Malware Analysis Report

2024-08-06 11:12

Sample ID 240614-ynwbnstdla
Target image_2024-06-14_155622581.png
SHA256 593e1288bf819bed2b272608c8d1b78cb0ce3ba7f1da989c6e84096a6124e478
Tags
quasar testing spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

593e1288bf819bed2b272608c8d1b78cb0ce3ba7f1da989c6e84096a6124e478

Threat Level: Known bad

The file image_2024-06-14_155622581.png was found to be: Known bad.

Malicious Activity Summary

quasar testing spyware trojan

Quasar payload

Quasar RAT

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-14 19:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 19:56

Reported

2024-06-14 20:00

Platform

win10v2004-20240611-en

Max time kernel

231s

Max time network

234s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\image_2024-06-14_155622581.png

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
N/A N/A C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133628686094296741" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000003f8835712ebcda010e60d83c3bbcda017ec0147495beda0114000000 C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "6" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "5" C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Documents" C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202 C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80922b16d365937a46956b92703aca08af0000 C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5 C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Release\net452\Quasar.exe N/A
N/A N/A C:\Users\Admin\Downloads\Release\net452\Phantom.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1848 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 4916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 4916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1848 wrote to memory of 1428 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\image_2024-06-14_155622581.png

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff907aeab58,0x7ff907aeab68,0x7ff907aeab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2288 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3120 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3136 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4360 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4576 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4716 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4580 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4940 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3136 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\Release\net452\Quasar.exe

"C:\Users\Admin\Downloads\Release\net452\Quasar.exe"

C:\Users\Admin\Downloads\Release\net452\Phantom.exe

"C:\Users\Admin\Downloads\Release\net452\Phantom.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2512 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:2

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jevvewxj\jevvewxj.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4404.tmp" "c:\Users\Admin\Downloads\Release\net452\CSC26535C8B8D174525A9F485608BF4A449.TMP"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lmnuolhw\lmnuolhw.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES454C.tmp" "c:\Users\Admin\Downloads\Release\net452\CSC3D307B1BD35D45F1A4B9CD2CA514F5.TMP"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2876 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1884 --field-trial-handle=1936,i,11181752177245204196,7852222927221142784,131072 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
NL 23.62.61.155:443 www.bing.com tcp
US 8.8.8.8:53 155.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 10.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 play.google.com udp
GB 172.217.169.46:443 play.google.com udp
GB 172.217.169.46:443 play.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com udp
US 8.8.8.8:53 46.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.108.133:443 avatars.githubusercontent.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 154.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
GB 142.250.180.10:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 collector.github.com udp
US 185.199.109.154:443 github.githubassets.com tcp
US 8.8.8.8:53 api.github.com udp
US 140.82.114.21:443 collector.github.com tcp
US 140.82.114.21:443 collector.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 10.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 21.114.82.140.in-addr.arpa udp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
GB 142.250.180.10:443 content-autofill.googleapis.com udp
US 8.8.8.8:53 private-user-images.githubusercontent.com udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 collector.github.com udp
US 140.82.112.22:443 collector.github.com tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 22.112.82.140.in-addr.arpa udp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
GB 142.250.180.10:443 content-autofill.googleapis.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons4.gvt2.com udp
US 216.239.32.116:443 beacons4.gvt2.com tcp
US 216.239.32.116:443 beacons4.gvt2.com udp
US 8.8.8.8:53 116.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 alive.github.com udp
US 140.82.114.26:443 alive.github.com tcp
US 8.8.8.8:53 26.114.82.140.in-addr.arpa udp
US 8.8.8.8:53 github-production-upload-manifest-file-7fdce7.s3.amazonaws.com udp
US 52.216.221.33:443 github-production-upload-manifest-file-7fdce7.s3.amazonaws.com tcp
US 8.8.8.8:53 33.221.216.52.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 140.82.114.26:443 alive.github.com tcp
US 140.82.114.26:443 alive.github.com tcp

