quasar | af454978c652f9acb95b7c2f45d41ee0ba7923d6e3b3f554af853ef9efff9440

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Celestial.exe
Size

3.1MB
MD5

12bdd4b4c107fc3ffec7f9b29d7d6a93
SHA1

04bb395848578e22cef0c90215463e4efe4965c3
SHA256

af454978c652f9acb95b7c2f45d41ee0ba7923d6e3b3f554af853ef9efff9440
SHA512

ff4a2c42ac1fed5421955a949cf28c9abb714484bb68259f160516d10a7a179cc6e6327ab2fc2f099ba51a98b25fa5f41ea2af4f3815159e1ce7f75a698b8251
SSDEEP

49152:nv6lL26AaNeWgPhlmVqvMQ7XSKZkxNESElk/iULoGdldTHHB72eh2NT:nviL26AaNeWgPhlmVqkQ7XSKGxsa

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

147.185.221.19:33365

Mutex

ba5220e2-c4e8-4381-aad8-a85115ef955e

Attributes

encryption_key
67C139F3E9A16FF8132A3DCF42197B8BA3C38609
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Miicrosoft Securiity
subdirectory
Miicrosoft Securiity

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar payload 2 IoCs

Processes:

resource yara_rule

behavioral1/memory/1096-1-0x00000000009E0000-0x0000000000D04000-memory.dmp family_quasar
C:\Program Files\Miicrosoft Securiity\Client.exe family_quasar
Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

4724 Client.exe

resource	yara_rule
behavioral1/memory/1096-1-0x00000000009E0000-0x0000000000D04000-memory.dmp	family_quasar
C:\Program Files\Miicrosoft Securiity\Client.exe	family_quasar

Drops file in Program Files directory 4 IoCs

Processes:

Celestial.exeClient.exe

description	ioc	process
File opened for modification	C:\Program Files\Miicrosoft Securiity	Celestial.exe
File opened for modification	C:\Program Files\Miicrosoft Securiity	Client.exe
File created	C:\Program Files\Miicrosoft Securiity\Client.exe	Celestial.exe
File opened for modification	C:\Program Files\Miicrosoft Securiity\Client.exe	Celestial.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

4424 schtasks.exe
4488 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

5068 vlc.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

4224 msedge.exe
4224 msedge.exe
1256 msedge.exe
1256 msedge.exe
1876 identity_helper.exe
1876 identity_helper.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

5068 vlc.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid process

1256 msedge.exe
1256 msedge.exe
1256 msedge.exe
1256 msedge.exe
1256 msedge.exe
1256 msedge.exe
1256 msedge.exe
1256 msedge.exe
1256 msedge.exe
1256 msedge.exe
Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Celestial.exeClient.exesvchost.exe

description pid process

Token: SeDebugPrivilege 1096 Celestial.exe
Token: SeDebugPrivilege 4724 Client.exe
Token: SeTcbPrivilege 4056 svchost.exe
Token: SeRestorePrivilege 4056 svchost.exe

pid	process
4424	schtasks.exe
4488	schtasks.exe

pid	process
5068	vlc.exe

pid	process
4224	msedge.exe
4224	msedge.exe
1256	msedge.exe
1256	msedge.exe
1876	identity_helper.exe
1876	identity_helper.exe

pid	process
5068	vlc.exe

pid	process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

description	pid	process
Token: SeDebugPrivilege	1096	Celestial.exe
Token: SeDebugPrivilege	4724	Client.exe
Token: SeTcbPrivilege	4056	svchost.exe
Token: SeRestorePrivilege	4056	svchost.exe

Suspicious use of FindShellTrayWindow 32 IoCs

Processes:

Client.exevlc.exemsedge.exe

pid	process
4724	Client.exe
4724	Client.exe
5068	vlc.exe
5068	vlc.exe
5068	vlc.exe
4724	Client.exe
5068	vlc.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of SendNotifyMessage 30 IoCs

Processes:

Client.exevlc.exemsedge.exe

pid	process
4724	Client.exe
4724	Client.exe
5068	vlc.exe
5068	vlc.exe
4724	Client.exe
5068	vlc.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Client.exevlc.exe

