quasar | 6afbecf27622e89b8a0d5e7107a951a996b22b1a4239f3e1d7876ef603e3e93d

Analysis

max time kernel
801s
max time network
786s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
23-11-2024 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nose.png
Size

1.2MB
MD5

ed9c825249a85040c2e6df6049ab6ba6
SHA1

af0a2b4738b933b1c6c23ac96c4b7675b2fc43b9
SHA256

6afbecf27622e89b8a0d5e7107a951a996b22b1a4239f3e1d7876ef603e3e93d
SHA512

018cd0ce54ae7160c2a43aae4c0f3cf2c51c9a449c031f6cf2a1da2f10c776a518037b07717a21d19927ab82cb97fcbe74864e192a0f593bb61da15707901592
SSDEEP

24576:6iUwcohkKHD0FKK9ETsfL7oTKl5iA7tDnqBWhKJeQG+CdZtwjueui7bN:CchkKHYFK848L7oTKl5vtDnjKJXG+Cih

Score

10^/10

quasar discovery spyware stealer trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\Quasar v1.0.0.0\client.bin	family_quasar
C:\Users\Admin\Desktop\erg90ij.exe	family_quasar
C:\Users\Admin\Desktop\Quasar v1.4.0\Quasar.exe	family_quasar
behavioral1/memory/3840-1085-0x00000141D96E0000-0x00000141D9818000-memory.dmp	family_quasar
C:\Users\Admin\Desktop\Quasar v1.4.0\Quasar.Common.dll	family_quasar
behavioral1/memory/3840-1087-0x00000141D9BF0000-0x00000141D9C06000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.exeQuasar.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Control Panel\International\Geo\Nation	Quasar.exe

Executes dropped EXE 7 IoCs

Processes:

xRAT 2.exeClient-built.exexRAT 2.exexRAT 2.exeQuasar.exeerg90ij.exeQuasar.exe

pid process

1712 xRAT 2.exe
4264 Client-built.exe
1080 xRAT 2.exe
4796 xRAT 2.exe
772 Quasar.exe
3112 erg90ij.exe
3840 Quasar.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
1712	xRAT 2.exe
4264	Client-built.exe
1080	xRAT 2.exe
4796	xRAT 2.exe
772	Quasar.exe
3112	erg90ij.exe
3840	Quasar.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

Processes:

flow	ioc
92	camo.githubusercontent.com
105	camo.githubusercontent.com
106	camo.githubusercontent.com
107	camo.githubusercontent.com
108	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

231 api.ipify.org

flow	ioc
231	api.ipify.org

Drops file in Windows directory 2 IoCs

Processes:

mspaint.exechrome.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

erg90ij.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language erg90ij.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	erg90ij.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

3240 ipconfig.exe

pid	process
3240	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133768628995901009"	chrome.exe

Modifies registry class 64 IoCs

Processes:

xRAT 2.exeexplorer.exeQuasar.exechrome.execmd.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	xRAT 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000500000004000000030000000200000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	xRAT 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1 = 6a003100000000007759cf9a10005155415341527e312e300000500009000400efbe1647ab867759cf9a2e000000150d0400000004000000000000000000000000000000ff31ba005100750061007300610072002000760031002e0030002e0030002e00300000001a000000	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "5"	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	xRAT 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 0100000000000000ffffffff	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	xRAT 2.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	xRAT 2.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\NodeSlot = "10"	Quasar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	xRAT 2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\MRUListEx = ffffffff	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0 = 66003100000000007759189b10005155415341527e322e3000004c0009000400efbec550097d7759189b2e000000190d0400000003000000000000000000000000000000859712015100750061007300610072002000760031002e0034002e00300000001a000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	xRAT 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	xRAT 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000004000000030000000200000000000000ffffffff	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	xRAT 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	xRAT 2.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	xRAT 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\1\MRUListEx = 00000000ffffffff	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

224 explorer.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

mspaint.exechrome.exechrome.exe

pid process

3292 mspaint.exe
3292 mspaint.exe
812 chrome.exe
812 chrome.exe
1976 chrome.exe
1976 chrome.exe
1976 chrome.exe
1976 chrome.exe
Suspicious behavior: GetForegroundWindowSpam 5 IoCs