Files

\??\pipe\crashpad_1848_VNNCXFMSIQPCGMEX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 e9bf8a73d8390421ac512eec88b809c3
SHA1 4dbafc913209e870b8cc5b93d711bf8e3727974f
SHA256 150372c6256d83af242bd3de336469bdd32b2e38384f649ac6d0570681bc0496
SHA512 6ea20ee50d427c6069d47d785d08f71b1ac09e38d4bdd2141a78d286c9e89b763b867933dc4adaca6885487f600461b4e1f12601eea81b22fd02c5fde2378344

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 2149edf42fdee9401e4102fe289b71d3
SHA1 e5e34522645d5afcdbba95317b2a20748628b2b2
SHA256 b942932c7f30b9a1431024856d665b145085a0b369129305d0ddc5a0e71180f3
SHA512 ef7b0cc727fa6f8312a9e188b3a5e6012a5f32214edad32c42bee5c45538ab70fe02b51a4f626f8acb7db705def6667b072e9a543cc1ec326a4ea08446431e9e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 0f9787151accb0fefaaa2ed9b3bd8edd
SHA1 2b18661341ac6c1e3a1b565736ae80a699daf50d
SHA256 3f82fff38f9b044490f7b8ffa12016843878ff06efc3d2acbb21b1a8131d64f1
SHA512 d7681d69b15a9ae3f6de7af205133e3faea8b2fef86798bf899f8f8dd4664981b31d394f70e7ee4eb780ae9b53543589f826dc7056cf8afaee638a486951e910

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 bafa5267fefb054f9824382452147cff
SHA1 a0d17e7a15cd137dd99b9856963cf0d0be5f85c8
SHA256 743e9f6c2ec7b015e94e557790863755c957f2d91f3f7a3f5e34411398cde11c
SHA512 583087dbac0a225fe0606f52e61e765606654a2077c38ecc37470587c9b55cec86361748c6afa76eae0d8ecf252cb648438e532b452c3db60b2c2ff8105792a5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 68857f91051fe8ec2d54c4231f0ddb6c
SHA1 1983b64e499d2d2aae37a7b293ff163efc79e8bf
SHA256 c2b2b7c9f05cfb6c1b7ea072cc4c033938ca8bfb84f57e79b9b26b1aa13937ab
SHA512 0f48097e9fbe44b16b74dbb0dba91185b0563f6e257473cf03cd0e9fe81a6b5c848a8bb38fefc4b5ec29f55673218e9ad4ee3267b8052e85fc60f4765bbbfa4a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 dbb8bc803f060642cc1a1f6c4be88d31
SHA1 f2db65efe7402e6122c5e0c64d1261efe32c4d93
SHA256 a34b4887dae2188ca254008c0c3478510c18ca13302afc11db28e3e79cbf8c4a
SHA512 bfbc33463ebbdf316c812c75e194ec7cf6a87043c8601c9d50d10315594be93b4ba41fa51f8091366e6cbf1b14f7d792e0f0922eac8922a16f966e6db4112e8c

C:\Users\Admin\Downloads\Release.zip.crdownload

MD5 39c0f302390f115837ebf88f370c9f61
SHA1 56dab3a25ba0f4b0ca730c531bb53fccd649328f
SHA256 6c56877063bd0354599282dde8dd96fb82160525d765d48f5b807451387b091b
SHA512 ebfd9b2435f84c6d8217f7501708ed5009dd164cf623a37690696a31351e3d41a6a62ac78727257d4d3e4e33e39551704ee4a90e1bc48eff06595e4d7032ee98

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6f71e97b073096fa7008dd29d68aa062
SHA1 5d2ae0e3ab2e9a448015f745152517a7117017f7
SHA256 025def4c951ea050794ba06167c776695b3b6b9e91ae66d3d0944ba08581082b
SHA512 17ed25c3d90922ec50b6a54b828bb63fa6fc4ed3ff95857e440dd6a02e53745534fc782426ae2a7eb9330f1d482233daeafb27346774f5ebf72aaefaef3cf7ed

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 116996bc2f18a96cf0c4382bdbc22edb
SHA1 45bf4bf746157b4265ef5514c3d68061b6f9e26f
SHA256 e5a710d7eacbc1a5f0e2915157d0fb41a60974ea46ec5bbd2061561335f0c65d
SHA512 30d2fa5805634fffbd6d6adc1c05a2d6339a6ba4cc4aa3e810486da7eb15f3568e253d21c169e7547d764be99ff213163cfc9418571365e058c20d88ec31500c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5815a6.TMP