pid process

4724 Client.exe
5068 vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Celestial.exeClient.exesvchost.exemsedge.exe

description	pid	process	target process
PID 1096 wrote to memory of 4424	1096	Celestial.exe	schtasks.exe
PID 1096 wrote to memory of 4424	1096	Celestial.exe	schtasks.exe
PID 1096 wrote to memory of 4724	1096	Celestial.exe	Client.exe
PID 1096 wrote to memory of 4724	1096	Celestial.exe	Client.exe
PID 4724 wrote to memory of 4488	4724	Client.exe	schtasks.exe
PID 4724 wrote to memory of 4488	4724	Client.exe	schtasks.exe
PID 4056 wrote to memory of 1264	4056	svchost.exe	dashost.exe
PID 4056 wrote to memory of 1264	4056	svchost.exe	dashost.exe
PID 1256 wrote to memory of 4664	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4664	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 3888	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4224	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4224	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2268	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2268	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2268	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2268	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2268	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2268	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2268	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2268	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2268	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2268	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2268	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2268	1256	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Celestial.exe
"C:\Users\Admin\AppData\Local\Temp\Celestial.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Miicrosoft Securiity" /sc ONLOGON /tr "C:\Program Files\Miicrosoft Securiity\Client.exe" /rl HIGHEST /f
2⤵
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Program Files\Miicrosoft Securiity\Client.exe
"C:\Program Files\Miicrosoft Securiity\Client.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Miicrosoft Securiity" /sc ONLOGON /tr "C:\Program Files\Miicrosoft Securiity\Client.exe" /rl HIGHEST /f
3⤵
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\system32\dashost.exe
dashost.exe {6f5dfed7-0136-4bfb-aca9a6862e94ccb2}
2⤵
PID:1264

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ExitDebug.mp4v"
1⤵
PID:2308

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\LockRevoke.ocx"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5068

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\OptimizeCheckpoint.tiff"
1⤵
PID:912

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ProtectSubmit.snd"
1⤵
PID:5000

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PublishOut.otf"
1⤵
PID:4600

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RegisterRestart.vst"
1⤵
PID:3012

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RenameLock.jpeg"
1⤵
PID:1584

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RequestDeny.mht"
1⤵
PID:1784

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ResizeBackup.jtx"
1⤵
PID:2612

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\New folder"
1⤵
PID:4064

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ResumeRead.inf"
1⤵
PID:2556

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SendStep.tif"
1⤵
PID:3084

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\StepSplit.mp4v"
1⤵
PID:2760

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnregisterFormat.ttc"
1⤵
PID:1840

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnregisterInitialize.nfo"
1⤵
PID:1060

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UseClear.docx"
1⤵
PID:2100

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\FormatSave.DVR-MS"
1⤵
PID:4656

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\GetCopy.mp3"
1⤵
PID:4924

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\OutFind.wpl"
1⤵
PID:2336

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SendFormat.dotm"
1⤵
PID:4252

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnregisterSave.3gpp"
1⤵
PID:3300

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\WaitSend.svg"
1⤵
PID:1868

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\AddUnblock.rar"
1⤵
PID:4460

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ApproveComplete.TTS"
1⤵
PID:3148

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\AssertMerge.dotm"
1⤵
PID:4648

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CheckpointUnregister.mpe"
1⤵
PID:4664

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ConvertToTest.mpeg3"
1⤵
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffad3f446f8,0x7ffad3f44708,0x7ffad3f44718
2⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
2⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
2⤵
PID:2268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
2⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
2⤵
PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3964 /prefetch:8
2⤵
PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3964 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
2⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
2⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
2⤵
PID:1504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
2⤵
PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
2⤵
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,17600962086189071839,10048670185523170117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
2⤵
PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Miicrosoft Securiity\Client.exe
Filesize
3.1MB

MD5
12bdd4b4c107fc3ffec7f9b29d7d6a93

SHA1
04bb395848578e22cef0c90215463e4efe4965c3

SHA256
af454978c652f9acb95b7c2f45d41ee0ba7923d6e3b3f554af853ef9efff9440

SHA512
ff4a2c42ac1fed5421955a949cf28c9abb714484bb68259f160516d10a7a179cc6e6327ab2fc2f099ba51a98b25fa5f41ea2af4f3815159e1ce7f75a698b8251

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
541B

MD5
116b709b43205187b781199da87486c8

SHA1
acb542008e21613f7fc113cf5f73068697e28815

SHA256
89fda39508623760d94ce32b307b4cd5ae5b94d78bd0f0d2d525ec7d12be8812

SHA512
af2e0c2cb763bb16e36f66c4bec5572dd5e6843d4aff62ebda35f4b62d0428a3b68d485fdec39e65d7cc80c9c7ccc551233e048a0bf1049b671e4dfab876537e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
76c629660a90431c341c8c269169f51b

SHA1
88b89b7ecb9fe557fbea9884721475ec49ccfa41

SHA256
d922e1b7d7c178281a456a49a5a09bae7e7e57a2e04bc3109b17336ae96e0eeb

SHA512
357c3c7864372701aea35d7d986bd88c1ffeecccea940bc0af85f098f0fdd581de2caa66ff40d89f97645c9ec7b33c3ef7c300f8bf840cef747a5ce75746429c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
75a3c4567bd5d61034110124351f5c16

SHA1
381b757cb6ea13a6280286275030139768262d1c

SHA256
e3df696f54ee8631b5c609bc854c4cc98ceb2770275923ff8e7a6f1b8ea3efc3

SHA512
96383dfb322903d904be5c01c9544afd3aee10433357315669c088a3d9b1978e095c0cf1ba07f31b646401801a07dd06077f619a40df0ec7de7d0bde5726b75d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2e7c8a5aadf3919ec60c97ad83f13429