Processes:

xRAT 2.exexRAT 2.exexRAT 2.exeQuasar.exeQuasar.exe

pid process

1712 xRAT 2.exe
1080 xRAT 2.exe
4796 xRAT 2.exe
772 Quasar.exe
3840 Quasar.exe

pid	process
224	explorer.exe

pid	process
1712	xRAT 2.exe
1080	xRAT 2.exe
4796	xRAT 2.exe
772	Quasar.exe
3840	Quasar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

chrome.exe

pid	process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

helppane.exechrome.exe7zG.exexRAT 2.exexRAT 2.exe7zG.exe

pid	process
1292	helppane.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
4792	7zG.exe
1712	xRAT 2.exe
1712	xRAT 2.exe
1080	xRAT 2.exe
1080	xRAT 2.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
2120	7zG.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exexRAT 2.exexRAT 2.exexRAT 2.exeQuasar.exe

pid	process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
1712	xRAT 2.exe
1712	xRAT 2.exe
1080	xRAT 2.exe
1080	xRAT 2.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
4796	xRAT 2.exe
4796	xRAT 2.exe
812	chrome.exe
812	chrome.exe
772	Quasar.exe
772	Quasar.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

mspaint.exehelppane.exexRAT 2.exeQuasar.exeexplorer.exe

pid	process
3292	mspaint.exe
3292	mspaint.exe
3292	mspaint.exe
3292	mspaint.exe
1292	helppane.exe
1292	helppane.exe
1712	xRAT 2.exe
772	Quasar.exe
772	Quasar.exe
772	Quasar.exe
772	Quasar.exe
772	Quasar.exe
772	Quasar.exe
772	Quasar.exe
772	Quasar.exe
224	explorer.exe
224	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exechrome.exe

description	pid	process	target process
PID 2576 wrote to memory of 3292	2576	cmd.exe	mspaint.exe
PID 2576 wrote to memory of 3292	2576	cmd.exe	mspaint.exe
PID 812 wrote to memory of 3196	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 3196	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 2364	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 3756	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 3756	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe
PID 812 wrote to memory of 4700	812	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Nose.png
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Nose.png"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1128

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff97a06cc40,0x7ff97a06cc4c,0x7ff97a06cc58
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1960,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2008,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2020 /prefetch:3
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1816,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2300 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4548,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4740,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4688,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5388,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3432,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3216,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5684,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3168,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3576,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3844 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3280,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1296,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2672 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5132,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=1536,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4884,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4652,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5708,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4572,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=4596,i,14147924263713289129,8977562602489298922,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:2612

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2828

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap24829:92:7zEvent7195
1⤵
- Suspicious use of FindShellTrayWindow
PID:4792

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2748
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:3240

C:\Users\Admin\Desktop\xRAT 2.0 RELEASE2\xRAT 2.exe
"C:\Users\Admin\Desktop\xRAT 2.0 RELEASE2\xRAT 2.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1712

C:\Users\Admin\Desktop\Client-built.exe
"C:\Users\Admin\Desktop\Client-built.exe"
1⤵
- Executes dropped EXE
PID:4264

C:\Users\Admin\Desktop\xRAT 2.0 RELEASE2\xRAT 2.exe
"C:\Users\Admin\Desktop\xRAT 2.0 RELEASE2\xRAT 2.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1080

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap24900:92:7zEvent3090
1⤵
- Suspicious use of FindShellTrayWindow
PID:2120

C:\Users\Admin\Desktop\xRAT 2.0 RELEASE4\xRAT 2.exe
"C:\Users\Admin\Desktop\xRAT 2.0 RELEASE4\xRAT 2.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:4796

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap1870:88:7zEvent29895
1⤵
PID:2084

C:\Users\Admin\Desktop\Quasar v1.0.0.0\Quasar.exe
"C:\Users\Admin\Desktop\Quasar v1.0.0.0\Quasar.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:772

C:\Users\Admin\Desktop\erg90ij.exe
"C:\Users\Admin\Desktop\erg90ij.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3112

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap10249:84:7zEvent17087
1⤵
PID:2996

C:\Users\Admin\Desktop\Quasar v1.4.0\Quasar.exe
"C:\Users\Admin\Desktop\Quasar v1.4.0\Quasar.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:3840
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Desktop\Quasar v1.4.0\quasar.p12"
  2⤵
  PID:4360

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
76605ebdb55ab245151f14bcec366a72

SHA1
4d01e10056e66a5ea0b3b12d62f837510c56472a

SHA256
77059009b747fbbc32be3c52cbfaaa265104add24ddd255a9ffb12b8c7dc87a0

SHA512
579563d0ab9cdf70c7e244669ed1dd08a3c7ce3af0f1649acfaa7189ddc571f95984975c3e56ea0526b3a4aa18e4f5af2e92479015a4f710e845c8b7f5be4157

