2b76bdbf72389fdf3951e
SHA25642b6e1705b16c9f7b2145e530bfc1e1fe6a36cddf40a03ba5c9bee57828ff453
SHA512cb79c2a17ff66e1bfcc4bc5b8cad04bc3e674b55a31f440d09bd72300cc872c5e9d14a1587cd2b52bf197f9d6c04762e2f4d376156ca5709b5cd7570e4befb37
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize157B
MD58999542cba20d380f79747633a322a34
SHA11b7743c7924b660d3d87a194a59d1b9c4fee0fea
SHA256081ad0f40538c1ec0169b2917ca1b0a34403ab404f680b114bf2d94482af3db8
SHA5129bf03eef051d80868f1c892628e1a07f614a00caa2a910f52bfc5f4eea9ddeca5b9c74ddb095c50d6d4ba8d82b036429ab346fcf9ea27021b10666426669bf88
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize153B
MD50ead918c21838074aa449a6429372d94
SHA1a60830fb2d44a02f8e1a4675c775af98ef2375d3
SHA256c582054cedfdf0476424c45a6884d7a373dab68b2b9b0348b2776a1df4490bab
SHA51279b2adf27242c9e2ae35ed32552d9026489b9c1c7e2dcb7607cb6f4a6e6d99d1521e4c56083e45df1b0e9565e5fac1d069494230a4d4ba1504c56efa70ca1f81
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize153B
MD51c768e4ab8a449ee81131444fbef409b
SHA145204f0d09ed298e174605afe5398b32abc6e5ff
SHA2569f226bdd858dbd484e3fa36e4d689f0ea2ab6c0549fa256e5214070b1f28f8a1
SHA512206a42a652af8ff59cac152d1cdb9fd126a4e9af6bc9f48a06151144e7ce44dab9409fa93a77dc81a2a98a84886e95e1e9f3f4461ccc1454b6f91aff4308652d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize148B
MD5de31633f3b301a8cc35d596d98e13586
SHA1268e636361b11729e8c1229ae9afa0676d0b0bd1
SHA2563a2574f36034366a83940090e4f4b949c16368b9603a973345e0b072e886b857
SHA5121765f5b2b15135264ce644c4a5ad793678f0f5ca775b13bb2a96a3c2dc6ed170be6bca74c40b2ba00741de17dee5cb4a23f1ddd42c02028acad3cfcdb503df88
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize153B
MD511e584e41a8e1aecbeb6beba7f8237f0
SHA1eecfac4f508e3f5620b68ff833af2098e70e32ea
SHA256ffc153e148233597fc378fc7f4a1cdca660f8cb680e498a24ed73fa1c2c3b457
SHA512911a6fb6f1c3b3e66e4fc8d2ca6c7d56b4c9d23dc9339dbd33c1afcaa9c9c9372f69e819f6f7fc6f50fff1f6304579487a697d225bfbf89fabd9a2082396a698
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize217B
MD53fc018a17f950072cddd669226fae9f0
SHA110e5c60daec4e87c7245c120e0778ee166a0caf2
SHA2562f0c15cdb52988edaa45128d387dd6f8d79cdee28dcc6a1de9a295a97e0df648
SHA512e3a9be4efd73134a31bf69f1b92608044bf5d4dabae588a49396401d8b5eee6f1224a9ca904510bca72dfab0aaf5f5fed9affa7e957c330dea7782c7a2a7ed18
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize89B
MD565dee00b3c11ef7591a62c2d6f54ef54
SHA11d0c6832d835b6973ee1e46836ffd1e99fbd2c71
SHA256ba780325fa73abfbe1d62a0b079ca18eefe7471f3983933f58b649560168f288
SHA512dd2ccbd589802e409b91a14977db54b3473594ec9975ae84d09e039e5388dc5fa467aa81958b56f9e128f434a35a490bf7951d0805d268728b9714bd0e94cd67
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize146B
MD51f99eb534d4032c5fcf7896cbadb14b5
SHA12a0c978cd74ba287768f2dc003ff40872f561d7c
SHA256e7709df6f1e0b0051dc86ec5f1ae28bbc7028a8b35f265cc831e27ac677c2e00