MD5 c10ba3ced4666499afc33424d9581a91
SHA1 12666c98f0d08eab0d6eba262b7e02ba96eec248
SHA256 a44f58d8fcd17ba76c0dfcb853ea68c5936eee9c790aadcd1728bb5daf7c09cd
SHA512 d6432bde792db8aab0b674d0687318c04912222c171dfb70004c7e7351f2c09560fad177181852dcd7f0ac815dd3538f6010b9ced5c4716e45815057f074e44c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 4f502584ef968f1a034f54e023267509
SHA1 285a6c00deefe147ce44dc3c47ed8cec4132dc59
SHA256 0d198103aafc8b0317e0a097aca689eec95e1b316fb1b1ffde16a31ae9ced926
SHA512 6de3e344db1d06089b7cceeae71118cb526b1ec3fbf933e88e42c9fb885f380fcba9c7f032d6c280bd28acfa274f1989a427fa4346119af8a86b7b7bd13360b2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 397a3bdae384c82365cc401eacf9422a
SHA1 15b1b204adfde65cebdc9be4567d16501d433190
SHA256 cb4d70c2801b7f7d1b523f6134776e9f8e013add5152a2a24b60e249ed480312
SHA512 8d139c7d0180d44de1f8f31f0a34c702b450ad85a3d51b910c540c14c6ac750fbea80ff5dc82c6e542b14ba61ef28e22ff9fc4f125d2fc27feb3ea78bc6fbc4c

memory/2372-413-0x00007FF8F47C3000-0x00007FF8F47C5000-memory.dmp

memory/2372-414-0x000001E8C64F0000-0x000001E8C662E000-memory.dmp

memory/2372-415-0x000001E8C81D0000-0x000001E8C81E6000-memory.dmp

memory/2372-418-0x000001E8E3370000-0x000001E8E3388000-memory.dmp

memory/2372-419-0x000001E8E33E0000-0x000001E8E3430000-memory.dmp

memory/2372-420-0x000001E8E34F0000-0x000001E8E35A2000-memory.dmp

memory/2372-421-0x000001E8E3430000-0x000001E8E347C000-memory.dmp

C:\Users\Admin\Downloads\Release\net452\settings.xml

MD5 8e44a023d2112129ab2bf88a4c04381a
SHA1 a1a736dc126588bf1e819c7a42866088f8170fe3
SHA256 2ab378fa81f348589311749673b574900ebe364e153784b6419a6dc51715316b
SHA512 9cebef823d45962677ebaff1d72177ea5ba5d94702a2645950a6a794339b66faac994f45729603594558e7375b31ae0533cc9fd616169ee3613a956bfc13de5c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8c594606-d1e7-4a37-ae7b-d4bb00744595.tmp

MD5 daba842011cffe140da867ebfcb00f75
SHA1 7d1597a48ba292415626f9a115532e0022b50fd6
SHA256 6483547e221afe8b552f38e853c6921846ad43da548c03aefdab1944d816e6ec
SHA512 391a1d583b1033cc3eb5cb6a27294671dad5d3dc22d62ea04e7e60c82f2bea29fc5055bb501fa5dcdb2eabfeff4303a1e7ca90b8b55021348b885b19638d92f2

memory/2372-457-0x00007FF8F47C3000-0x00007FF8F47C5000-memory.dmp

memory/2372-459-0x000001E8E5D90000-0x000001E8E5DEE000-memory.dmp

memory/2372-460-0x000001E8E2FA0000-0x000001E8E2FBA000-memory.dmp

memory/4136-464-0x0000000000080000-0x00000000002FA000-memory.dmp

memory/4136-465-0x0000000005390000-0x0000000005934000-memory.dmp

memory/4136-471-0x0000000004D10000-0x0000000004DA2000-memory.dmp

memory/4136-472-0x0000000004D00000-0x0000000004D0A000-memory.dmp

memory/4136-476-0x0000000007690000-0x0000000007740000-memory.dmp

memory/4136-477-0x0000000007780000-0x00000000077A2000-memory.dmp

memory/4136-478-0x00000000077B0000-0x0000000007B04000-memory.dmp

C:\Users\Admin\Downloads\Release\net452\Client.exe

MD5 d51aed5befb27ddab601db7cc57766b3
SHA1 3f0758f9737246e1611f072032046a9a6297d549
SHA256 269ad091ec7fb8bf9edc8681f334678c24891df5c34285797e050a73f2dc2098
SHA512 3d935e902c95bc3c898b43fae72f4702edc265f9f23e86658621d273ff42e734da0a0941be4dc0c602dd86860ed2f7598d762a8076559a46b53b24932b9d491d

