Overview

overview

10

Static

static

3

33C2ADEBFE...7D.exe

windows7-x64

10

33C2ADEBFE...7D.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-12-2024 17:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe

  • Size

    72.2MB

  • MD5

    33c2adebfe2c3acedfb34ffff8151b7d

  • SHA1

    8e93f7ecafa92017a7d528423574ab5cfeec754a

  • SHA256

    773e13fffd0842e717ce55e2a678da37123c55186f9c92460c671261b1654ffd

  • SHA512

    6f545b4da55412ec78de6d1c3bddbcc6bb857b7d13b15fe4bb832259dbe1842d44a02b46395233c23ca57abd34239226a60c9f7ee26fcf82ba383a836f8d61ad

  • SSDEEP

    1572864:yIWs/6+mI5n17YTIytz8ATFiQiFGaaoE13gIFxXtzM/zMfCOA6Z:ssJmIBiTvR8UFiQYGvoq35FVEeCOr

Score
10/10
quasaroffice04discoverypersistenceprivilege_escalationspywaretrojanupx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

167.71.56.116:22269

Mutex

3470ac31-30aa-4cf6-ab0a-1ed0dd64656f

Attributes
  • encryption_key

    33E08519CDBEF59C54E93052681A76D1969C659E

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 2 IoCs
  • Checks system information in the registry 2 TTPs 8 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 15 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe
    "C:\Users\Admin\AppData\Local\Temp\33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:696
    • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
      "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2756
    • C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup_x64.exe
      "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup_x64.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4076
      • C:\Users\Admin\AppData\Local\Temp\nsdC70.tmp\nsdCBF\TeamViewer_.exe
        "C:\Users\Admin\AppData\Local\Temp\nsdC70.tmp\nsdCBF\TeamViewer_.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1128
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2212
        • C:\Program Files\TeamViewer\TeamViewer_Service.exe
          "C:\Program Files\TeamViewer\TeamViewer_Service.exe" -install
          4⤵
          • Executes dropped EXE
          • Modifies system certificate store
          PID:1920
        • C:\Program Files\TeamViewer\tv_x64.exe
          "C:\Program Files\TeamViewer\tv_x64.exe" --action uninstallpnpdriver --inf "C:\Program Files\TeamViewer\x64\TVVirtualMonitorDriver.inf" --log "C:\Program Files\TeamViewer\TeamViewer15_Hooks.log"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:3560
        • C:\Program Files\TeamViewer\tv_x64.exe
          "C:\Program Files\TeamViewer\tv_x64.exe" --action installpnpdriver --inf "C:\Program Files\TeamViewer\x64\TVVirtualMonitorDriver.inf" --log "C:\Program Files\TeamViewer\TeamViewer15_Hooks.log"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          PID:4380
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3200
        • C:\Program Files\TeamViewer\utils\MicrosoftEdgeWebview2Setup.exe
          "C:\Program Files\TeamViewer\utils\MicrosoftEdgeWebview2Setup.exe" /install
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3336
          • C:\Program Files (x86)\Microsoft\Temp\EU61B3.tmp\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\Temp\EU61B3.tmp\MicrosoftEdgeUpdate.exe" /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
            5⤵
            • Event Triggered Execution: Image File Execution Options Injection
            • Checks computer location settings
            • Executes dropped EXE
            • Checks system information in the registry
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4544
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1944
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:5112
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Modifies registry class
                PID:3748
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Modifies registry class
                PID:3236
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Modifies registry class
                PID:212
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNDUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNDUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Qzg4RUU3ODAtRjBCRi00OUEwLUE0MDItQUY1Mjc1QjJCQThEfSIgdXNlcmlkPSJ7REI1MTNEQTItMEYyNS00Q0E3LUI4QTMtRDNCOUZEQjQ4RTNBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswQjBGRjQ5NC1FNTk4LTRENDMtODQxQy0wMkIxRjQwMTRBNjR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTczLjQ1IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1Mjk5NjE2NTk0IiBpbnN0YWxsX3RpbWVfbXM9IjQ4NCIvPjwvYXBwPjwvcmVxdWVzdD4
              6⤵
              • Executes dropped EXE
              • Checks system information in the registry
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:1216
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{C88EE780-F0BF-49A0-A402-AF5275B2BA8D}"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3284
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4832
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{818a1fe7-2caa-fc43-9ba1-d8a46c698fba}\TVVirtualMonitorDriver.inf" "9" "4e60e5847" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files\TeamViewer\x64"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4828
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Checks system information in the registry
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:4472
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNDUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNDUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Qzg4RUU3ODAtRjBCRi00OUEwLUE0MDItQUY1Mjc1QjJCQThEfSIgdXNlcmlkPSJ7REI1MTNEQTItMEYyNS00Q0E3LUI4QTMtRDNCOUZEQjQ4RTNBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2OEZDOTY0OS0yRTY0LTQyRjAtODMzMi02QTAyRDhEODFEQTJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzAyMTE2NjQ5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4516
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\MicrosoftEdge_X64_131.0.2903.86.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\MicrosoftEdge_X64_131.0.2903.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4828
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\EDGEMITMP_611BF.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\EDGEMITMP_611BF.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\MicrosoftEdge_X64_131.0.2903.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:736
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\EDGEMITMP_611BF.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\EDGEMITMP_611BF.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.109 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\EDGEMITMP_611BF.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.86 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff6ee7c2918,0x7ff6ee7c2924,0x7ff6ee7c2930
          4⤵
          • Executes dropped EXE
          PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Installer\setup.exe
    Filesize