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
72KB

MD5
eefb3b7038040a2b45001d9b00e3614c

SHA1
64f409fcd8dba116aa15366783133833ea2e29e1

SHA256
d6def6ae11d1cf9bc2c244af00ffe3c6161263c26212e4009c613a02c8a9ea76

SHA512
d463a84948b07ac2b1c51f471e21e592f84b249f6a0f58853f3e38a357068b8a6e9d33de1146e187bee9c586bbb3525b7397f2f1b4f2a2c66d784e50385bc121

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
411KB

MD5
5a322b316bc8745d39d83b130a9ef6e6

SHA1
f2e8ebc252d92722555b6fab8e38fbccbf6003cd

SHA256
b6fe2ea8d85c1ee73bf4e45c34247fec18e2efa340d009e0c2c1b41cc42e3f47

SHA512
97fc03ce19046d14f561bd812c4853eebb608185d20b9e8f319098b866e820c09c35d42b4354d0a6ed519408fab7a5ecdcf4b33456561400c8e3acf256846535

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
38KB

MD5
4a6a239f02877981ae8696fbebde3fc9

SHA1
5f87619e1207d7983c8dfceaac80352d25a336cf

SHA256
ac546e02b937ee9ac6f6dd99081db747db7af6a4febf09cbe49e91452d9257b8

SHA512
783cf2ae4ba57031c7f4c18bdac428a1074bb64f6eb8cef126ad33f46c08767deeac51917bef0f1595295b9f8a708cb297b7cf63fc3f7db0aa4ac217ce10f7cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
20KB

MD5
b701fd5ce841ce90ff569c641bf0cbfd

SHA1
923ef9dff528ad65b6f135828aa39340be591a9c

SHA256
26ac894bd46903e9b8d08bf85cf4c7795e88f7c9dd85717b7560e16acc007fe3

SHA512
67d8cbd5ca9334aa5c784bb73b2057d28e2a3687341cd62358b5c5211ba833e10909dada2069b49b0ef328c1a40d8e02b58d27385e3d944eacde240a4bcf2fde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
37KB

MD5
d34875fe1c47517f4081a1e2c5bc91f9

SHA1
204fed3cda5eea26388e139dd1600682e7665cf6

SHA256
aff6fc26fb0c69a279bdf9b32b4d2560cd47039470cca8248534daf8d0876186

SHA512
aa164260951708910e1cc3d83c17f2d176427dcbe53e1e13cb539d65317a1750bd1e482850049e9c126aa5e70fbdd72db13d50367b90c8b8b37f01a264ecb148

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

Filesize
24KB

MD5
4b3e8a18f156298bce6eda1280ff618d

SHA1
c929ff9c0cb0715dc5ab9fa66a469cb18106ed0e

SHA256
eb8429f5918f8dfb14c7f8b32620f3516303c812869e9e8d1059e759a1550b49

SHA512
e51a54976d11fe25486d35ba92f99b8de28222a7dca8c272dfc43d8f0bc1d34b6259797fd5a7aad9c1553c0881772875ba90e7d99f6175d16ffdd00586fe8ba3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
38KB

MD5
f6c1297fae3fc10f55d4959d9dc771ce

SHA1
2df076464b94b7b06d771f3ef68e7a1403ec3d82

SHA256
9aa5a405e664c215a315b794668de2faf252ee0bc0694596d82a1c0e91564ae3

SHA512
d0d3e4a6fda2f9abb60d05befceaec9f1dec9d5dd4a31df5eeb94f0c1c545cfdbf70b862d0340a460e6d0cc62b8df16d3ea839683fa534c67030e70a181659db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
59KB

MD5
5bead0d2b2685032fc3f12b5a4f72a21

SHA1
118ba82f13acc96cc2b28a1192947b81fbe88c2a

SHA256
b74d05151579f9564a39b1287d81d6574c90ecebfdff9106480e29bf816fb610

SHA512
653583a04218e9cacfd813458e28bf8b784cde06a74672948a5b864216ead351a00f8d62ef6e06ea8e85e43048df27d8b6b0c8432d5842c8f3ee7bbbfae325fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

Filesize
53KB

MD5
cfff8fc00d16fc868cf319409948c243

SHA1
b7e2e2a6656c77a19d9819a7d782a981d9e16d44

SHA256
51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a

SHA512
9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

Filesize
16KB

MD5
da4fb15960b623d2d1e45e712eab4e9e

SHA1
4daa448effcf03190d1a8b38b4cd377d8a1bf0b8

SHA256
04a50722e2d7f3138fb002ddfd8dab1b0bf44803960fae3dd1f336118d8940db

SHA512
05a0acdcee52bc0708da2ee4a1da468e07ae8ed525e0d4552f36fa9bd3f465d5f982e2d58f07cecfe78b0834003754f1d0adacdfac70b3b1bc2a85973e4f1ab0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

