Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
280s -
max time network
278s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
19/01/2025, 15:47
Static task
static1
General
-
Target
pack.mcmeta
-
Size
109B
-
MD5
43ccda95b5c701c0fcf59baee8f7e30f
-
SHA1
0e243064e052298ebb619297c4516886712246d0
-
SHA256
ec34f78b2ed8239bd50e0beb22c61ee72f9902f356aa964b5d83087386985c75
-
SHA512
a5ec7e401e6fcb6d988d2801a3fe162cd2aa98d3f626a9b20493d268d6b9868f1fb236d6b3f351ebff41be4569d74e1d85e527952fd401a0640bb154af8e834f
Malware Config
Extracted
quasar
1.4.1
Office042
127.0.0.1:4782
4fdba42b-1529-4894-a5f2-8af35850b68c
-
encryption_key
95D889B5EA350B61B463513FC30DBCFBC48B664D
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 4 IoCs
resource yara_rule behavioral1/memory/3996-566-0x00000209357C0000-0x00000209358F8000-memory.dmp family_quasar behavioral1/memory/3996-567-0x0000020935D80000-0x0000020935D96000-memory.dmp family_quasar behavioral1/memory/3964-645-0x0000000000370000-0x0000000000694000-memory.dmp family_quasar behavioral1/files/0x0005000000025004-644.dat family_quasar -
Executes dropped EXE 3 IoCs
pid Process 3964 Client-built.exe 948 Client-built.exe 1080 Client-built.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 39 camo.githubusercontent.com 40 camo.githubusercontent.com 41 camo.githubusercontent.com 2 raw.githubusercontent.com 33 camo.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202 Quasar.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5 Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 8400310000000000335a267e1100444f574e4c4f7e3100006c0009000400efbe4759d35e335a267e2e000000345702000000010000000000000000004200000000001df2020044006f0077006e006c006f00610064007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370039003800000018000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Quasar.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Quasar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic" Quasar.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Quasar.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Quasar.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\NodeSlot = "6" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg Quasar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Quasar.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Quasar.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 Quasar.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" Quasar.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0 = 6600310000000000335a277e10005155415341527e312e3100004c0009000400efbe335a267e335a277e2e000000a10600000000040000000000000000000000000000002fa12e015100750061007300610072002e00760031002e0034002e00310000001a000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0 = 6600310000000000335a347e10005155415341527e312e3100004c0009000400efbe335a277e335a347e2e000000a3060000000003000000000000000000000000000000196915005100750061007300610072002000760031002e0034002e00310000001a000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 50003100000000004759c663100041646d696e003c0009000400efbe4759d35e335af97d2e0000002c570200000001000000000000000000000000000000f6a40201410064006d0069006e00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Quasar.exe Set value (int) \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" explorer.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Quasar.v1.4.1.zip:Zone.Identifier msedge.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1088 explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3928 msedge.exe 3928 msedge.exe 860 msedge.exe 860 msedge.exe 1640 msedge.exe 1640 msedge.exe 2972 identity_helper.exe 2972 identity_helper.exe 4768 msedge.exe 4768 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3996 Quasar.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
pid Process 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3996 Quasar.exe Token: SeDebugPrivilege 3964 Client-built.exe Token: SeDebugPrivilege 948 Client-built.exe Token: SeDebugPrivilege 1080 Client-built.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 3996 Quasar.exe 3964 Client-built.exe -
Suspicious use of SendNotifyMessage 14 IoCs
pid Process 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 860 msedge.exe 3996 Quasar.exe 3964 Client-built.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 408 OpenWith.exe 1088 explorer.exe 1088 explorer.exe 3996 Quasar.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 860 wrote to memory of 3036 860 msedge.exe 82 PID 860 wrote to memory of 3036 860 msedge.exe 82 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 4380 860 msedge.exe 83 PID 860 wrote to memory of 3928 860 msedge.exe 84 PID 860 wrote to memory of 3928 860 msedge.exe 84 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85 PID 860 wrote to memory of 5116 860 msedge.exe 85