SHA1
b9dc43c8e3746b1badd17de497144554ced4d849

SHA256
cecb6657023b63645cb215f57bf80b4c25423f7ff51087c75b7fb44ace970ff2

SHA512
d0de1067e0a8a68b12e7aa90132f20ddd59574bb6a814a0d37c5758ccf314bc5ce353dd33f6c074f9deecb7224b8e38d7165ee8ee8eab0a311df0cd524bc9d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
7f61136f0398c478d8757f2d106968c1

SHA1
b0412339236644ddb28a01fc7774dd4700e97215

SHA256
bb7553f82f7f366facaa90099e0c2d7fbe55c2858cf4ad438b31142debd2a067

SHA512
6137136c847735b8fa00bd4e6aa4c1d0c8c62668c1b0f5e2c9b55fc61fcac706fb81bcf661fc3a48d907b3dd201a06222ecb05d35d903323ec5cc3ee683c6208

Download Submit
C:\Users\Admin\Desktop\AddUnblock.rar
Filesize
592KB

MD5
836c3788389582c5fb573e953a644d3c

SHA1
84c5641f62481739cdc30fa6875e6a4f16d93fc8

SHA256
e597d905ee119f86103ce9cef7bacbe648e5affad6bfa89b293e95b8912ba809

SHA512
47be7e186b524e38379af4d05b4bb69ef4c55711eb3ce4043d6d0c02369623e9f15cae72c99f705ae9c075ba90087d7aa1ad832268ce376a680524fa3982bbce

Download Submit
C:\Users\Admin\Desktop\ApproveComplete.TTS
Filesize
386KB

MD5
f46728e9b2f80bfc60537918e29239f8

SHA1
27da5755214cb295d37cfa748b9fc2fc9de6afd9

SHA256
e1efe6a10fdd9402093e0a08f272dff8c796b1e4b534f13acf2a45efcd295bff

SHA512
2f0ab80c8cb4b64a06c7e8a50fda1a02893927e4ab651bf061a4ba087e4ac4f8556faa8e1f79766a006966c1f8abc189a90156f986f67646c327a78ee749f7c3

Download Submit
C:\Users\Admin\Desktop\AssertMerge.dotm
Filesize
746KB

MD5
7ac5064a60cf67dc8fa17f1225e1202a

SHA1
1e1d3671dfbbd0205c549e63b8626f23c9b9984c

SHA256
407a36d9bcf0d465241a97e0404f11a4082c6d39c02a3f258daded98f4791421

SHA512
17cbbb3ca310c1ffdf7f8c5f72ba2e29333ae7b44eaca2376c133bd2e93202ed0ed7f9af14f1a06f5e476c1fb8bc2cc7a4c492b9f06fdaeb862027219db99c20

Download Submit
C:\Users\Admin\Desktop\CheckpointUnregister.mpe
Filesize
695KB

MD5
c7b911ca4ce3173c21982b06444a58d4

SHA1
883a148ce444e74443eb35fef18622b13166d456

SHA256
cef0e85ce53c561c594007e977c555caafbcda4a697e19ee481c2fd9d66cd742

SHA512
cf3e31837941603d2726484057ba2713dada2a49e805499ba966a1ee628d9d797c404637b1e9c181be4cab1b4610b6b639c95908d03aa47e50522edc1457a818

Download Submit
C:\Users\Admin\Desktop\ConvertToTest.mpeg3
Filesize
412KB

MD5
868d8b508da6d14ba5dea511cb95fc41

SHA1
79e816c8f82b74d9885f9193969281171f0394b4

SHA256
ffef17cc149e27a00744bc864d715cfac257d7d03dcd00f824ffc27e22076039

SHA512
7b908e50774a0ebe5cad228939027949b2708a88c855187dd69501048e33776c0b844260f6224e4a7529c86b17ce26e6deb84984fe5f37b831c211912d678546

Download Submit
C:\Users\Admin\Desktop\ExitDebug.mp4v
Filesize
489KB

MD5
d8222314a2c187193138ccec55df39fa

SHA1
ea4ec1585eca4e7e3e9d850505f3bea04d3c4bd3

SHA256
7b1aaf3cf448b0fd5580ab5eb9d03259dd586c890ed28fe4d3685db37d457991

SHA512
b89ba2282c6161f12d3a793bd20290aab323344e249ed72655fc66ac873e2311989f7ae041a40c49d872fc29e3c1c0f12d3fb130fcb749927d6f94e4a52ef020