SHA51280d61996b643cb73da9a76a69f8c9adb1523018884f8b1cb4cd19c65e19490e64cfc26d1b1a480ed58196625f8694fe27f13dc5fffc6f906d28f2b41f19e87f5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize82B
MD5a10d4d94c60bf373919cf7d4619d70eb
SHA14462df6721f2d88a0485bf763674d5479facd001
SHA25666891961c04fa78ae147b58cbdf15324d128c00d7eedb219378f57a19a210231
SHA51203c56efc7eef3e866724e02335cec4de7ea580053578aeafaff3adde86fc127323762fb6a0d55f3bc55355ea489fac8df7b1347635d6232640c619841def7c02
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize153B
MD5e6f46ae78829fbd7c956f9e3bf71166b
SHA1f75ba95ae4c25b941a2a3006e1ed11b33b9f9784
SHA256fb582311e8b2ad9c0fd3abee966e5cdeef9d30d0b13b59cb807cd3d172104e4b
SHA5122c08ba79a983c07b596e078603ac50aebb32d21e7d6ff352bd5de61fc944f3dba04663149a1d2fb7b993f870f4211bbd752907f672291f68b273203d2c719e2c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize84B
MD579450a5f37c67a5bc5bfe2148e08970c
SHA1cbb82409bf2ba966352ca2a92d49042b5f01ea9d
SHA25691f88de61b846504440f1e496308919efd10c51e07255af4d23faa1e83abcdee
SHA5123cc67ae12f0433ca7a952b19f02ad07df375df57c0bdff95199eda2d407268081e7b9404388a186c15b962e4201546f749dd2c4c0511e9127965420e3dd103b4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD5d2bd19f6ce4a381b89596d14473107ba
SHA172dc82960b5105be4b6ab948080a2e2b05816d96
SHA256ecef7c15e3ec23112e76178b60774dcb2fbc5b1d5195510dabeaf0d91f043cc7
SHA512589b5bb8f27eb38d769b28deabd8d2ed71fafe7a487a29c7a94c1e79837e05fcf50d6ebd07351faca8a1babc05ebe1b8dfb7a8ee4d8214f400b072a7c1c8d647
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe6610fe.TMP
Filesize48B
MD529e1e40415f4d7b562b718f7d610ef89
SHA14b2dfb164662106f291b6902381ec51774fbf832
SHA256f238c242fb78316d5c975880a38bf5198f68101b3e22c337e2e6dcb86c8ca618
SHA512195811b1dcf67192b3a07d25f32fe19b0ae1ccbce809b700003f908486c22f15950214dbbc1052a19f6c8dae747feddb57ca88a1a3bd1068d271ac686d2d0cce
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
1KB
MD5ee14eb7d8aa6a0657c3b3c2c35748435
SHA199aea7082a2d0a057c6bb0a4909a37a48bff1616
SHA256f04bb57e5200082a335af11df730350c4a1dcfa5cb8b20c975d306aba3ec9266
SHA5121e1b78dad33e4824723d041062abedbc2b56330188915ad4c2045c402a7a7765d0b677c987711b27d4e12f4743bff7b83774933147a2d67ec97cb8d5e69e6649
-
Filesize
2KB
MD5a7010703cc517516aa6a9292d50a3d50
SHA170314dc3e6738c3d08b9403d0d89fea66fb91e32
SHA256eb0374b64b55142e816b4c728ca28e7d785f686283da475223d8b7a0392b0ddb
SHA512e20450c3e44662a51e356e01245ee0703bef533e12e6c79baccd8a8dac36239c3a06ffd458aa59f2afa3da70f2a3207d35ddb5228872f238879534cee8895fcb
-
Filesize
3KB
MD57c7daada1b8eae944326682080d201e2
SHA197c18b220229fbb3e1163e479360b6bccf5f2f29
SHA2560e34ed67c0c2aa633484a7255b3a6a05b5f700329ed902fcee6371a0f0fdc218
SHA512bb7320c723d543beecee2f62588618088d27f6c98c88cd3d92920c978d44af352841749ec6d4dbb38739b20cc41ff876d7dd134bdcdd00b6154dfcb7a0ec182b
-
Filesize
3KB
MD53b8409059b0c636b093440b76d8cab78
SHA1fa5a0bae244a56e8abc5708ebca79b94796bcf0b
SHA2562a3d93ec5a9bef2272cb853b7746b745c13063194883bb1a52fe2f4edbbf028a
SHA512fb92be8f5a9836659fdd1f257139f1de05ca587487cb0e04496f567bfd7bb7d813deb471db206464ae5317cbe00d1a6a4b393fa44463ac978a7b4a09490a5267