Filesize
101KB

MD5
9a861a6a772b86aaa2cc92e55adf3912

SHA1
85156e7eaf0d3bff66bd6119093610e8d9e8e5d2

SHA256
6e7cc83f3b23d5f48bafdd934321de60485eb8d9ced04c6299e07dc6bcbc0d1b

SHA512
b0a051e2e703227a55674fe235a97643ab1478af2384a5a974605cdd0e4ed79916d65e2adf61d19f59779da920699e74ac72cce05ec078f22f9b6678c5022a26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

Filesize
88KB

MD5
76d82c7d8c864c474936304e74ce3f4c

SHA1
8447bf273d15b973b48937326a90c60baa2903bf

SHA256
3329378951655530764aaa1f820b0db86aa0f00834fd7f51a48ad752610d60c8

SHA512
a0fc55af7f35ad5f8ac24cea6b9688698909a2e1345460d35e7133142a918d9925fc260e08d0015ec6fa7721fbeae90a4457caa97d6ce01b4ff46109f4cd5a46

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
19KB

MD5
1e53408e78feddaa3dea2f0014d5dead

SHA1
3dbd20f4511465b8b18e4681ea24f9e0140307cf

SHA256
deb39cbf92259253ae2c5627f31489104612379e8d781a7b2bce775682c2d833

SHA512
601a7dd43d4e43ad479b4241d02652c5523b2bd900118bb2cfd579bfa451e96a6328723c61146ebc113e79c03bf718464504d43502836250fd6b3752e13d6467

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025

Filesize
64KB

MD5
e50645c3c977f149ac014e54424952be

SHA1
5188e4afdba73553b58e0f416ad6032e583f8dea

SHA256
bf584a3b9ece53a018065e96bcfe5c3aa78f5e9042ad0f91b8db9140a7286ca9

SHA512
5aa9d8d13434bfc705dbee405e22d8cbfce3feb5f6607b7f72fdd95b20745ba0a93649249a3625c38d31992ff8af167568915629f053fd8e6a8c2c0f419269df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026

Filesize
108KB

MD5
0f9a3513f312ca2a023bec8075e27771

SHA1
aa56ea41e99b17e63b03c6643e5b1df4dcb24b7d

SHA256
2eefdf257186bf4fdf9777404e34f5f1e2f731e12afcfd1a4355418b7027355e

SHA512
8ade920afcc9e5585b0263f90992765bc548b000633c5bc7962579f00e5e7c6759f32b348372c1bac671b1d5d50e67b3164e4e229517eefd2a6093f92ddceef5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027

Filesize
94KB

MD5
c541b8524cae22cf32c3ebcfa7dc6337

SHA1
8248b51e2b0d4793fdd24a4cbb637530c6635fb0

SHA256
a1a4bdb4a849fbaf9b3f123d9f9d2ab825659359074fbff92ae149af2d879ede

SHA512
79893ca0a5faca4394eecd9dc37de4901f5207f1dce7b65157b26a63d8c4dd349ba0589a5c8659a2ec91f73cd90bb59b07573028958cfd76d62035788d2f4af6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

Filesize
22KB

MD5
86c46c29d1801ab8914de2a036d00773

SHA1
33424ab1bf44080c4671275e4a65a5f182d79a37

SHA256
29bba4b630c68ea3718faa7fb87fd77fe0e5764e5366b19db4d6762ecac341aa

SHA512
e6d7527fcac9b3505d6c4337f2430c91c6265ae27db81452ea32e2ad0352302d969d822b7f27c896775b101ca0688c9973e2225028fb3a1482f4bb6170f1997c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a

Filesize
41KB

MD5
e319c7af7370ac080fbc66374603ed3a

SHA1
4f0cd3c48c2e82a167384d967c210bdacc6904f9

SHA256
5ad4c276af3ac5349ee9280f8a8144a30d33217542e065864c8b424a08365132

SHA512
4681a68a428e15d09010e2b2edba61e22808da1b77856f3ff842ebd022a1b801dfbb7cbb2eb8c1b6c39ae397d20892a3b7af054650f2899d0d16fc12d3d1a011

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3545a9e694a7a24c_0

Filesize
289B

MD5
600790c9e2e29ee6f3dd571938b40463

SHA1
a5fc8a73a668dca5a8c9acd71d01239ef12256d0

SHA256
f7f4883430abfb3c3c6af1e640c23582b2b4a12170ea5370ab20dd9ea97521c7

SHA512
b7ddd6924a6a9282c1df822fd10c89ca1c86fffac42abec13ee7709cd4ae73729ebe78c1a45c715f6226d52d9ac0d8330116c4fa6605f00ad4f665a44cd6c899