Download Submit
C:\Users\Admin\Desktop\FormatSave.DVR-MS
Filesize
927KB

MD5
636f3cc9bdf7529933cdd4f2234df12a

SHA1
cbb5144dde863aa3523207d827ab22722f688016

SHA256
b32ecbb6a55126b9c0ab775f4e989f1de73de90b5a8582efb315a8d7ef546f43

SHA512
28b0a24e7d1a2b41d47c523e8be6d55cfe5f8b7730a46fc59e23be8a5ff5c1189094e32c8a634707e59045c9410f1150e70d8899821b7789542135f4580ccc8e

Download Submit
C:\Users\Admin\Desktop\GetCopy.mp3
Filesize
901KB

MD5
cf73e1139e2a9cd53802dc260cd944ee

SHA1
1780e4d36f2b8598f23a82f11a7dd5f13a6a7314

SHA256
ffd196420fe8d7448a153ff5affe3448c3ef13a23b405ff315b71781131fab65

SHA512
a207f31a266746ae4f0c3b6d7cbc8b3a60c3216d6840583ceb483dc3703f46466d8ef85027d5284318d9514593cbee14838d3629735e0a5f604938596f080a55

Download Submit
C:\Users\Admin\Desktop\LockRevoke.ocx
Filesize
515KB

MD5
738781e2e5461d0fb2bc21fcca77a69d

SHA1
f40b4a4ce97f6fc37f2c92cb63f50f3d95436227

SHA256
41a76031e5e2757ded3f6d8682423ad7c834267b0fd00ecb5153ff9a0cdee2ca

SHA512
8363dd5e17ade8e1ff10b0f0e6e4379f0e913d5c620a17501b24ac5b380b753ea61755b2c723fb374aebed44534be410bd4a7d252ea89a2bedcddce1f5a33ccb

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk
Filesize
2KB

MD5
ccc9ef4179c717b0d381064f07ae8b43

SHA1
071c743bc00d36b035b6ff4f4112617e179faa4e

SHA256
7badd0e5b98770cb1a7c1426c199fb356e177c9eb0dcce63bd153245ab2c6717

SHA512
00df112330fc52c70105513ae5119cfc99b4e45088532423b029352956189798ec4af35a40c7c82c7d14a47c10d830914412bab3687bc1323adccf0cd30cb97e

Download Submit
C:\Users\Admin\Desktop\New folder
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\Desktop\OptimizeCheckpoint.tiff
Filesize
669KB

MD5
53a0e434cb060221ee82a44bbbbc8cfd

SHA1
8eb20a49b113c29b655af5104a109cd487ca9a45

SHA256
edddbea3b30d5a7eb9d6baff873f4992f2eb3473cb79187a5c0dbba3f6dee219

SHA512
1d2ffb59a15baa210ec38a02f417f84177a38fcc9d76d59e6f16c074904d2deec66a88716340b81cc3c72cb3e0803984945b6424540714a08de5650b6b4c3887

Download Submit
C:\Users\Admin\Desktop\OutFind.wpl
Filesize
875KB

MD5
3287a1ce3d53bbc7e69bc099f157b0f3

SHA1
5692d6c79be2bb93d0f766e0f2bd8c5e19d3388d

SHA256
b4fd5dbad1bfcb7cba09b8ce9def79b219586556e017bd5e11268edf84cce65b

SHA512
9a8125eff30b6aded25d48329728ded04f6e754025a4f9f6bb73a68bc48f481753e4766d937310760e6d5a5801be2c6e1b9963bcadc79e6785f14d6a50c250f1

Download Submit
C:\Users\Admin\Desktop\ProtectSubmit.snd
Filesize
540KB

MD5
0ae3cdb1fd84af5613c268a7c6bf705b

SHA1
e3eab118a53fb05ff41172a0c7ecaf62c2490841

SHA256
649d95713617e116db2df530eee7146ad7b893082cc68dca92ff213c938be370

SHA512
99ee5bc7287a907f9d09f2da003babf88cbed8ece2d0e4ce3528d1c3825cd843367fba5167ef4efa821d21a2366e440fe83334b5cbea7f093f829cce8d99e0b1

Download Submit
C:\Users\Admin\Desktop\PublishOut.otf
Filesize
437KB

MD5
be110e32cb59efaaf6665ae5c217ab45

SHA1
0b924f9d7bcee17a96d7b84a356dae654fdc0cf2

SHA256
0f955c79001e1eb5e8f996b370254845df2636820f34c56ad82c233406ba51ac

SHA512
2eab03bbfa08ac0712940c5421fcb434a74638ea03caa24370de9c417b69499ef4158005457c0beeb70eea4f2ed4a715f934a98c31a441cdef91922b6e8833c6

Download Submit
C:\Users\Admin\Desktop\RegisterRestart.vst
Filesize
643KB

MD5
c33bedaea03187cb1ff880193beda6c2

SHA1
c2d05831aacccdad78c91c62d0c0b2a441852dc8

SHA256
2c96010951a17d7998ea2b8b44a555bd5c786dcd9d962911b0a0267d509cc43e

SHA512
9d16b990fa8cf2cce26b4c41790b796fc639421a7d4663b585811ed7b4c396d7ec91bb4c511fbdf9cc93ef0b045cd2963bcee39ea13fd6b69086f1e6014bec03