C:\Users\Admin\Downloads\Release\net452\input.txt

MD5 846016e5b6c566c49ce269ff34268647
SHA1 b1679eb8e66fe660db9b88f792ebd477e843155d
SHA256 a0457046b7226666d5f582d62672b168e325eb87903761fb1ae7095b76a95c88
SHA512 41cd3b2543532c373e5e156307b8e8c82038cb7530cfdb8a337ec2ec7e7cc6500e9474ab2375c4d7c0f15010ba18d9afa60fefce543956ad6a05ade18aeda9f7

memory/4136-484-0x0000000008360000-0x0000000008684000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\jevvewxj\jevvewxj.cmdline

MD5 f5af92ec2846e3217eada51518f29eff
SHA1 c9a197c68c26cedd7d667fa6f312c492f85b96d6
SHA256 b9bb528c54c26f420df4f32a6cb1ba8e1a6aa7b33b71a30bd64151bac90bd2ae
SHA512 c7045780ed1aad0eec55df2b2af4a5d9ad9b346e2c247c2f10357fea676033c985e52b7cbd59deff9f9c95d76bb1204ad206d5d0ec29a99919ec28efb73c9013

\??\c:\Users\Admin\AppData\Local\Temp\jevvewxj\jevvewxj.0.cs

MD5 db73dc0f9ea53f7253f89453a1c44229
SHA1 54a6622cd67ca111e9f36d37d9ffc09ba5051d22
SHA256 88cf87b72a204cc567679c82a2c2ab8ad288c9b57f0efef8fea35b382853e210
SHA512 da5e3cb7df665b8d35218eb61d023fe582520d675fdd1b5658b708f2b1709cfb1076ff7287b22aa5894ebb53c3a74287564a80e59bfb55ac7f9981cf5e6ea5cf

\??\c:\Users\Admin\Downloads\Release\net452\payload.exe

MD5 99313b9a58bf3261e1b7fd9bb1f1349b
SHA1 dbc5159c9e2d4845bdf074409eabe5b6af0224ad
SHA256 2b4f4797cf751f903475a0e67d10e0d306096e709d20128c50c34c5683eecd42
SHA512 2f97d49d7102aaa3b29bb65bda1fe81c3efcff18e74c34c178dd5a3e48244b8b158055fcee2ccb293ccd98aa25c5f3a03055db1cb1814e39f2348a4503a9726d

\??\c:\Users\Admin\Downloads\Release\net452\CSC26535C8B8D174525A9F485608BF4A449.TMP

MD5 467489367504ff70a113e0f85a6ae821
SHA1 2a885a5bc00cd193ea2369c2f643fea9e1446acd
SHA256 f795e9ddbc3450b54a69e38de4dfc9fa876bd3b36ad2a3b0fd1ad0f7c6713155
SHA512 22f5a2218e205ce029e1801a317847334c4a3622f805e50ee2c94ee0d0001e6ba5434b322bd951b18da176dba54f40203e36bb90e1aae284bfa4b5f43ccd0111

C:\Users\Admin\AppData\Local\Temp\RES4404.tmp

MD5 4b26077c5fcd6bc605375124fd26ed40
SHA1 1ca9da2923fd81c4015edb149829e3e8754dee09
SHA256 6f8d5caeb6dcab94929bd9617618ce0dcfc2fa078d151c1add0e3119246207b8
SHA512 d30860255848ccf5e234b57b00d35162c93c650a67face8ddc967c64c9b84d55efb91f5a6e6fb6ee4fd6f9cf8ae0d96fb5b7cce2fb1c428b87a246b6019fcabf