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\cb4dad437ee85da0_0

Filesize
383KB

MD5
a585ee98c2b24fdca9dd631c23f856f9

SHA1
2a3be9a4072586db26703eb15344e9f431ffa6cf

SHA256
e0fca6706cfd150f6fe4e60fdbda1872ac12b0aadee6a088097d82fd106d3112

SHA512
5c120ae6f9523284ed61c89792fea5673f9d10a67d20b86be8a1010b01d56b139dce19c63105f16c54d8a8c08bb92345b17ced3fecc54c4134c7feaa27a75459

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
20aa73e1870c5e0c6608070ab8459f2e

SHA1
ee41bff3a92541c65542b9f8ba4b364e11f0da9e

SHA256
cc355cda851a28af6215c54f9e1c947d88aa222316a88ee3794e7af6d2d1ba4e

SHA512
3d874f2645cf73b98896cce92098f4d513b77b1157f7fead3e44e731ee5b2cce02f02178a3569f7a11bd9f05ca80b655e5d6a4deeb46c8ce40ba249e3cb7cc1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
84648c26e17a6824e1d1e38a5ef51bcb

SHA1
19ba7605c56b2e03e4f54350252ea8636217ec1f

SHA256
ef64c2de01494e62cdfd38e7d1dad690b5771a1ea9dde34e2ca86ddc0c788154

SHA512
63e8b0f9dc8c3b6320908e3bc8980aeca78093b9982aa65f8f4d772c09de35a0652cc912bc8dd0c409110f66212099605fb4b7e00a27bb4a8fca934e87cdc08f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ee4250b5f883fc466b70005903af36fc

SHA1
6f87a2028a41958ff669bedce8526dda393dcbf2

SHA256
1014f992d49f4a0c113a76b9360444727b8af0260699936c051d871595ff3184

SHA512
7a34d1c7741648cb478a6083c93476a9cc891560b7ce08747c7983ea11521b17c6f7268c8c2c49995f3296f58284d0c99de3d7996cdd2bceb1b3cd1fdf9f94c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b02a0c698af2a57200d7dad535b09540

SHA1
0faaa24f4c1b98d6b00f26053921af3866aa7765

SHA256
d6740dd48a99c73bd443ac5c32b98e9171bb96356886bbdc0ef03deae03c9aa1

SHA512
05e39e0fc5fd1ebcfed26f56700c4b1c967dad0228153e6c5e2489af8bb00a2387dfaffbe2a44826534fb03ac9100d0ba0907c4c30263ee8255a6d1e12702ede

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
aa7bc347fbc5c7ee2493a749e3236cc0

SHA1
018899b6453b067b795bb9f766e02b33460929aa

SHA256
2f2c26470dd383e2f038cce2823bdd1c94efdd1f24a879b2d53be5d2056f0feb

SHA512
35ba6e3a5668ab664a96ad43b4143a80d65e8544fdf91e925335e79fcd862b9bd1c56396406315f65786e05587eb72f365c6b11be65b4ffb4fdbd173587ff90e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
691f28bfe1c49f79eb103077835ded32

SHA1
631531d41188e8123622aa1d4cd9071732d4d0d6

SHA256
6ae1321911c542482b3ff908d953137e8040634403df4947d46e4b91ae760b76

SHA512
53e85c70b1d6f28b06bca8abdbcc42ec0bb34adfe348ca685e8508e0a5b66232901eb03909af261cf4a3b3acf4a7dc047483dcbe7bb7b7b67eabc477bdf523b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
9617c278d2ca9a7a32dd259f4c02c570

SHA1
8a14bae1bfc1d9e4839fda12c57d1a20ff3d03bb

SHA256
94107b8edbb7d00a3ba201855edab1aefd6342df49052ec67586d8ec4565d0fc

SHA512
7d5d707b6a26efcb707aa4bc122ca1067df05a96a60353d036ffa19f5118a7608fc3bbdde23e0a87a4c5ee38366f71babffb29ada595bff845a6011f598edfa6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
6a7cc6528b1bd4165991cadf6aee1e4e

SHA1
8c3c6e46e45444ff0f9f0bfb9cd0494ddc13a2e4

SHA256
bf11b9e4a21faab73f61720c4f494a5316cbe7be1ee7f3cf9c93c16999341c69

SHA512
2424fd90469bf6c6c8e543c59ffe7218f7c0b721352becb6fb037c2f409f21e6669cb494f20ff4227afbafbfd659ba8af3b7c81cd72626e21a32d14860b625e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
7e76877a53f717074a7fb547d33cb621