Download Submit
C:\Users\Admin\Desktop\RenameLock.jpeg
Filesize
463KB

MD5
9302724cdfc4aeb6d64020614e7ba966

SHA1
2ad0907198ac54c15ba71b6be5ff62e1ce4ee65b

SHA256
e4c7a19a816f34a2ef4514dbd0917f6d01a451b96c82c53a25fda32c24936ab0

SHA512
abdadfd461a17fac342ea7ccf0381c9177355d042af1312c6387a4894d42be68a549588603b228baac9c7100e4198781b77156ddb05a254e893208d6e7bc4715

Download Submit
C:\Users\Admin\Desktop\RequestDeny.mht
Filesize
824KB

MD5
da40d1a893ab15a0d3d6cd795842980b

SHA1
94ca7bb0f5fe2d416d21470d4e4d8caf8d534567

SHA256
1690656b201392da136d71a0ed58e5e1e27192d349b7c1f21328edea9a41dccb

SHA512
ad692afd1c811a1925a1b6a80396bb0dde297e0cf9ababf340160ed6ed5ec257903f7dc5474e521bfde966984fc9f7b80cdfd9c179a7e1ebfd6766ad988f2aea

Download Submit
C:\Users\Admin\Desktop\ResizeBackup.jtx
Filesize
798KB

MD5
8820ab694bdd303c53c0dbce5b41054a

SHA1
9937014402ed2a1e769c800677bbe374413c309d

SHA256
1b9dcc6c780e2259abae817064b2718ada7247a40ebfd25d92c24efa40df9de5

SHA512
e5c01e6f6bc4233db9773b6124f84846bf1b7f479a989d02c9dfd6f1749b93d5acca6106aefbf7d8c2892253163712b9e42454354d02e711909e2cc57844b96d

Download Submit
C:\Users\Admin\Desktop\ResumeRead.inf
Filesize
334KB

MD5
498dd4923bd587f6c530a0d7bbb52d82

SHA1
cc870848ae8ee1b70a4e9e0ad8842d700f5bd237

SHA256
79fd7d368b745824e0740860529ef438d0494638ab39dbd7b288ee43de1b92e9

SHA512
9636438b7f726db8522b456bdede3fbcc13829141f0fa0e853e90e0d142cbd709f2d832308315bec47dc8938412209e72aeffece64f4bb17a1bc5cb14026db50

Download Submit
C:\Users\Admin\Desktop\SendFormat.dotm
Filesize
1.3MB

MD5
da8d4d4f4b07a39c3b43935f42289ba0

SHA1
c18d8747f2528817fd83def3117164c2aa3ca5e7

SHA256
e85c2eddaa52748adf77be622b0b37642970249bbf6a3e26c0b2433283c4713f

SHA512
f21426fd79378b398c277cce17de46bf796cf38e24b6d0b35cfc698072efea965ad0d098ec1b52d18f231ba61cfd3ad6bbf1184387993c719f623948b265bb13

Download Submit
C:\Users\Admin\Desktop\SendStep.tif
Filesize
721KB

MD5
d214c35e5e9db1a25ec105de2efcd975

SHA1
83c2d394322d1095006a39a3821715c2afcdb039

SHA256
c203671686bd9d9138deaad730e6ff805df99b9824d032cfa00b0cebefc94c5e

SHA512
2c12cc1166cb4f15e7d41bf367b8361cc041cc47b8248e75e21412d88d67d88700c891582de40fa6701f91b36e83a6da1576382910bee53a2e452d94fed9feb6

Download Submit
C:\Users\Admin\Desktop\StepSplit.mp4v
Filesize
566KB

MD5
abcac1a05334cb54c4b3006be8d186dc

SHA1
67cbbade260131f540c358616865141098e5a49e

SHA256
820ab34cc3d400e4b91e81298f9cb48c2178283c02d9245a90d563a0024bd92f

SHA512
282872a4e1585be39b4e727983ff6bd03d97e4c0ca3b0b2cc3d7b32e6c36d9acf4ac24fff0838cbdc86a1894021eeb786cb7e2d9135df129180ca2e6fd400509

Download Submit
C:\Users\Admin\Desktop\UnregisterFormat.ttc
Filesize
618KB

MD5
148f6a1d6c950b6bddcce6f93c1ad0b5

SHA1
b11ee78908ff11ae5e519eec2262f654fd7159d1

SHA256
3967e34bb7b186a38eeacb1b70073d4523979ca51c90ffa3df1dcf25ec8e30a7

SHA512
d4bdfea1d159edee84a1a7a563568bf0fecfbe9a24048bb1a0a4a4c4ccacae5d9df3d9651d9e381924787728838670feaf5fc98b2fe80a158c33d826357ac4e8