    6.6MB

    MD5

    69221ee7ef83d7eb340857b5833eea14

    SHA1

    d7f27c64b62eefe2c204a323cc812fa56f58ce1e

    SHA256

    ad14d7268ee8a9c3c89e7cf62a8a9b713c9f37069fe85b3f8fe525dcda8cdfc9

    SHA512

    8df73f03d7438082b9e8793f5346a7385c91139d879703dd8c32acfdacb200c18231a5a9cedd7836c892ebb7a8888857c68653728b9027ca1f483a1751fbe2e3

    Download Submit

  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    Filesize

    201KB

    MD5

    ae0bd70d0d7e467457b9e39b29f78410

    SHA1

    b4a549508cbc9f975a191434d4d20ad3c28d5028

    SHA256

    4d9f16b00bda1db65b68cb486f7ae1bf5b32aedf7fd335e4a8ef2fa087870986

    SHA512

    cbe2b5ffe647f5318edd9825ea6536d6d14dab66920def0323fb5b4dc03a4f8b6781b9209e5a557ab4d270b3f2b170797e6bd807195c93869367c0a245a3168e

    Download Submit

  • C:\Program Files (x86)\Microsoft\Temp\EU61B3.tmp\MicrosoftEdgeUpdateSetup.exe
    Filesize

    1.5MB

    MD5

    b32d72daeee036e2b8f1c57e4a40e87a

    SHA1

    564caa330d077a3d26691338b3e38ee4879a929d

    SHA256

    65f6efdf6df4095971a95f4bf387590ae63109388344632a22458265ab7dd289

    SHA512

    b5d62ce1462d786c01d38e13d030ad6236ce63321819cf860cc6169f50f6309e627bc7709b305422851779e37dbae9fb358008aad8d6c124cd33cdec730288d5

    Download Submit

  • C:\Program Files\MsEdgeCrashpad\settings.dat
    Filesize

    280B

    MD5

    11d46731abdc00088874e63787150873

    SHA1

    c4e6e79abb090cea74c0e475487fee6f2b6f40fd

    SHA256

    13bfc8e167b9a4f923cb3f6ff02d33633f18a6780b5f8fe5c083dbe7b00fee2b

    SHA512

    c1fb96a7fd9997b87cceb93e713d48aaf034950d0adb02f1cf96bea07e9e72c168acac35eab630f28920c55ca231bdb16af0ad1850bd0b51052cbe1e3c0644b7

    Download Submit

  • C:\Program Files\TeamViewer\TeamViewer_Service.exe
    Filesize

    21.6MB

    MD5

    e901c556a63e8738affa2d2f1c82da4c

    SHA1

    87092e6c7a60c8e8595a7c034dadfaa55dff417d

    SHA256

    4e40c3381fb5a99bcc4adf2e3b6f3ecd1e224c4cc22b39648552ef4514ea933b

    SHA512

    314bed464671b2b5e9a94b3ea2e3bb2e3899a5b5cafad146691b5a6a009d50414de2a84b518e2f7b253f55cd7393eecf7f5c3d73a9d443164689174069ff21b2

    Download Submit

  • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
    Filesize

    104KB

    MD5

    cf41f1f18d60a54836ddc5a77a970d4c

    SHA1

    768436e7116082f4756d4758cf4594e32d69371d

    SHA256

    733bd6531820e9988627370b65e5c6460baf9044bd09c34751ed5e9d7e9ef2bc

    SHA512

    4c6db1630b2591537ad65357907bb6b29070a1fe3c49ec6cc198a7ff5319d03b015665ecd88669810e8a548ef3e618989a18ed83dfba7a132550ab23e1dd75a3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    Filesize