C:\Users\Admin\Downloads\Release\net452\JkxymOEGvD.tmp

MD5 8aa980a478f674c81829898d8e85a572
SHA1 ff19b32b314e8478a13660ba995b631663b34f9c
SHA256 7a6145d7b269a3f4bded457d2b94b4a348965a1bfc400346bc30244d1a94b1cb
SHA512 36b255bb509a10328db6c4ed6a47d00a6f7333798e90ae4bd229e7bc4a5c7fdcb66190f6268182f60457c76ff0b27f0382b4ddf2357466d058fe28cd8776e052

\??\c:\Users\Admin\AppData\Local\Temp\lmnuolhw\lmnuolhw.cmdline

MD5 2504a67526840c509eca9a14dd250821
SHA1 5eb67aae1e414c99cd071aa2b2ce3e3e7c9d85f7
SHA256 e6a6e2af2d5ecfe48099df2fd998a468d00bad119f266f7a40d12bc2903a36b2
SHA512 806c0223c00bd053e554e3384181c6560e71c90aff3b1638f0df5da3ff8db68e3e52ab80ff7eafc0e0957f5bf3fc1924cfce41c574ac724f2d233a972b42e667

\??\c:\Users\Admin\AppData\Local\Temp\lmnuolhw\lmnuolhw.0.cs

MD5 a8ff4ea875e3025336d34aa95d5ef9f0
SHA1 0ec17cbf30076aa3b13bb687931c430c1fb9b533
SHA256 d6c2a82c9c76af5608a898d8840dbb72644239319dcfe86aa6ec8b5120612541
SHA512 fded699dd73275a0cefcd347199b7f13e9eed671b19a714e2c9179677dfa17225ecdfaad423d27d3ab6e73499919576db11abaaa7a9c75ca5287583234946001

\??\c:\Users\Admin\Downloads\Release\net452\CSC3D307B1BD35D45F1A4B9CD2CA514F5.TMP

MD5 950ed4c0eac0f3afc7bcd7df9974b56c
SHA1 a730de958d47abe9982b7578ed4e72d23844ff61
SHA256 eeac7368bb995b5ba69f3009bc49bbf9318c9e3e1af5bce2d732c2d00c6e6258
SHA512 c496eec994d7421ba5653b2fd0dfd29fdcbc631d47b6905647010dfd3bfa548d57edbb7f28cb735a255b32497ec486f35c98e1a57abf917eca788c7211723ccf

C:\Users\Admin\AppData\Local\Temp\RES454C.tmp

MD5 7f02e02b4d75e0985d4b6acd37589bef
SHA1 32006966e49859a20f3b38bb454e8ea9b43761d1
SHA256 486bab76b0fe0ff767a44eeed3bb21fc4a297f3f4fb229a422970b2c06b2200f
SHA512 26ad4b3993a1e4b19eaf3caabbb48b36b2eaa713768e81719380f82208bdcd9fc3533beeab65b557aac82b324d24b9ad2ccc1b80ab516b2fe759ebb4e632ef2a

C:\Users\Admin\Downloads\Release\net452\zTBLIQMSZB.tmp

MD5 faa97578a2f848427b15aaadfd900343
SHA1 ddf5fc6e43b0a9fcec8cd4ba2dfd4a0a83aba792
SHA256 09d87fc7a35ae7a3d616d466e4a7bb18353e50af59f854f67e0dc9708760079d
SHA512 9784ff209adaaaf04d8e7472e6be67615921412b242919e4f0eddbe66ceaee0bcfd295d2699f864219625481456c03e073f383c9988ed4f57c20363b6554d1d5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b87f68396d0b74631e3a8c72977a89b4
SHA1 7be8f511d5a068c880ac65594d12c5269dd9cbe2
SHA256 1d7a2e7e819bf971ece907d16680baff091efd1478d22d67ac110455c785aa49
SHA512 6d920e98693320f514086ba58aecbcb01fdcaf577221ca495b7fa4e20197ef65b5bc3b6295a3c019e10a319332d5f8a0273d363920984832c3d503360e25cfc5