-
Filesize
3KB
MD57403ad6f6c154c7028144ddda3153306
SHA1db4ab7922107ae557fb3b0b6117f9e08188bc0d5
SHA2565b2c356a3729dd1afc8acf99780a46234cb8ba674db9ed04d70d42b315bd5b35
SHA5129dad3a87b26bfccae2ce5a005e6aeb2a232432e9a3f13153be5b78ae92cd013b93c4c91bba3f537386f5d862aaf7c16c9cfc103ed876018ce0c0a0faacbcb436
-
Filesize
3KB
MD53351449f8eeb89ac2eb6b1b8ee6d167a
SHA1bcbe23affedfd9ac85e51bf1595c199746e2da23
SHA2562297cb389cd8dcb6e8c020e66731f8fd2ac68d56753e2fd86d66cec1860081d2
SHA512d053a7ba7d05e8f35dd8e6bbf67dd702f9481f5d3406422af099bce6f9ab7cefef59be2da0fde836dac7df48106ccfcd249b536ac90382e848e273a0fce3e86e
-
Filesize
3KB
MD5ead6ff20c3bfc416177aae9379a03861
SHA18a26e8058baeb12fbc4f3bafeefc7a55d1ff4b07
SHA25674ed9b513198c24eb49382cc708a20785b15d7902daa5faaf27a182702132eab
SHA512beb6f77d4f3132d88bbbd71afb83ae9262e5af15c86de3aea5df54c3c6c29cbec06255bc293d44596f6442f4d0a5d792153d5e6e2c2f9c065761789f557af63b
-
Filesize
3KB
MD531a0feb9924b0bcdc17c83de9d3e0afb
SHA171981047d6603888cca493e1bfda819ce930efcd
SHA2565875f1f5e476de6b32510e24460e15c49ea8c574de79a2f61eed13b0ae21b039
SHA5128ed1f76e3e418dd059b5c05d884f80942db202c1145fbac2e187cb669dd588176418e3cb98ee32f1ad1ea46b394af9181c9e2c99ed4531faf2b6fd000c094086
-
Filesize
2KB
MD54ee077225ad25c97f35fdfd9435404dc
SHA1d30bc5f0b3a256e7af45184454231d57587d96a3
SHA256ba3016e7ddd360b772e536d0ad322bf40825684f5217451da9a169e08dc2fa92
SHA512313f580519de927dc9a5bb8819afd4674b99a7db84478c0e2969c4fbabd7f3912b35c4debc2ae47f355ce92fce139ae67679b41f758d30f8a0b6e3e1501076a9
-
Filesize
2KB
MD5e06c6bd8b4bf6dcc47a570e2823006e1
SHA132a68c637a825c942d124603cfdd6ce6ede886c6
SHA25635d005cd2c6b43fbbdf5df5403ba531fa2c938cafe1f6d811da941c09d0020f1
SHA512b57c9c8b610f46e69677c842b952b0ea9ef3e19822de366babacc8c39f17d1535be180bb6f1924257995b4f4b793989849b2afe3ce38aa9e5e8d70cc7b5100aa
-
Filesize
1KB
MD5a834d66297f761af140a7f59126ab1d3
SHA19a9e50752b528af8f54ee14c462c50e004d4ec6d
SHA256d3b4c58ecf366dad357f89ca2953e12f6b64070f754e76b562b05c16c26877ea
SHA5128b56eee284a57193b157bea8acce6c9c1b92924c306f1c6b063266785ddb948369e643d764f8c879a08bfcc172b38d80b25dc9af5e0f408a63b6ad1de89eb962
-
Filesize
2KB
MD5bd542f23e08da34103da6806c948bf96
SHA13732d1de803bf1ac2b4ea2bf5473317bff8809ac
SHA2560d1781121f7c882a73f89869f8526fcbb459fc73f9f7bc4b16c379551ac29455
SHA51299bdac6bad03049aaa13cdd6938fe95f7be6a52558e4d68d4371e91a806f0cf3555dc45a631e457f9f1f8cb1a8fe6edae5002bf7bb8b722103cf986b5655609e
-
Filesize
1KB
MD5daf4810a9c0f7ac0fdca30e395778db3
SHA1a12bd95daefe462db14edb7f58c660c50059f056
SHA2568425f0720da4a20ed3ec3017dd318ab4f3c638c165bc08f495c126284e9caca3
SHA5127dd1f7937579872a05033ad9df5f581f38489a170fa3dfabf094d1dab779fadc6942d3367e2468611e64bd2c5398902320e86618b0138445199b2645a674e628
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e04c5fec-3c64-4ff2-b18c-564bdaa7a2e7.tmp
Filesize2KB
MD50d6d7c8a05e1f7257a36cfc7c4479339
SHA19b6acd7df01183bb3838b5ee8ac415603b4579bb