Download Submit
C:\Users\Admin\Desktop\UnregisterInitialize.nfo
Filesize
772KB

MD5
0537ecd9d5a7f545efb063d1be3753b8

SHA1
77b984e67d25ef2bdc35042e47fa3fed514adf43

SHA256
5f69cc8ea8735e3b2e32bf71919ee363fb01c47bb9ca95856a9afb49b9f9e129

SHA512
ac7f57bbbbe3fbd9f859732d0b165f4885919191b377118d4f638800dd248b09bd58d298bdc5019a405353e7366f5a5233c1e989c332bb13dfe8335f8cb99913

Download Submit
C:\Users\Admin\Desktop\UnregisterSave.3gpp
Filesize
952KB

MD5
58cddbf8c73480b996b269094ff35557

SHA1
8443b4e89b48e96284a1660bc0514f7796ef42d5

SHA256
41623d107c5e739aa094d92410cc26d3bb27707d1c55d09fde2c3dd4e86dc127

SHA512
6378ef403657092ff6a82fed58fd2bae2f3278a80df0b0e72b898a7cdb4c95ddde0d3a721b59f07f528d4e88af3da7e76d746930739f36e8aa9682d3824dfd04

Download Submit
C:\Users\Admin\Desktop\UseClear.docx
Filesize
360KB

MD5
0ef167076fd0948ef988fdb0d733b810

SHA1
66ee2ec24bea369d370a2cec47dac6b9cd97ea79

SHA256
9be432dd9901d77bd84375e511652d7bcfe94538772cff90a7fc8a1473e802aa

SHA512
9deb5dc2b0b65208efb383d8f9b2616715fe27b46d3d4e513f87cb8d75d7060e00911bdb420f1f56695ce6bb8ad08e1395aee6516eb5bdd68832f72ac4cb5dd9

Download Submit
C:\Users\Admin\Desktop\WaitSend.svg
Filesize
849KB

MD5
d6ea5c0d7230e08729dee9c323bdaf8c

SHA1
b612525f850799c0c98efdc7b71e0ed1b64a9d1f

SHA256
279ff4818851d9aaedabeed719b8b0945fada59cd49dda58ec61903d9fb20171

SHA512
b6382f434e6a2ba437c64d50ea851ef7db02062e2b92f54b5efd252207784d96d013e2bd91c9c8710bb1ce91e1cbcade8020409539ccacc3b9421e6e9c224177

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Filesize
2KB

MD5
cd2e601ec2f44b0211fae65422446e0e

SHA1
b2ab43d71e0cfd537c1a4fb17d04b82f7201b6e8

SHA256
2b83847fdc0f0e3eb695aa504d2a332c5197a07eb25b37b0e184e0e5411caa14

SHA512
c0ef50cf3f82c3ed49d23c39b69513f84c0aa94059f618a4dcf7b628ee8e67d83998e59b6c1f23b11cbca4aba5b8d46ea741dd77967ff757d5b8fb10b1da0fae

Download Submit
C:\Users\Public\Desktop\Firefox.lnk
Filesize
1000B

MD5
61ac1e815d81f4a2f93ba70bdb7f84a4

SHA1
0531d3d2953f72dd89a16cdafcad0a2a010b3a32

SHA256
844d651080ce9319d36dcfa225504b6e77a36f00fe17693f2d9df081bdef81bc

SHA512
ad015c9f9724b6fa71defde43ace702955ed0564a873d82716f97fef8f56d2a75879c7d1ae373ae879089ed1fab853d4f08dfbcedd2cf81fd8eec69c2a11b0b1

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk
Filesize
2KB

MD5
b912c7424324879493c771def40a45e5

SHA1
914f55b098e0d79a5285bae6d00e8a6b3f2574c0

SHA256
2db04f2f0b7deace03e50618c8b1ee26be81fba29c3c8885b41dc6898cf6509c

SHA512
2822f6ca58037a55acd4d7d4ffd22afb88084bbc192c5f98b4d454e2693027fd07e163cf908d5924950dd5fb24a26994a3e82e2c755745be523c68d4a7557b11

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk
Filesize
923B

MD5
36867f540d444fb05ba7469f61198517

SHA1
26e3ec466b5392d8bc47c49937b11bdfe30e8bea

SHA256
b0e200ab7b8320378557a7a5d4f14d9d3f7b8fdaae9541fdecab0c16f63e9f95

SHA512
d6637fa169b65dfb8f36c24c8eee3b944ea09185ccb1ac1d7197028ef04a6d0ac613e0ec4728a8cf756623bb227b0e6c108194f741636f958488ff4c595c6f99