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\pack.mcmeta1⤵
- Modifies registry class
PID:2764
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:408
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff917ca3cb8,0x7ff917ca3cc8,0x7ff917ca3cd82⤵PID:3036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:22⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:82⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:1468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3408 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:12⤵PID:1448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:2548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:2488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:12⤵PID:2588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:12⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:12⤵PID:2752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:12⤵PID:2768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:12⤵PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,13477933811867428975,7110788691064423707,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6060 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2368
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1712
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2376
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2780
-
C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Quasar.exe"C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Quasar.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3996 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe" /select, "C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12"2⤵PID:2716
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1088
-
C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe"C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3964
-
C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe"C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:948
-
C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe"C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b4e91d2e5f40d5e2586a86cf3bb4df24
SHA131920b3a41aa4400d4a0230a7622848789b38672
SHA2565d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
SHA512968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
-
Filesize
152B
MD5fdee96b970080ef7f5bfa5964075575e
SHA12c821998dc2674d291bfa83a4df46814f0c29ab4
SHA256a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0
SHA51220875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff
-
Filesize
152B
MD546e6ad711a84b5dc7b30b75297d64875
SHA18ca343bfab1e2c04e67b9b16b8e06ba463b4f485
SHA25677b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f
SHA5128472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e
-
Filesize
67KB
MD569df804d05f8b29a88278b7d582dd279
SHA1d9560905612cf656d5dd0e741172fb4cd9c60688
SHA256b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608
SHA5120ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e
-
Filesize
64KB
MD5d6b36c7d4b06f140f860ddc91a4c659c
SHA1ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA25634013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
SHA5122a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
-
Filesize
19KB
MD51bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA16dd8803e59949c985d6a9df2f26c833041a5178c
SHA256af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
SHA512b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
-
Filesize
63KB
MD5226541550a51911c375216f718493f65
SHA1f6e608468401f9384cabdef45ca19e2afacc84bd
SHA256caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
SHA5122947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD559fc09cb4937d9f94e76a79207ec933c
SHA176ec91a977a0d1662882ba74bfa68b665a71cd5f
SHA256f1f192f0a106d6c51cab8cacc6c960566152ad887680d3747b12865ee5818ed6
SHA5123a99648f1b9f1927e8721efb3ae40dbec53c4d2a38cb6cd301bf9789f82843be9336b63f9ca637158fe718a9297259186e755020dc9df67057d2f6cec11bfa48
-
Filesize
941B
MD542e113c52b0721d5183875cc0f373bdf
SHA1fc13e94d880d9944ee6f94c992625dcab1c02b0d
SHA256d07df43362ed2338965206fe12e1a52a4b475ae74f48576bc9eab3bb40024a18
SHA512a82ad14db2bdc54053295ef82f9fbc5aa9bc91c4db13b41f4a50a251436f9034b3b77736698cb7306137125df0877e0a0d67560f6d55093dc6f29a3d404f71a9
-
Filesize
5KB
MD51d128bf7b82c8c8cff530a1cc5910b99
SHA1fdfc569e9f3956174eb770ca79ee4c42539d5854
SHA2564b86de8b29686154eda591e6ec017c17a302bf4b69eac2ab09f6c66c8c98f24b
SHA5128b913a94000333ad188ea0f1cdd7b154605bc52ba931fd8f16406dec0976ba68eafe702602f5346f502156004267a6b997aaa6a591e19b10be6fb40754eeb1e3