SHA256d7855b595b403fb52685c155f9c5ae9fd3771c3c563fa6781725936a594d4540
SHA5126e6a20baf37beb04c89108497774f56c141b3f0f4d1888839ba8188930f5c8c396bc40fb25a16cf650cf66487d917de9e660ccd4e12754e79a21d93baa1a79ca
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD579a4dd290be45c99ed267108e6a935ca
SHA1a903d5e9a743b42a596e389d63c91759dfde3a46
SHA256687d1c013d713ff2e6f4c3c9f5eaa8891894b90b5fa50966c2891379bd4138f9
SHA512307a73bce435f94983862716d815ea71c549af1580a89e4b9b0ddf6f9aa8c5302a8ce9eadce2601592655c2872cd25d7dde1c21ce8ca6dae4c3e3357afab5dbf
-
Filesize
11KB
MD593d6f2dc92a6f5e647a38b1cac251fce
SHA1391f9c31d048c3c429486d9006eba56dab6baa61
SHA25627cbdd5dd0a4d370ba0144e036fb8c7d5ad98003a0133224c837075ccbb3aec0
SHA512b508ae44883e9051d455093a0d9efd077c70c4fda3b6f8511f46a6561e622807ce55c4e1d2999a200a00b2be7b67dc8441533b7ae5853a15bc986e79adc0417c
-
Filesize
11KB
MD52beba88ffd1b8e9b0dc3245179593293
SHA1d88f0ead6e54766a739f1e4887cc2bb0bd572f6b
SHA256ab644458b8bc982699b39b2de2b031ae9c1196e0efe431d6221ac63c5e829d7f
SHA5126c3924730ee28c1d1195b066330402cc91bb3131288347fe34fe3df1cf0a00ca4d23ce1995e2bb0a665f115b4e2dfc11918a88830e4c47aee442449bce781162
-
Filesize
11KB
MD5ec59f74cc632cb584f36e50e667126ef
SHA18f440b8075a217cbf2fa613c1335a95011ac7055
SHA25691030ed5657d28b2e2f4921a139a0f6fdcdab5acf446c5bfb4b47ce9785235ce
SHA51204e2ff292c69312765d7920e584d82beed5af5a645701c1c3561d3ba9398816c1c5707aa5244aae69398b644a9b9cf459d5da325d6da47f12b242a3e17066a6e
-
Filesize
11KB
MD589290baf3d08adbca169a2c8e7aa63e3
SHA1f843f854e670ae67a9974a872098e8244eb47a71
SHA2563b9d9581ab715b89ebbfdc406b274a43de9c5ece2ad55cf3b5217a83a4da60c4
SHA512c2475565d46fcc7204cfd65a90154ca1767869142dfc924caf44ddfd5f57053387349093a1b1a69db3ecd68d3ffa1d5b881aca4e8eaf784aa671986ac6a77f58
-
Filesize
11KB
MD57618aa844b8419f1166e821702693221
SHA1cf7b265337da145d6a5bb2098e763618014c1cfb
SHA256b18eca9c8aec54cabb277ebcf58c70b298f7bb23f90e456640d47cacdb3461bf
SHA5126cfb287b620db0823eeae97f17c8edeb1ac35f2a42874aee64b60f3b2c7da94c9c13342dd057583d99cc6f71a23396945fb34f801d89e4c4c6801e359a912bf4
-
Filesize
11KB
MD5ee3b4f7a106e5c65aa8046d11bed6a35
SHA1462be87e41c7e0c8c86a72ef100368ce930d90ec
SHA256e52702b3d27db707b7f1ed86a367e2afc28924c9f5de85c59ce85c4fdb6539b2
SHA512c9aac566b5bceec9e301319c16a490b034ef2e67f755eee1e2ed09a83ac0b9884bedc87afcef4d42ce6ba818a65bfbdfdd969dd7ed6eeb93781d1322e025a032
-
Filesize
11KB
MD5bc8bab90290fb8f8d60c633825a96e9b
SHA16f5569a8d64cc00654f39ad8c14f750b963a953c
SHA256262a163e794c5ccbb6c92c047eb8a435ae480ad4db649064cc85c659b3fc9925
SHA51241081006ea84226c1e16b5726c532a6f0a1d2da87cf0f4c725bce80920f026471eecd689f691d9500d1ed942f639b51dab1aeacad22aa18cf2fa7b502c5278c1
-
Filesize
8KB
MD5869bc033e8c412784528ad840f56ade3
SHA196ef994905f663e2804085db5063031978aa68e0
SHA256c3eb579988dd6595bf5a9d06d884a309b111662dd045d8bc6ce344a744def2a0
SHA5128ad57803354d4771daf15cbb6adbc5b00f39b0e133d870a15a669efa489146d3aa25628b72f49e4ec175dc7793284d2b81389442c38cc8d3494ce3edb5b9757e
-