Download Submit
memory/912-67-0x00007FFAD3950000-0x00007FFAD3984000-memory.dmp

Filesize
208KB

Download
memory/912-68-0x00007FFAD0D50000-0x00007FFAD1006000-memory.dmp

Filesize
2.7MB

Download
memory/912-70-0x00007FFAD3930000-0x00007FFAD3948000-memory.dmp

Filesize
96KB

Download
memory/912-71-0x00007FFAD38E0000-0x00007FFAD38F7000-memory.dmp

Filesize
92KB

Download
memory/912-72-0x00007FFAD38C0000-0x00007FFAD38D1000-memory.dmp

Filesize
68KB

Download
memory/912-66-0x00007FF743E10000-0x00007FF743F08000-memory.dmp

Filesize
992KB

Download
memory/1060-26-0x00007FFAD38C0000-0x00007FFAD38D1000-memory.dmp

Filesize
68KB

Download
memory/1060-21-0x00007FF743E10000-0x00007FF743F08000-memory.dmp

Filesize
992KB

Download
memory/1060-22-0x00007FFAD3950000-0x00007FFAD3984000-memory.dmp

Filesize
208KB

Download
memory/1060-23-0x00007FFAD0D50000-0x00007FFAD1006000-memory.dmp

Filesize
2.7MB

Download
memory/1060-24-0x00007FFAD3930000-0x00007FFAD3948000-memory.dmp

Filesize
96KB

Download
memory/1060-25-0x00007FFAD38E0000-0x00007FFAD38F7000-memory.dmp

Filesize
92KB

Download
memory/1096-2-0x00007FFAD9F90000-0x00007FFADAA51000-memory.dmp

Filesize
10.8MB

Download
memory/1096-8-0x00007FFAD9F90000-0x00007FFADAA51000-memory.dmp

Filesize
10.8MB

Download
memory/1096-1-0x00000000009E0000-0x0000000000D04000-memory.dmp

Filesize
3.1MB

Download
memory/1096-0-0x00007FFAD9F93000-0x00007FFAD9F95000-memory.dmp

Filesize
8KB

Download
memory/1784-75-0x00007FFAD0D50000-0x00007FFAD1006000-memory.dmp

Filesize
2.7MB

Download
memory/1784-74-0x00007FFAD3950000-0x00007FFAD3984000-memory.dmp

Filesize
208KB

Download
memory/1784-69-0x00007FF743E10000-0x00007FF743F08000-memory.dmp

Filesize
992KB

Download
memory/1840-29-0x00007FFAD38C0000-0x00007FFAD38D1000-memory.dmp

Filesize
68KB

Download
memory/1840-28-0x00007FFAD38E0000-0x00007FFAD38F7000-memory.dmp

Filesize
92KB

Download
memory/1840-18-0x00007FFAD3950000-0x00007FFAD3984000-memory.dmp

Filesize
208KB

Download
memory/1840-17-0x00007FF743E10000-0x00007FF743F08000-memory.dmp

Filesize
992KB

Download
memory/1840-19-0x00007FFAD0D50000-0x00007FFAD1006000-memory.dmp

Filesize
2.7MB

Download
memory/1840-27-0x00007FFAD3930000-0x00007FFAD3948000-memory.dmp

Filesize
96KB

Download
memory/2556-50-0x00007FFAD0D50000-0x00007FFAD1006000-memory.dmp

Filesize
2.7MB

Download
memory/2556-55-0x00007FFAD38C0000-0x00007FFAD38D1000-memory.dmp

Filesize
68KB

Download
memory/2556-47-0x00007FF743E10000-0x00007FF743F08000-memory.dmp

Filesize
992KB

Download
memory/2556-54-0x00007FFAD38E0000-0x00007FFAD38F7000-memory.dmp

Filesize
92KB

Download
memory/2556-52-0x00007FFAD3930000-0x00007FFAD3948000-memory.dmp

Filesize
96KB

Download
memory/2556-49-0x00007FFAD3950000-0x00007FFAD3984000-memory.dmp

Filesize
208KB

Download
memory/2612-38-0x00007FFAD3950000-0x00007FFAD3984000-memory.dmp

Filesize
208KB

Download
memory/2612-43-0x00007FFAD38C0000-0x00007FFAD38D1000-memory.dmp

Filesize
68KB

Download
memory/2612-41-0x00007FFAD3930000-0x00007FFAD3948000-memory.dmp

Filesize
96KB

Download
memory/2612-42-0x00007FFAD38E0000-0x00007FFAD38F7000-memory.dmp

Filesize
92KB

Download
memory/2612-40-0x00007FFAD0D50000-0x00007FFAD1006000-memory.dmp

Filesize
2.7MB

Download
memory/2612-34-0x00007FF743E10000-0x00007FF743F08000-memory.dmp

Filesize
992KB

Download
memory/3012-48-0x00007FF743E10000-0x00007FF743F08000-memory.dmp

Filesize
992KB

Download
memory/3012-59-0x00007FFAD3930000-0x00007FFAD3948000-memory.dmp