SHA1
3087ab9351b32995db3c5201c8b6844f007ab893

SHA256
8ea3cf4dcd78e1b68b1c90aae5552e53b25027eca46fa248e2f7e2c7dd34dee7

SHA512
2ca9f8e3afc7d8f0cd258890c8374e6675db60f6741cd27e3b61bdf479dd07d717285d4d5622b672b814f9a9f01eaef2a146569ab39e9e982aac0d5fa5e35bc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
32cf3ea3a993ed84759d497d7fe04c33

SHA1
2b1c2794aa16f2f88a4698103bea46f4900c04e4

SHA256
f336883da34e9ebd5003d69e8fb7f01a3e098acb48db99a011b34d7451edda64

SHA512
7185bd1d122c697087c76a834b7ca714bb9e0ec5cfe2c6e29f2b50cb36cec82d152b9910b37c23132c9b38814cd5816a3eb3edab504adff80f71c10326c41644

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
adea3c348b2b079dea4e423a37e7decf

SHA1
5fc98d7506ad04892eeb5de096e7a05872fc7689

SHA256
89bcfad21d1408a133116e8ebe4dea8b4cf8629be8a7e6fcbdf1bd074216c54d

SHA512
72085c586fb736398335e3a676fe728b05ff8ebb61d9888edcbba7c128d7dec8408558e46499acfcb7183e0bae4364dfd8265c329d55c0e33e6801211b69af48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c73c7f2e3c857cfd278380565a32f59d

SHA1
007850989f20a3d549bcf84bb4bd81b9a1a4e52b

SHA256
e6ea423dff7e5a85bd4331c7a33c35ddf4d5a3bbf1e41e5490ee2f06f932de7a

SHA512
2404c3abd9fc6d395784a8cfa6a628d74c4bebac6bb35e9c48975b39b6b1b49fe2e54e7ddfb29281a01eb0f0da0a1af77fcae5551c93157b76a44cfc17e0ae73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7ea65064bb2cac9586a058308eb67701

SHA1
cefa9c48ca6d6a8340312738c50f302f66eb0879

SHA256
c84c408ba1f9682095f4096ad1c4d0a9b2eeee5209533326f946ea7ae2816170

SHA512
5eae69776725e0ffdd17eafe6e27cb3be8f024a6dd3d961be4334da8c1ba5a6ffc08662b937eb676acedacac78f417edf5ec0677f1cdc0741b004fbe8c3e502d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
808b95c5cf1dd0de0d88ee90d9d3e2aa

SHA1
81f27af9c9db11599004db1c24f8438a1fce76d8

SHA256
863c7c7e61a1ee6f2e0fdaf917ed6b31d0ff390bcd8a1d13ef83831b7f55e0ad

SHA512
f4b5a5ab4d901b25b14bacf5c13848e00c08331f38a97aebe57eae66d5226928ac564c658520e565bf8bd5fffab56252853775f7e2c1334306f48d5ee0e49e75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
03c276f3415fab005f420b53c4c8013c

SHA1
4a78f9cafbfc7775a4cf2e9ab4784d4650cc1b2b

SHA256
d274600dc55dff0e78dfd4271a3cf8a246ea93fc52fb28f5e94fc52cc15e4441

SHA512
f8647d9f6579095981b941072ec8001d95b3ec76e7f7b3a0fc05175d03b378be74658208941bb033f00f680625a9c4e35a377908f2e11a53e8a53ca62d36e417

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ad113b2030786e2c7e3a084475aeedb4

SHA1
df8adf4e0a718448a3ab32c0d96d3ed555d8a806

SHA256
1e4afcf787ed7ce7f271725493db5097581ae7e135952d6f247ce502babac4a0

SHA512
e5df4e92798da98f5e4634870d087f5e280c038b80d6728dfa5787edff1533c6fc9e53f6a42200c8bbae9694a36c2122737dc053bc44056021a5dd03585eb233

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c0a95d3817d79c882dc63a4a3c8132ca

SHA1
a8b69260b91df75023fa8dbd284620f9d0e23709

SHA256
dc34ef6b911cb06dea6783283960cf33e82597210b9163754281eab8da0aebe9

SHA512
565f5abc94615bc8131369d7aa62d8e94b32c8fb2a30e50cfe064d5881ee39d4c1dfac0fe0878776509d44cb08db34b28db5dfa94d5f04ebfc828b55b9e9084d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
bedfccaf23cc60d0940105ffa560f2ce