Filesize
11KB
MD56a1e5832010b945548be4bae7f03bc8c
SHA17f6bfbc59e852125376239eaeb238c824698f4f2
SHA2561ecb92524083937c3b13de43a7c641ae087f9eaf9552feede3e337f7c81f2ae3
SHA512ae2edaf0f2f73940aa99788d490ea9085b96cc8ec965ac705d6a1acea106223ffc29315f68b972e866db8c00038be47b1fa523491456538121c123617bcb504d
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\.sentry-native\attachments\ba8c19b7-02b8-46d4-a0ef-effb53fba139\__sentry-event
Filesize409B
MD53461188bf304901f7bf1d01e6ee3ccc6
SHA12ddb29f9f1b4ef96cd0a4c5161eeb141768ecc42
SHA256e8e2acb09a4768399c1e96d837fa0aff2ba63b1a124ee38cb6eb2c622f10b265
SHA512357b200272630238180a5fcd709f8943bcb6c510af7a3519ec4a13316cc79b0b95a11a43e28239ca8db59dce3dc27a7c672d2a4c63ab53f0bca9186522a290eb
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\.sentry-native\reports\ba8c19b7-02b8-46d4-a0ef-effb53fba139.dmp
Filesize9.6MB
MD5355b447f17d058d0e9029bb5db8fbeb6
SHA18e2c0b830d4a63d372db444ff2ff918c88ac2369
SHA2562b2330432d4f3a2504dcb1cb2562da56e4f05206f5aa43acd705fc5d433dbb25
SHA512729d98dd48ab0df21680923b691751c982ae626001bec97efba6b2e88f9310095201f5bd6a73bf95e0788a4ffabfc95c854f18f4c39d84de9d05046b5aa13b34
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\ScreenRec_app\qml\QtQuick\Window\quickwindow.qmltypes
Filesize215B
MD52006d4b7d0da455aa4c7414653c0018a
SHA16685b8360b97799aa4d6b18789bf84a343e9e891
SHA256a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a
SHA512703804e6fab0cf44317b7292c547a1348e2e7395e4b71367c32c3b097bcfb3344d3296179bf4ba33a4c752ae58a3873af57d8cdef35a34564205356bb4e6fd84
-
Filesize
8.0MB
MD5848bf5799df2fe53e7f2022a5eaa8acb
SHA19b821450498dbe97beadc1113ad6a2137cec82b6
SHA2566ab605c101b9fe4aae3489c1d3b428316e559d0c2e021c83a47ac98537e5059d
SHA5123cb7389654433bd851c5321274e306f1e0fb42b86820d091503b412480ee47c271c6b44281dea799724d21b890473d85b1bc2f603474ba4c4865ca28551e668c
-
Filesize
207KB
MD574bcd4f1da5c4d6b2c9d6484a91fb1b6
SHA19b078c07b24ade4c9f6f284c54f22494fbfa5cb5
SHA256804c6d5926bfa6c54637d456c19733ed1193ab81a416f222c005324bd31da78c
SHA51276f6f079c0bb9222a503c6790b1dc851e22f8569ff28347a50cbe2748392f4d976b50320c39ed5bcf6f0fa1aba81edec9d441d78dd12bf20fdbe8a5b11e214d8
-
Filesize
5.5MB
MD5630d75210b325a280c3352f879297ed5
SHA1b330b760a8f16d5a31c2dc815627f5eb40861008
SHA256b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
SHA512b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
-
Filesize
17.5MB
MD52ebc7ea99d649093ed4a36f24a54896b
SHA1a84f2be8eb7d338b0be5b872abf6ac7875770a24
SHA2568a64ece89763bb75fb23a728078447768d4c6941bd0e11681ebfc86e273f7bc2
SHA51297f956d25d9c82a5ec1cc52b5bad4e1e604043b4ce54878df0dec882f0dab5ad6ead1f967f46bf8b07326d3333bc38e7267264b068a35ce6bba8388995ef9bcb
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\screenrec\cache\qtpipelinecache-x86_64-little_endian-llp64\qqpc_d3d11.lck
Filesize62B
MD5bf354b988ee6e431b005c19817443107
SHA1a1ea7cd81132cbf0f1daa6a2fa4090a4e1d82cf0
SHA2566a873df009d93383158b75196497fc2484aa86107003875c2b9ea9ae31612310