    3.1MB

    MD5

    181719b653c83d0463d89a625a7f5c3e

    SHA1

    1173005be27979dc74779e60dc790299e4f2b0a4

    SHA256

    03a4b081b4966130cbe615ff249954e7e9a0d62a79faf8e56ac3830929748e43

    SHA512

    d05e6fc586a8731903df4cffe3bdcb92f99e2cdbe15e40706e87ecc038e4e9b1ef1fc9a39f8adeda4341e3507f2f8f81ae50d590ff9f4233cd7694b26fb3fa04

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsdC70.tmp\TvGetVersion.dll
    Filesize

    686KB

    MD5

    878c644c12c3d96438c2909fbb7375cd

    SHA1

    4fb206e213bd088e28a1c10ab815d1bfd1b522f1

    SHA256

    75cf60d72a2cb6a748db6f69e2bfa065422df7bb6636d3c214f5435341574a66

    SHA512

    df0d1903901ffaf7ca1ee22cc5b8bac37cb554f78ed07a8ccaf84a2cd6fb7f9ac5599caad83d92079e170190701a9391468331ec8aa562bfdf32376703e05bd8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsdC70.tmp\nsdCBF\TV15Install.log
    Filesize

    4KB

    MD5

    a2ae58be95ad63529af19680bc702e1e

    SHA1

    e3c3161681ae362b693f4c255c18b97d0b45b048

    SHA256

    4dd5a9d3945969b33b7055a7aa0b37fbb8af6bce77cf09cf098a1718aa74d25d

    SHA512

    1e7c737c3f31dbcab0085e0d023df39beea567f8b3ce2591a74cae230b6a0261018dcc84cace098fe837dfa54d83dcc61af5370a6a83e23996f5f0a0e4f88ea4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsdC70.tmp\nsdCBF\install.ini
    Filesize

    78B

    MD5

    a3c26dd25fc88922e9297e2a9d04ac53

    SHA1

    807b0ca16c4080b6ce7ae8b09e7dcce7e52d5c19

    SHA256

    1c5231379c3025a42d51f956f649c445ebc550f9ad9b9f5cc4ae5e627ef456b3

    SHA512

    1d36ee7b43d82b72000520c0b0c37585576363fcd506aeab362c544000b0bf9702a357e118b2ae3499d8f8c9a7529f56169cc14e5281a5246ae9efd342c4fa59

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsdC70.tmp\nsdCBF\tvinfo.ini
    Filesize

    50B

    MD5

    a48b05e8e36f7f4e9096ade8950b87e4

    SHA1

    c743c68fb5798389435927338d1c8ed1c59496a2

    SHA256

    72935bcb05a31b405a0e4a13eb0babd1640bbe03fad52ff85ffa91390d0e8eee

    SHA512

    7943a5c44c136347f199a1a3e1aa8af3f4ee9d5024d4588e3faa95f57dcd51292e606a057d567d45c8bc9d62ebfcfebd199654d1f1214b205124418c592f47f7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\InstallOptions.dll
    Filesize

    27KB

    MD5

    e87068563fc18e67a78230067cc240e5

    SHA1

    37cd2cb5581fc575b8c46383d877926bda85883b

    SHA256

    822f75b69dd87332b5995528771923ec74dc5329c65094bf4e372eb8ef42bb8e

    SHA512

    dab6b330d73abadb63f6eb02a5bc87ce9b9d1bc64fcb9289581cfc2e04be0254893945b3bdb762b382bb491388e34bc018f098a489908dfbc9feca2a9ba13d5d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\System.dll
    Filesize

    23KB

    MD5

    938c37b523d7fc08166e7a5810dd0f8e

    SHA1

    47b9663e5873669211655e0010e322f71b5a94be

    SHA256

    a91aa7c0ead677fc01b1c864e43e0cace110afb072b76ad47f4b3d1563f4dc20

    SHA512

    77afe83fb4e80a775dae0a54a2f0ff9710c135f9f1cf77396bc08a7fe46b016a8c079b4fa612e764eea5d258703f860688e38b443e33b1f980e04831739517c1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\TvGetVersion.dll
    Filesize