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 fd748e10622c65dc8a979e10e0fb9cff
SHA1 e977d7d725a29c5df27c2103091da5c80ef0d388
SHA256 2d8df5e3aa2fd1e8c1d8cc055f05d3ec52f0257297435af3703a76d56c4fcb97
SHA512 b6a5fad65b31ffa60574ac202d48a5eba5268ea23c17f4765944dd7df6100f115c779e09d9b0b02feafab6a1aa719dbbd43e0c0111223d1f11567d5a3d1a96bf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 c04200c7f88547821686105ea628660a
SHA1 b85bb96820ce51fa2977d8328f4ad7fd9878157d
SHA256 070591d83acd0dadc25b4b20b87fe9fb7a31e392c82158d7fb1b45120b213412
SHA512 a6b3d91d27e38d5f9fae878df44a2a2e424a1fc4e85e0547581eeba1f9f7d1c3f586ee644c1b2671212280c58c74a1ac4b3c487f33831ff3168699cc68c49143

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 331533b2452c170c876cb933d882a816
SHA1 7b7ca7e5b68951e1a22f2de0f860bffb19f280e3
SHA256 2330eb628d65ad1d7ed0a411e74aa5b7a0dee04208864a040496a6163b721105
SHA512 312df757faccdff914e60aaa3424eecb0b42183ddaa158c69ea188f9cee43f894f2cff8cf2f19106723723a4cab1d8d55ac460c8eabe4b3c64929a7e6059132b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 698657417225402680cb39e7510636f5
SHA1 6fee76d246428137a9260a93a5ca67f28b3971ad
SHA256 17fa7bca3543fd904706fb1a633762f5512a44b6d3666e9b05228bd64fc7cde6
SHA512 8432dea5fed12dd9b3fb85f3762309e9b664baf49ae06d3ddd9a55d3415022212165457d917e744c19b01dd904baaa1a94510398231aba2136e1eb746af63237

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

MD5 4f462ea90211a0170c0fac3187824858
SHA1 f90cc1b6f82e5f07739bd91b2b363e83716c826a
SHA256 c61a598483428c78349280e539bab7ae8c19ffdbe31b1c7cbd98c3a4e4a129b7
SHA512 f02a268d985f856d97df4eec61e9e16bcaa53a3bb068499723c996813afb6c93e7e980489126b21f720b580a69356001fc0c20e1337ad1f53c91071de0211776

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 5bf4ebd236837fbed513b7022fcf3083
SHA1 2a0549927fef291958d345426892bff435ef7419
SHA256 fea92071ded0625fc4c8cd94edd4abd893b81674bf459fdfe533b96d1b1ed87c
SHA512 1fae04f4ac70a6db5c1df8f69a359f90bec5b84261b270594683c40bcdc0744f5999c0953a3cecb73cddb27ab5ab8d79c15e90a048ac6729f46d75ff26a221cc

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

MD5 1acb57ea4072eb7b816118dfba0202d2
SHA1 76c912d45ebe39459fb9af4b07d23e1a9d6976ee
SHA256 c2a9ef51e2bf55e3739170bbbec2849beeaf6edf669b0c7441127401414d8829
SHA512 d825c61568d8ec83e6803515e6e1e1aa59b5ee822d11311424b8cd36700b485718943fd5c7566f552863171d210e64c1251282e85cc7126e1ee568de22278597

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 eb34ef8917a1fb670202340e43a0f378
SHA1 ef6020ea90c3dce754d94469abbbea918f6b02cc
SHA256 f7929697ead2822e07c38f519f58395f20bf9526038cdb113fb90aa12b7301ea
SHA512 4fe726d1f04dca538a8e542a6781089495fbd92b723ab4377a6e740f9f5b5f994f2e098369bbc9f43616f996950cbc967300327e168ca84fed6b3376daded5fd

C:\Users\Admin\Downloads\Release\net452\Client.bat

MD5 439120f796ed4977f594bea8bd82cf31
SHA1 4584ec947309d2c0d3aa0b7af99a74e914649f1f
SHA256 a2ef6988f4d2669de231d1857b5fb9b64d0069252db3c017498a065f2d1574cc
SHA512 605f0958b42a350f9b4a01cfb47e17d6d095a4a299ad182c537016d5fb1e83c3860d4141cae74242644504aac6b3b5378e6c4551b1bba918bb793fe8e883a49b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