SHA512488a59281251e0b1f49c10293832b8ea37cd1436dba34169d87cf0a469b2ff26370c544e41a77ace63dd676e95c630332cc558edd4ae398845c0d0480aed0af4
-
C:\Users\Admin\AppData\Local\StreamingVideoProvider\screenrec\cache\qtpipelinecache-x86_64-little_endian-llp64\qqpc_d3d11.lck
Filesize62B
MD53432f146ea49ca861b052d6b92dfbd68
SHA10ee271d643d9472dca847e7f0ddf1258141c1ce4
SHA256ea03c0e07ea8911fd0a6fb0776989f8bd53e6eaebd24b2c41eea4371aa24bdd9
SHA5123b6ee5c0f205ae9da95a42d185cb5686977504e4ad924523f4ba4ad437b8851d77c8e9d0b94682d5324c0f785d05a2ac7bfe60b727c063f431b7c39dde3db514
-
Filesize
16KB
MD5d7b162771d4cd8ff304afbd949f30093
SHA15cab61e2373a8dd49a13f348a14de008667850ec
SHA2560b6077c1b8dd7999a38954978f7e185b5a08682615b464ec05797a5efa822b67
SHA51206dc9f4ae8cbc0803d04b4b6223b37f1e6eb6859897958e17621582d8b3e97e96058dad47c1095a7face6322a36783d8cce95d4b981f9813f3dc9a50bec297d4
-
Filesize
3KB
MD559b7a89dbff790d69e01409dbc2a2788
SHA14ebbee3ebb35add8c1a0e436a4e4c9c5ba47c02a
SHA25617b9038e66f3f45c4e775b32ad1bf076812d1ca4149198b47f4e0eda416859b1
SHA512c202034bfbb7aca777326e7fb336e977e79cd9ba3bc7c17e5b6ec9c0222f6df2e1675b7d6bcb3de04a84e6226b193a5e0b81af950bc659fab83d12cd2fb84c04
-
Filesize
25KB
MD540d7eca32b2f4d29db98715dd45bfac5
SHA1124df3f617f562e46095776454e1c0c7bb791cc7
SHA25685e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA5125fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
-
Filesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
Filesize
7KB
MD5d070f3275df715bf3708beff2c6c307d
SHA193d3725801e07303e9727c4369e19fd139e69023
SHA25642dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
SHA512fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
-
Filesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
Filesize
1KB
MD565814f56ac1452f0f61fc20587562091
SHA18eb619b7fdc8bbf6878cf6579b3756c2ccf26d89
SHA256b340a3d7cac9bbdeb3373485e07da44789ad7e8a633aa67456ab89d8eeaa8dec
SHA51227d7fd20f49b401748b3e9c988b36796f4d73f4ea0ad72b12d62e54ac161fa0b9daefec2544e4961a2ab82ba4cf802451d973d920c5035d61704a1c603482449
-
Filesize
1KB
MD57b730c727d6cc8ff623e41737529830d
SHA153bc16479b5f5f6c896153caf373dcdab943bdd6
SHA256a6eaa2993d281ba1decad4869f79dec5da25b143622e5a9641770a3b99f45e87
SHA5126a1feafc0a3c3b4ac2d0e9a005638eeac31ca2b5c6dfa101fefa77e743b6acd3ca3c23bf71ee00cf0a40c976a1f09880208cb5f14dadc1a9c68a1c949928efee
-
Filesize
1KB
MD52abc0febca07e7716cd64abc27ba64db
SHA12d6a0eb98e6fae3994905a716d8ff84c7901220b
SHA2568818b01688b2ba3903b05e6492ef3ced1a1478e392a146eb90cee474113d6afb
SHA512df9e1487a3927bf66d23b3593520f32c87752c3b60a9447ea39ae9d0c4ee61b6be0d137dedfc3f0de1b4b04907241915ddad297f805f356e2027101060447499
-
Filesize
4KB
MD5f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
Filesize
12KB
MD5c5285d861243f3b41648af5c0ffd5678
SHA150012e20b898e2f1abad27a4bdca12033e618add
SHA25635e54b12771f671bd8d9677369eb8216b54de0608a07a92ef17a4c29a841935f
SHA51292c687319e989199e392a81bbd16c00a551c1df9fc3535e98b2da0604424b148a4c379578837aacfa4e204d494c0f0b0ed4f7638cbf7462bc937b4e198631350