    696KB

    MD5

    41c3a6594060581d3bf1a16ed4ae6a72

    SHA1

    62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47

    SHA256

    e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83

    SHA512

    3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\UAC.dll
    Filesize

    29KB

    MD5

    488819f838abfcad73a2220c151292ee

    SHA1

    4a0cbd69300694f6dc393436e56a49e27546d0fe

    SHA256

    b5bb8d301173c4dd2969b1203d2c7d9400ba3f7f2e34ee102905bd2724162430

    SHA512

    b00d6cf712fe4cefce41479f6e6f4aa5ea006694d10f2837204de5bde1c5a4bef1368f2b0eb4b66d57a66e8ce6dc335fa91e9c8017e8e125c27eb1f5df4de9a0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\UserInfo.dll
    Filesize

    15KB

    MD5

    77ff6a927940a0e4b8dc07bdde6ab5db

    SHA1

    8d0035242289504d050d237f7e3e548c1ddff077

    SHA256

    e1cb80a23786b02cb2c6a2f9e391b63cbf3ad911e42bbdc14cc6879c84b7404e

    SHA512

    6a3050dc8e3f4eaaa85a43cdf1ac4f69745c07efe48268103ee7d8927ec574b6866740f95e6b3aff154ba74cd05024223a3ea4957cb773dd065cfd797f8a07e3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\linker.dll
    Filesize

    56KB

    MD5

    b05a97bb3f532b7cf57b8eedf198d7af

    SHA1

    83c13a90f4a3c1c62e132f5f3bc70c97c2ecfc80

    SHA256

    7817f79bcdf54ef8617f15b5c0b9b92053549d5a51fa280722ee7179311b69a1

    SHA512

    40706c5fc72198148962d24046722fc5e488c0cc4b3374a9f4b652175919e97a8712e882940db8c26479619a26ec4e2d41744627a9ca52ec7cb1ce4f91d7ee8c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\nsArray.dll
    Filesize

    18KB

    MD5

    9761d708ea7c49662a21f6690d439e06

    SHA1

    b2e757e7eee5c788f16d666fb6cf9d41caccb04b

    SHA256

    8b8be21fa7bca491c93683c9f84bb49370ca7e1e864bd0658ff9e1d2809b67e4

    SHA512

    25990a993373009ccbd9e89cae3fc601928121775d0d5fe326c55a305ce8de51f35a2cb160e9dfbf3be82a53ddf7b9864116e7f5d3325afd7403cd3b7740c652

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\nsExec.dll
    Filesize

    18KB

    MD5

    9ea6ec7934495cc757639b5095362ca7

    SHA1

    ef2c14142b70689483576cc09083db4a2a363e02

    SHA256

    4d8c8353641bbb26bf9ea2ab2dbf126be6ef164b1ce80e3ef5030b873be166cd

    SHA512

    414b08f75bd7febb56784d8534cee028f6420776f07ce5797f66a78748c34b52f443aa35f72c8d7c81dd5366b34998b56d99a9d0d2b4b2b6bfc9775e4ff66531

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\nsis7z.dll
    Filesize

    187KB

    MD5

    7fe20cee9277556f4ef137e61d29d9f5

    SHA1

    d53c37dbf548914ed20c8ebb21186a95beef1ee3

    SHA256

    5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925

    SHA512

    a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\start_unicode.ini
    Filesize

    1KB

    MD5

    e1e5f83035cb20fd89b7de415465eb28

    SHA1

    9444cf7198dbf73700d19f4725d8d06efec87366

    SHA256

    483e0ae06bf051ffd48e0374d6d16454ad7ebc0794bfc4572e4c40155b4b4e2f

    SHA512

    b3aaa4d68a0d79a5ad8471ea8ebe9cea3f2ec202fcec32da1c39555d7e17b77738411f3b6b75a99c904014d2f0dee93644813775fb1c22e3c5694ac2713c31bd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\start_unicode.ini
    Filesize

    2KB

    MD5

    e5a708a9a39d64fa2cc6aa3132f72179

    SHA1

    0328794c52614243b82ffe552495042397c24e7d

    SHA256

    5e9dc1dcf9e3df87ca8ed455a606c4d49925d2a172737b6d414d83fdf75d7432

    SHA512

    fa45b75c3fbdbe8fcc1d62e157ecf33f2c12087dcec232f749e363716ba26cd4c342dc05d76385bcebc5e564164767aa7d56ffe13e86249dd572ef34f809c27d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\start_unicode.ini
    Filesize