MD5 1ec8fb7f6fd9050ab7c803cab2b0b48f
SHA1 6b831a02f8daed957b82c310cf867aa3e77b9816
SHA256 4345ede1557a49c9322e84fcfe2a20821e47003c2b3c214de6ba6d5d42bac73f
SHA512 d4ef769640f071121d07f8942533c7cfbaf4e4a29476d8977fb31d462e986246278fd599b2cb4344713f5ade2b89faed5c728093e31848c9e428601f0ea2f871

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\c93622985013877f_0

MD5 8512467606899d52048aea46c16b31d0
SHA1 566f3f67d6aa222f71d3faac9a77d7e74fc5808d
SHA256 7f217af3e8c8465e9a5c8e89001066e26c264a1614e1cee54305d6487e9082d5
SHA512 2b4c1b4757f1e4bb201339285a970028cc6148af05f507d793f14c77719ea9a73662e85a5fb8f37010260b38d9173dcb212473fc287492846044cdedb257cb58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\890341016b4cb769_0

MD5 297c70be66d83bcbc7f2d87a4c7e21d8
SHA1 fa1e6d9a73025774ed081699c5593e0339dbedce
SHA256 e6daf0b1c32dd8824c497da29e561eb68afb76aa7a4c51919e2723161492e5cd
SHA512 f365500b0f55bcee919fea3e48b75e808855da6feef0c06def2c313858d10dffbdd14f998375951d611e1cd6d3c0edde92c5cd88d9537ff253a7e01e58b01032

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3c1b71d6c92f4ff2_0

MD5 fadf706671b3bb470ac53cab81a07187
SHA1 e1466b720cce59ae6f0c76175241c8f166003851
SHA256 373c779a33c7cc48a12d6e47a3e363319963fb5f09b8617b048bbf2a5908b38c
SHA512 2efb15e6ef1c26b3e15f96835a5c0567a064d02c9d5aa052b46a88af0a347031ff743f67536b57a810431a6fb3d27d24950e45fb91b84689f8ae6ae691a6914d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\50e7ca177d06e22b_0

MD5 1d40b613aa320e36b813108388b65ef2
SHA1 61a3423c5302717eaa95a3fdb65dba3fe952bca4
SHA256 4c04c1928a1ae42671bd004453f133b5bd038a2bef39189ad948c95867c6ceee
SHA512 01625cf334f49b1ec073f23b9e0008ee42769b033eb2b9ebbaeca3a20ef102a2b7ea7a030d6c2dcb980fc4a1ae20d3306c33567ef230063c4204c322676b4ee8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\e17681d1054c0b81_0

MD5 39f76e7c141fee41067973fdf61811d1
SHA1 2dafd09b2acdf440869dd54897a50be109478cd6
SHA256 e52d7b2fdb6e38cb65b79966f08b5f1a691165429d7e33f0a4be855a0763fd5f
SHA512 83d83867bd56bcf0cbbdd5a3dfd3c0bb1bdecb4fdc98ab8ba5bfc16051ed2d48a9e7e4aa2a3890828c2aaa65c0d38885d8461e798526f1cb9e7493606a1d2a6e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b5c0b0d2ff0cad95_0

MD5 0cd773315095a4db3d2ff727ba85d402
SHA1 2fc90a104a0d55cb6744a10aee97d1197de46040
SHA256 0ec2356c49b8cb7fdd1e7a382f40d6f7585262564ecdf2685ab940cc6082272c
SHA512 7943bb46c996148b933fc30005a97a42d3086e796e047f26b43ad5b4194218e3e51a03115c57c20e2331721540ac7118721765912810b45865b2b2ff59aef0ff

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

MD5 8f41323683bb7d3ecb4b8decba29cefa
SHA1 95cb350f4bdb10839b4c3e9f9c5b8e87bb2e31a4
SHA256 c8b731ae3961dd30885a72f256d10eaa6e53bd021e8350e8627d207332c43f18
SHA512 ad881da39c9d5d49bdf434cc41195786e78d4f5a3dbc2bdd2241f9825c750c5df7a0b7e878c608fe76f829e74254503e8676a6ae2767af9f9cebd599a78f4368