-
Filesize
88KB
MD5bd97d86d8bd07ebdc8ec662a3f31dfd5
SHA15e2b3a1af5ee53ab6d1d6c2cb8127add39ee7e82
SHA256c31b590cba443de87f0f4a81712f0883ac3b506f3868759d918d9a81f84ea922
SHA5124575d1ea0d1b2f74df74cad94eae7fdf31c513e5dc6d945e81e0873b99f94a5d81b1c385c71ab79a19e5bb6c00fc5fffec7a3bbfd60ad7de312cbb53d8bcce9a
-
Filesize
179KB
MD56bd5659d9525b9d710e0feefbab32be5
SHA1c4ccb03b19ddf4eb594cd382d001e2eb3244bddc
SHA256814df60b30ebb806806058dcc076a9aa84617ab14b8b8bb09f8e0e612b708e28
SHA51296f1fcaffc7734c958d8b2434b76fcb668f9b205024b72297beee6343c5ac9621ee1fd80976acec4a702cf5bc6184e1425a0140e477e776a6ffab39abe529cec
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1669812756-2240353048-2660728061-1000\97dec878f6e2206c4725dc9d23e890e8_6962ce98-49e8-4fd2-a97b-067651396527
Filesize3KB
MD523537db8f029452b76de8b13ca2dcde6
SHA1102dd4e6e0c7762a48db5707466186c2523b7007
SHA25614409dd2098259de659ad5ab2a4ec41715fc95cc6ee5eded35099219d041a7a8
SHA512383f7de7ce87ba1762dfe84dcfba22071c8edcffb5939d3fe3e0ada5841137d36175982abf89e6424e03d8817921e2adabf8c413a08309f0fd64c93e934c08b3
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD533e9b3a6d81cb2b00f844059be77ad88
SHA18b01da2fe7bc2f4b87ae3d8805d35f63580c2cc5
SHA2560a12a7e37cd3d338d3ecee626760b1d9e3a35781724c43f4574e9e6562632feb
SHA51217052cb9de21cfb2c23945c000dd294d46ef13d75d2690ed1d9bdae216f3aad413ed4967d3ecf87814e175bd2878b0650212e5ba88e8d184789e504601cdf894
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize12KB
MD5e2e2a25090ff1c4a71d4aa76824ba6d2
SHA11da0bacfd263941c72788395517b3418f093d541
SHA256f8af04bbc47a0fa79555557f8d82950d4f12e430218781aef7c77fe95fd6de9e
SHA512dc917faf517335f68103569db4936af555805c125c37c0ccc9e97d2c7336a6dbd07b639a11dce10eaaade15d4290064a91381ca28fc861df7c02090feb1c532e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize7KB
MD5c4b034074ebc7478e7e37fd0cc60b364
SHA14f6f4e2efe875a6f6c9694213ca3b9c26410957d
SHA256a5ae67be188bd96a2bf8b66c933a573cc07bed1f3715517b6da259a945e1f212
SHA512da7dd911a3dcbd00391436e6044aca9e0b03c7b6059efdf2961e6b46c40417f3e62bd93c61c0b5fe9dbe837329e7dff3209a4f361dfe04477abdbda602bca324
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD5effbf3448bff962c8b858f8740b636e5
SHA11f73e35c9a9dac1c9c7ca115b68d2f0bda3ac814
SHA2566914563dfe9f5eb09d732bdb452297e64028779ff1d134740b458ca7c3164b99
SHA512a76977768cd975c3aebc6acaca3ac55558137a7ede73711fed0679852e596222f3da0dadd204707695c2a55e5a839541569a4fa5b44098133ebe00bfbfbf6160
-
Filesize
1KB
MD5ed4dff8e995d9f35c63600783560f210
SHA12ced385257e082e42921e49605fede2d9408b265
SHA256bf2058e7914efbbbf93bd1c6f54b936d7f293baaf18efff0370ffdfe7b063f95
SHA5126580c37ea07a3e1e58fc2adaac6980daf0e198447ffb438c7160c4fdfbe91b8386a9f1e3f2068cf7b0e43daa59cf4bebac0948af0fb7b4c9ff8a211a086f8077
-
Filesize
4KB
MD5ca39d245a2ef0d726fbb3cb355ce11ec
SHA1fa9f72f24d96c35c6f07784d5a1a3389a8ca50af
SHA2565bdaa490be6e933ee2941c167751cfa700c176d22dfa365d721ef764841ff34a