Filesize
96KB

Download
memory/3012-53-0x00007FFAD0D50000-0x00007FFAD1006000-memory.dmp

Filesize
2.7MB

Download
memory/3012-51-0x00007FFAD3950000-0x00007FFAD3984000-memory.dmp

Filesize
208KB

Download
memory/3012-61-0x00007FFAD38C0000-0x00007FFAD38D1000-memory.dmp

Filesize
68KB

Download
memory/3012-60-0x00007FFAD38E0000-0x00007FFAD38F7000-memory.dmp

Filesize
92KB

Download
memory/3084-56-0x00007FF743E10000-0x00007FF743F08000-memory.dmp

Filesize
992KB

Download
memory/3084-58-0x00007FFAD0D50000-0x00007FFAD1006000-memory.dmp

Filesize
2.7MB

Download
memory/3084-57-0x00007FFAD3950000-0x00007FFAD3984000-memory.dmp

Filesize
208KB

Download
memory/3084-62-0x00007FFAD3930000-0x00007FFAD3948000-memory.dmp

Filesize
96KB

Download
memory/3084-63-0x00007FFAD38E0000-0x00007FFAD38F7000-memory.dmp

Filesize
92KB

Download
memory/3084-65-0x00007FFAD38C0000-0x00007FFAD38D1000-memory.dmp

Filesize
68KB

Download
memory/4064-39-0x00007FFAD0D50000-0x00007FFAD1006000-memory.dmp

Filesize
2.7MB

Download
memory/4064-36-0x00007FF743E10000-0x00007FF743F08000-memory.dmp

Filesize
992KB

Download
memory/4064-46-0x00007FFAD38C0000-0x00007FFAD38D1000-memory.dmp

Filesize
68KB

Download
memory/4064-44-0x00007FFAD3930000-0x00007FFAD3948000-memory.dmp

Filesize
96KB

Download
memory/4064-37-0x00007FFAD3950000-0x00007FFAD3984000-memory.dmp

Filesize
208KB

Download
memory/4064-45-0x00007FFAD38E0000-0x00007FFAD38F7000-memory.dmp

Filesize
92KB

Download
memory/4460-33-0x00007FFAD38E0000-0x00007FFAD38F7000-memory.dmp

Filesize
92KB

Download
memory/4460-20-0x00007FF743E10000-0x00007FF743F08000-memory.dmp

Filesize
992KB

Download
memory/4460-32-0x00007FFAD3930000-0x00007FFAD3948000-memory.dmp

Filesize
96KB

Download
memory/4460-35-0x00007FFAD38C0000-0x00007FFAD38D1000-memory.dmp

Filesize
68KB

Download
memory/4460-31-0x00007FFAD0D50000-0x00007FFAD1006000-memory.dmp

Filesize
2.7MB

Download
memory/4460-30-0x00007FFAD3950000-0x00007FFAD3984000-memory.dmp

Filesize
208KB

Download
memory/4600-64-0x00007FF743E10000-0x00007FF743F08000-memory.dmp

Filesize
992KB

Download
memory/4724-253-0x000000001E690000-0x000000001EBB8000-memory.dmp

Filesize
5.2MB

Download
memory/4724-10-0x00007FFAD9F90000-0x00007FFADAA51000-memory.dmp

Filesize
10.8MB

Download
memory/4724-191-0x00007FFAD9F90000-0x00007FFADAA51000-memory.dmp

Filesize
10.8MB

Download
memory/4724-210-0x00007FFAD9F90000-0x00007FFADAA51000-memory.dmp

Filesize
10.8MB

Download
memory/4724-9-0x00007FFAD9F90000-0x00007FFADAA51000-memory.dmp

Filesize
10.8MB

Download
memory/4724-16-0x000000001CE60000-0x000000001CE9C000-memory.dmp

Filesize
240KB

Download
memory/4724-11-0x000000001BF50000-0x000000001BFA0000-memory.dmp

Filesize
320KB

Download
memory/4724-15-0x000000001BFE0000-0x000000001BFF2000-memory.dmp

Filesize
72KB

Download
memory/4724-12-0x000000001C060000-0x000000001C112000-memory.dmp

Filesize
712KB

Download
memory/4924-76-0x00007FFAD3950000-0x00007FFAD3984000-memory.dmp

Filesize
208KB

Download
memory/4924-80-0x00007FFAD38C0000-0x00007FFAD38D1000-memory.dmp

Filesize
68KB

Download
memory/4924-77-0x00007FFAD0D50000-0x00007FFAD1006000-memory.dmp

Filesize
2.7MB

Download
memory/4924-73-0x00007FF743E10000-0x00007FF743F08000-memory.dmp

Filesize
992KB

Download
memory/4924-78-0x00007FFAD3930000-0x00007FFAD3948000-memory.dmp

Filesize
96KB

Download
memory/4924-79-0x00007FFAD38E0000-0x00007FFAD38F7000-memory.dmp

Filesize
92KB

Download