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\997d66cf2e10a48e_0

MD5 7f7b3de7abf6b024713bacf0275320e8
SHA1 d60f1f15117cf31bec338141935f381bff13a374
SHA256 52bc6fafa4aa8475d16b776431207a9ebefbf8d6406c680de03debfebed98c80
SHA512 10d1fb90ad9fe96293f7ff7ae56dbdcb347577f21d07c3b69bcad81cbb7882c99435ced90b519754d8fa2ff8e8e4812f3be524fecad2c4140c719844f5ba8a9d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\dccb891849daff10_0

MD5 c8fca3ac88bc297dd3969f136d925786
SHA1 7e1256df73f7b20b138ea8e916f3108dd93c5d6e
SHA256 80a4070d9e00d727a1a2c968bb356e7ffb6c154ef306942b6d07693581c696a8
SHA512 c1030c69478e25c8c87fe4327b2aa5bd1c488cd6c75b4ea4cc7c280569a3631b9c5e90a0df92bd909c02b8f6e3d2e02fb3111b2e1a6d23c7d6204c69b1b8bc6d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3ea857d7190276a0_0

MD5 00cb3786a8849b624bf22f02799cdcd7
SHA1 da55295733b45169530c9cb13b4d298c4e245981
SHA256 7667de552bb0465f09ebb7b7161341e3ebedadf94878c75298a3d1da45277398
SHA512 355a05a48f4761f798dc470364ee5767b03de3d90af0eecd0d530dc799025a3497559267d517bb69fb14fc07887fd7ea5cf9aca20b2d2e2b51e1f3812a107f4b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d6bf4491f55aacf3_0

MD5 bb936b7f1ba577dc1215ea1b7c9d8a6d
SHA1 66494261ed4f8dc6ec20225116da7e0477e0226c
SHA256 0b845c4bbe326e375fbc0b017be209f4b33979aa53f811dafdafa13a1c94d07f
SHA512 d0b3719ea476ce917e8723f794a8b79367152a70d4bec2fc6eee0829a6f26b3047c1270954f47cab7ff7cc9f6cbf41467102d2d6b4ce8bedf328c728622551fb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\fed1cb4e16b3a1d7_0

MD5 6469ef27178f60f332ef36808c4f6c7e
SHA1 932f8370df7411d4b0d66ef99ce8795389c41daa
SHA256 b500968304fba67be004b446563789e579137ba1f19fd0c0dd7c0e9f2ae21c3b
SHA512 49612cea7c741e5db74710bb50f865ddc748550c1831d1ddba182dda5fed292c3578850e00f975c6e048069e1f5e238a7895748a7f5ddc6baf7d104807ec9dc4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\07a0c4a3e1abceea_0

MD5 9e91558d24ba26de98f24dcd0ce26db6
SHA1 7babf228b4cf0e47e1f68e7496a8658514a032e2
SHA256 73ebeca3d67fb5df1d97891f8f00c65fc8cb28822339eb4a57f8c5ac921ba010
SHA512 8314b0f150d227d0696eb7c98b643d02a8f7d021529057cd515ed52e6b8d851b23856e7ac410c5a8f3da6f1fca57bda0a56596b143a684011309c5bc00902bc9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\00237b8e0e6ffdc1_0

MD5 8cacc1afcaa513818f7448650ee1997f
SHA1 16d5eb539a3d6a7a89bbf0aa0497d03e77aade04
SHA256 1107b4d0b35acf14829fabad30af0da0dd9d46087259d7436eb8339fee241f1f
SHA512 ccf190aa7d914e7fdb7e3e071e8eee1585ca9f9884ee2507eb6fc104cf6698c51d1931b584c0e5ae5c82850b308a8175b03def5561a76484cce93a5c835df390

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 dd9809e2d421b124f0d60954dbe38118
SHA1 f67b32c438ab6aafcf3afdae6a053e348e7b91fe
SHA256 aa7e860cecc45d869ac6f460633a5c42e23d0e07bf73ddd2cf2c2e0436686038
SHA512 16127adad17b5e1b4f7b7a489aee65014d9d17cda60cd35934f070f92de486ce6d80ef21da590ee9461bde70f57a869dd073317a80993afc4386d24250fe6d9d