    2KB

    MD5

    31205c22f89772550207ecb86ef3b53e

    SHA1

    980848201cb9d9d48b30df53a85b11226ead1302

    SHA256

    5a1bd56d6d7cbd25a40d54a233acff8c0cf89a72da5193e17e9c5ba316b8f0dd

    SHA512

    d6498af4e1a0f4d5c46dca76c48346bcd4ebdff715a909c4acf77ab14953e74ed21880f70b0c884fbff43d0ac2b7420f5f80a3ac1290bb898e9830166a5f0889

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{818a1fe7-2caa-fc43-9ba1-d8a46c698fba}\SET5F32.tmp
    Filesize

    11KB

    MD5

    746441b276b24b7a5b487a429f60d214

    SHA1

    657258cbaf47d6faa2ec58c77b948c6398828f96

    SHA256

    2c714a3687424c798b565128c0720322a7ea0fb779d91963048394ea471707aa

    SHA512

    f734829ec6d6ad84848fa5cd2b866337360481b596a383a49ae3ba5176ffd74850c8dfa345f1dd3bc4644da6fa905ad91644e450da02c413d39849ea3c35753c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{818a1fe7-2caa-fc43-9ba1-d8a46c698fba}\SET5F33.tmp
    Filesize

    70KB

    MD5

    5da3dd0a7761d1c1678d65f22005175a

    SHA1

    13edda1695d1080379adf30596f149cfe09e865d

    SHA256

    cd858c1a37d9599181285ce55e38bbd7cef8637f8df1d3ba425b78c2670e345e

    SHA512

    54c14b06f3cf373dd4a6d77030d7908fc6cb42bf151760877ef2ea0c5662b56f2dd09a334bb55602a4f1920cdf91fba140aaea14113da369cd25b89ab8b3ca3a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{818a1fe7-2caa-fc43-9ba1-d8a46c698fba}\SET5F34.tmp
    Filesize

    4KB

    MD5

    6ccc14f0f72bb4398f0a15cc96bbbb86

    SHA1

    891a0a4069c8ccec4540387a213a445e7a65982f

    SHA256

    f35e1bed01d9efdd2566f6a07560d263ce6cd9494aed03cd3564a7788f6ffa41

    SHA512

    1ef640fec7f68587e938646ab2771f5bfa8384542e401b097cfce3a0d0b67a3f5a6f756fc9f66c77d7d8ac6daa87d227864e7b44fc81a64bebc42254dee906ee

    Download Submit

  • memory/696-33-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-53-0x00000000752C2000-0x00000000752C3000-memory.dmp

    Filesize

    4KB

    Download

  • memory/696-51-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-55-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-57-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-49-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-61-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-1328-0x00000000752C0000-0x0000000075871000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/696-69-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-68-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-65-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-63-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-60-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-46-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-1329-0x00000000752C0000-0x0000000075871000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/696-1330-0x00000000752C0000-0x0000000075871000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/696-39-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-1342-0x00000000752C0000-0x0000000075871000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/696-1-0x00000000752C0000-0x0000000075871000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/696-2-0x00000000752C0000-0x0000000075871000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/696-1356-0x00000000752C0000-0x0000000075871000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/696-3-0x00000000752C0000-0x0000000075871000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/696-41-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-54-0x00000000752C0000-0x0000000075871000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/696-43-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-47-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-36-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-37-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-0-0x00000000752C2000-0x00000000752C3000-memory.dmp

    Filesize

    4KB

    Download

  • memory/696-29-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-7-0x00000000752C0000-0x0000000075871000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/696-31-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-27-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-26-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-23-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-21-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-6-0x00000000752C0000-0x0000000075871000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/696-19-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-8-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-9-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-17-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-15-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-13-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/696-11-0x00000000208C0000-0x00000000250E9000-memory.dmp

    Filesize

    72.2MB

    Download

  • memory/1128-1757-0x0000000006F80000-0x0000000006FB2000-memory.dmp

    Filesize

    200KB

    Download

  • memory/1128-1750-0x0000000075220000-0x000000007522A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1128-1670-0x0000000075220000-0x000000007522A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1128-1573-0x0000000006DF0000-0x0000000006DFE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2756-1357-0x000000001D3B0000-0x000000001D462000-memory.dmp

    Filesize

    712KB

    Download

  • memory/2756-1355-0x000000001D2A0000-0x000000001D2F0000-memory.dmp

    Filesize

    320KB

    Download

  • memory/2756-1343-0x0000000000010000-0x0000000000334000-memory.dmp

    Filesize

    3.1MB

    Download