-
Filesize
5KB
MD5acc6a753e15c4d71497d0c5a2c9efe49
SHA1b29c022ea34c74b2fa8a08e494ecc8f7f5f198dc
SHA256e0c8792d10f71cd6bc69dc86d5b7fe56827f6bca383f21ec69885ee243e27e09
SHA512ff261eaf5962e601cfcd0327c8045ac90703cd2517b45144e8dd349e42e350da5d0f37218f3cf4c5476d5aec8f30f2e79917bdcb023c9dad8c13b9d546f15ffc
-
Filesize
6KB
MD51d96fa5c136f90813ed28dabe6d8699d
SHA1c689fdd0106bd6b96795cb80da1c97eb22907532
SHA256fa72767978b306bc106f54abd0059cc5a49daf4521678be012c715e405131d44
SHA5120c24254d21957287dc4b12721be6a8702294771f3082f45bdc4b013830be1f000c2147d620cf5cfb902fc288493cd3c7328e72e0552d56c849cf18b504ad3419
-
Filesize
5KB
MD50c498c831553d52c87b5fc81d727d460
SHA13174a6885ed28fd41b6ba2408595be045ca373e6
SHA256ef7e6e04cc6875817bda83cbdd32baeb8c791911de70a614756a14d84857cca7
SHA512a44c82775fd1d7f8e2aaeea1839b02810f114fd783ee3c200b9f420c9adc4009864fcf5589f8887c28c1fce8d2a38bbb03b87c94e726753ff8d930b7fd381764
-
Filesize
6KB
MD57b238dd7116d7390201473aba0f6b3e6
SHA105f3eb3219bac6d60f2316f1dbdc8ac3b57b05b7
SHA2567e306c07eb9133bd9639067bff5add5ce67713d72cc3692272f2a26f973fd391
SHA512e46106452410edd6bbef4b1def239664fb98485fdf798a661fae82f3b74d819d847500c3b6aa0aa4ff52b8999bc9a8445af9eef7c5f64d29b54826b01d45a7de
-
Filesize
1KB
MD5a9c335a4b525c81e7e9eec2eff1887c7
SHA1d3e461f69f3dc6fe95eec4cc697edec5837112c3
SHA2562f9fca2dd5f8963a67adf23b52148fdfd85e71c13d40e50a3355f3dd6a3db9e4
SHA51248f5b43da7298b7643b1567be0e5bbea82eab4233ae4e082b9639ba4cce82363f08c61bd1c8ef5a81319483746c26f9117c09d9542918ff09a5336165903d7c2
-
Filesize
1KB
MD53212a71b13f5eab343164f2f42830579
SHA15538616a148575916c30e307bb6e3fa9427301b4
SHA2562a8f87517d735c1cb1715097dca4aab125804f2eea54601bf79c0700cf3b9ba3
SHA512a0cfc9af45176d21b7cb690654e908cc7aadd9c4e88d45147f11adfca0cda2643eb75d7a7124e95a1cfa668f826422b7518bf034c8103c2147a1cc73b0dc1161
-
Filesize
1KB
MD504fb354965848a0833d89e9e2c259a10
SHA144a36622277f70c9416e359ae92a431de818db46
SHA2563fbecd35b82685733fcee466a84715fb82532197549bd35e9b991e9a353dc5d2
SHA512a3e317ab1e760bfa296797aed73d8f5391399b912b7d59b88a04269b4d5482fea05fc87b1d0e1eb1d4d932976bb32a74d5d5751a1f2445c6158330d51553088e
-
Filesize
538B
MD5fd1a8941f714474a04acc10e5f5f9e63
SHA1f90588c3cb38c39d3c3eeacb4b64f58ba98f27de
SHA25650c8d805468a61e796aa5725b2b9ad78bd6b0779be2f8019563084f6e52f0133
SHA5125d7d4afe9ee65afbec94a3e0297bf5fac2db81fc0833519aa75feee986645c90c05e8663cd552214561a42c843cd5305c681688ee77b00812ebc9678ca6ce36c
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5bcead8bdc1a63d386aa6c7220f3cbe4a
SHA1d01ff327c81c2f8e488964117e1c4d47a0b3cdde
SHA256eb29e0841a4a516e4926e39d701e0cbd418068c711ec868059647f4f7a05dc01
SHA512726936c66f9e6ef7120768b1734eb6cf3469d2544f07313669a866124fbfcf11e7534b298bbc05715a0b6f758e0f81af734f334737a1311fe4fbd8de6582056f
-
Filesize
10KB
MD52762bc758fff1a371889e63f81e633e6
SHA1f4298e4426cb33400280d10a5aae5bef91543072
SHA256613919bb1e33d1711e3da13cb620ba1daa61a316d8e574429805a3564df7ba6b
SHA5121bf9c55f9ebf3aa8ee829e0e14f8c31ffa606e9cb4ea88f1c85c8d8c321280b5e307ad35cb89f47cb40f14b1029b66c493f2c077a967490bc25a5129223a0656
-
Filesize
10KB
MD5d9046239ae5f4235c5a40b8a7a9e32eb
SHA10c3731d4ff6dcbc664268a4fcb82882cd2d0e18c
SHA25600b95a236703e5093a52a3dc955f1f0f43538729fd89f485e5339192f24e0ed9
SHA5126b104d4dae0a047c17e90c9b92e694cc368d55d745ea01df47325251f980d63fe7483ec294c4653ad74e257acd090699f846c0046dabb2eb7abbbb9475560937
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3587106988-279496464-3440778474-1000\aa0aab2dc2e3b274f6205167f7e28c65_605430f4-93cf-4c59-84cd-e6cd51bd2585
Filesize3KB
MD5dd06f492fc91f213593a064cf44fce23
SHA17c0ad154aeb3fd27e33bf1ce7500766dc9a5193f
SHA256aea1cfa7fba8260419f470479fb1bb8d76d44497feee14d1fb3cf87f07ebea5e
SHA5129f2020331b907c517dbefd1aadaad1026bfdea2ab39e2ba93689d232e03d5dd4bcf70bf7170fe0b6a63272463bffffacd6ecb270e83542003febf216e731c27d
-
Filesize
3.3MB
MD513aa4bf4f5ed1ac503c69470b1ede5c1
SHA1c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00
SHA2564cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62
SHA512767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
3.1MB
MD55fae6e71664e29cfc1ed843509449402
SHA14591d9257774274dc220c0b86bc2e1c421194c1b
SHA2563876d854cc3252cb5e90e3aed711d80323a4456c4ae06a88b989a60f873b544c
SHA512b40cb99d352af9edea53a7ebaa88992e8df4ff585d4b78c5ecf1ab16da8a752d1fddca1305ca88003e3c063a56f7260026f564d9ed681e50f8041f79f7e34fb6
-
Filesize
4KB
MD5ce1f1e0121104b3b9388e7579515f459
SHA165893b04b7a2ef04f226d6f19787275a5d53f88b
SHA2566412d90c2fafc1fdbea00617096712f778c06a537b7c2764a259cc7798915dbe
SHA5122dfefde23eb454cebdd3ad4f53050661ae2fb9ab8f5117d8856ebb9817f7de560a60cb9e3e162c8d7b00e0eafc0d9439c5dbcde4dbdcea31b658ac75a4a5d41f