SHA1
675573815ed5ce3878e9d49edb508c198b850598

SHA256
42dfcedbbefa4c6a6a8363cc0b5a6ed7e1b600475c04850951c5ba37f4ff92d0

SHA512
4c6b87ae984f381b31219b481cd8dd4ed4f6068ddfb07906d343e43d454780e844a0bc76c8a876dda6f18c844e11e8dead98fd1814073705e5417847a70afedb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6e609137f014a2d4dc93550bd8fed5bf

SHA1
f171582f3ac1acb4a0cb69699d7bd5f0754ed5cf

SHA256
6db8a22edf3d4234192e7a5c1ae7b340d5cbe2aa9cc08ff20569eb40325dcf0d

SHA512
de6a7ce0114cf0b4f07468fa1e2c1b68de9ec0bcccde0de04be80881152335fba1c10fb71c459419013afc72af1b734a8ba7d2d933466101045c7804c95c862b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c6f4fb9aa6d40915fb9bdd0aa50348df

SHA1
f6f590f32aa27af5157f5fc2f866c3ebcdf8210b

SHA256
01ddf5e4b1cd206b266cd182855b60bfa13a56ae13496651b764b8865629a45a

SHA512
16035968455a17365197c9abdf9ba1b5c5c4220e1471167272958365092d6f73ec9d9d6824fffd12a394047cb5f83810672201188703609031a16cf43d0bc967

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ea39a7ab20583149d460a599a7ffbff1

SHA1
0225c6e0afd6a1ffb5fa09b1f2347034eb84e13b

SHA256
a05a009fbc76096de7f0d43669709f31f8451f7f305737b8e03c7380a935dbf7

SHA512
3ef0d4290f94b1a08861a935bac73d490bf3c7c837bf22993bc1a28284059eaa0124d321931eba8eee343c95db9acd5e0baa12ce90c37ae1d0b1ae3e92803fe8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
197e6762d734cec93fffff888a7f7a29

SHA1
0611356680275b0eb561b0c046729b2434932025

SHA256
83f1abce19e01005e7671a4f784844e8c9b2f1b4b76734474c0d3a9dc7787483

SHA512
5b6c3119608d608adc7abe793fbef3555cbc2555b0b68a669b0cd706a5da4a9102d54a7b9547b3f8585fb053f34edc08f30f905f7fd98828ddbf31b136e1a8d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5980e4aa91ee5c2b62776c7d64a4e2e6

SHA1
42f87405b3840ee9a7083126e41135dfcaba240c

SHA256
809696406f41ac44e21ccb410ca49ed9abcab51cb96720c8e619763e5f365208

SHA512
6d499016cfac48bb4a5c69ba24d4749f0768d90081c4e8a7e79af226998dd8a46354ff5e2b2ef528796f193fe23d79030062dffbd4c06670d59af330ef611061

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ae130f45d0137691ed408fec2bf4a62a

SHA1
25a356c48323c59af0aa5197f33e4502a532a3e0

SHA256
a20a0767051d7f239800186b32129680f258f25913f6a6cb87af0626977077cb

SHA512
076b52572ef3b529e5fda2ebbd164d5aec3bf352501dc9dbfc265af0ea4e980678ecf5efe88c2d730e022988cffd9c81064728aff9086da087e0cf65d4a88d93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b387b37193a32620ff7916068ba4c9d6

SHA1
dc7427e70dd54581438b3a2d859d6089161241e2

SHA256
9d3670d5f08b19e5a916e26bddebebcc7cda43ee258354919d93c39e6a704e81

SHA512
78d12c110503603c2186771920530aa6a732ea6daeb6cb899350f7134f46341e34f804aad4316e5f4efb591986283d20d6a6600dde7681611fc3df9ebb93599f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3e9589682bdef452bb34fd2558d8a6d9

SHA1
a9fc5b9878facd415954bd765851375b5bc7891a

SHA256
6b276b34b90fa51a31effd7cfebda749f4ff76ea85e85f911b1ded52eeabd551

SHA512
c60789ad745fdecd83ff1595e69292956627f95eaa74d3e1b4ec8b5130452d1a48d6585d88429987141065c4596be9a34a874b96be9a81984c3106da367b7617

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a9832b719e356a6b50e3b983e822c00a