SHA512b2a0981acae1a960605693857b5a948a87beefc856afaabf625329a45406a974c8a61cf0c4819246332c6be4ec5c2f58b759d906125bb45b52b413fca42edc4f
-
Filesize
371B
MD5482b40c0d7aa8a3d1bbf44e34b4d2ca5
SHA1d6d24c92b01a2d8a1e9cd5a15669443091f1c7a7
SHA25640adac53b3488585f0bd0dfc919d7d145184d4b78ee7641d721bfdf141571c31
SHA51264774f6c520ba1b99c353d79747e78d07dce9220ba9d4a0d81d8abd6d593ef32941b73d7795e1666b0777571bca194d9ac7b6b4394c1b2bde32387ea4ee2f813
-
Filesize
3.3MB
MD513aa4bf4f5ed1ac503c69470b1ede5c1
SHA1c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00
SHA2564cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62
SHA512767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d
-
Filesize
371KB
MD5befe56bc953b50620e8c00ca31293896
SHA160b7e831d652a2f4d3cb2f8d3e864e110ea835e0
SHA2562b364c5052c0c8f12f68907551655616d74f2e89f94ad791a93e58c9fd1c8f6c
SHA5128e51401417a8229ec9ba7a5fc221f735a08d5463df0f4083ab6ab170b7b2247e26b3a10de745392a65f75f976fd98300d7eeb948c52541ed78b35357d0a49ab0
-
Filesize
3.1MB
MD5049ce45ea2a457bdf11c06306009bc74
SHA18307e387a7c4aa2d005ac4d06f123803820b1015
SHA2567c26080a07567a00957175c76cbadecb137d95992cc1e8861db81dfe7b7857f6
SHA512c456ca0a09410dc34b91f6a778a8498a27bc8f3f72d165e88c116d55a2a9702ccef96a1d28e9beddb979f1102b09d2b8d36e390ec9619ca8084fe7f5d602759a
-
Filesize
3.1MB
MD566ccee3761f57922f2e66ad34ed1f7af
SHA156f8966155e997aaa82e8bebb8bffe0c294a38fa
SHA256778549ece4ed22b180c62c9fe9cf336bd2118e7aa3b0ccad61a018cad81bb07a
SHA512c71a8c0f834217ee6b265c1fb9418b128bdf7506c917f0504ddb25b8a6f3765dfc54da693771f07b07a2fc3ea6efedfd64a095259f8bfef8fc75e6cb6dacb217
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
76KB
MD5006f8a615020a4a17f5e63801485df46
SHA178c82a80ebf9c8bf0c996dd8bc26087679f77fea
SHA256d273460aa4d42f0b5764383e2ab852ab9af6fecb3ed866f1783869f2f155d8be
SHA512c603ed6f3611eb7049a43a190ed223445a9f7bd5651100a825917198b50c70011e950fa968d3019439afa0a416752517b1c181ee9445e02da3904f4e4b73ce76
-
Filesize
15KB
MD5cd131d41791a543cc6f6ed1ea5bd257c
SHA1f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA256e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
SHA512a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
-
Filesize
9KB
MD503e01a43300d94a371458e14d5e41781
SHA1c5ac3cd50fae588ff1c258edae864040a200653c
SHA25619de712560e5a25c5d67348996e7d4f95e8e3db6843086f52cb7209f2098200a
SHA512e271d52264ff979ae429a4053c945d7e7288f41e9fc6c64309f0ab805cec166c825c2273073c4ef9ca5ab33f00802457b17df103a06cbc35c54642d146571bbb
-
Filesize
788KB
MD584c1daf5f30ff99895ecab3a55354bcf
SHA17e25ba36bcc7deed89f3c9568016ddb3156c9c5a
SHA2567a0d281fa802d615ea1207bd2e9ebb98f3b74f9833bba3cb964ba7c7e0fb67fd
SHA512e4fb7e4d39f094463fdcdc4895ab2ea500eb51a32b6909cec80a526bbf34d5c0eb98f47ee256c0f0865bf3169374937f047bf5c4d6762779c8ca3332b4103be3
-
Filesize
141KB
MD53f0363b40376047eff6a9b97d633b750
SHA14eaf6650eca5ce931ee771181b04263c536a948b
SHA256bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c
SHA512537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e