SHA1
60eb66023d782bdc0a3b7e233129d0dc1359c58a

SHA256
5f2ccd21dc7e30141a89e94a6a70f213c1fabfb43d3d122d7bbf0af236298bef

SHA512
a4d385726ae0adaefeb4de8cd814432d085ee2c48343339a204cac05352cb44440f8012fa7a6112db6eb8b5d9a3032b2c49980f50ea72e6fa7a187762742bd07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1a3ffd1c38537db62ec331b9bc808e78

SHA1
7468ba1bf6f83bb570d7aff4624a1ff7b185cbf2

SHA256
3bea5f9db2a7382833da63f24fe4dcccc7793c84479e023e44ea90c69e11861b

SHA512
c6a51f6d1409987988f484e6ecaadf6551904a7efbbd3a341e42fd9f76293f7a66f17d1a53a62c237b11565c62970cf694f936b0211d0cba7f0f7fb8568ce11f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8a22dbf57b1858ebd9f393cf295e8035

SHA1
e64d4164b4dcc6ac8a6d6b55e05b0e8b167f83f2

SHA256
3e904a53885809e5394643d1ce9eb405447b219fe5aff5e0b745a8866bcf4f9e

SHA512
637ba83640e4ad47f3675e09e4608d6362d1e45cb6ca4977521478a20c89f7baab236b30379373aec2a16a9f541e13a7647792d1637369ca600dabe352ca9cd4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c17404f8babd4b213ecc1a9a3067529a

SHA1
56e3ddc2df7c560da2f171fe8f07b7c76935c96e

SHA256
ca2b893edaacdfbef8709305503f4a1021d859c2d7e1a52d4430768663083d13

SHA512
39313c9addfaca39f0987f30baa9c213e7ca58bfcc33500c812d89604e456ccf6c9a31548e5b8659de7d44c6276978addcdf3c3eaa0db1fb95f1442fdfa4ab71

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9851ab09288f38115f13b3180bd3cc0d

SHA1
c8e2c4213f2cbbbd23a1ba9c9e0aaef610343171

SHA256
2173a1934d5da6c6b9abd25e1a3e5518e8d8cead700a4f2a61147d22a893076e

SHA512
fe8e3e9c7d5475afed22049cb99ad382e641194048cfb5f39e57bc526cd8281be362fb5cb638b624badfd3c057da2ee78d20c8e59946fe56d673c7b79617c812

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e05fae7d351f73e3b7e0a52403b043e8

SHA1
f04fd13912ac39d898fad15144608d13924b89e7

SHA256
de5714edd5b42827388613853a1f16eddb58dce62dc3fdfe08fa98f0cedf6cef

SHA512
de33148ea32174999cf95f9887149dde44ef0e1b01cf752b44da72a56e432389dd342f30dbd4c9d00371e11c13bd0a94e88e64773824f093933c4544553ba489

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0cd6f24e93a441defc171eb5266e0b9b

SHA1
b61624364ee8ad48f1e4d27f3920a39c13901500

SHA256
a3bcb721d490baf525b9b8fb4d1e63991f7201ec057a44fb4f8c9a3cc3b0bd94

SHA512
b0148560aad6de54e0de91e7f93f293e92995dd5f8e266af0758ae1279b01cb5418eb4396e2d1dadd6f8c038d5191e272fac6676600b517a1febfd34ff7e91f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
673afffff454768abc432fc9d447c4db

SHA1
eca8950977951ba2b37b04a8851adea8684a159a

SHA256
b22d350ea2966692ff88a3b0a28d244a86bd591900b232937ee84580fd1299c4

SHA512
9925173d2991e9c37af14943a28a5d09526a33b21e634022db5cc82aa09560c4ff447366b69ae8896979d6cf9722610b0a959a9509b107ad3805e1161d90cef3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
468a2ba4519c21bcf66742f07e5b9e48

SHA1
5353669d16fe063fa8ad16e9cc7b54ca6f01a5b6

SHA256
5df29c314ca5997b3e4b4d96c3362c2017d904de0d2730450d2fbcfbdc0030d0

SHA512
dbab1572016d2704f5bb7727e33098b3c3517772599967a42843a05acde6a41d27122f7b2cefd3b7e40fce7d08205d1b2001b206b481b69f54da8585873a859a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0fc6de9bb8b1abf687521512c24238a2

SHA1
ef9f874bdd241515003aded52c0d15c06ce647dc

SHA256
f95868ed2cbee1df692a4c733ffa5f7b1f2fae743a9341d4db2d00c212790373

SHA512
0c3c6147eac14ff0fc4c9140f44558215d67b4101355a5ca33b5b5c82cb8df2597ffe4cd7e6f1fa02b36ac0b50c099f25aa81f73af4c9ad6425aabfd1cadb2f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8e0d746e3d80d1efafcad66a648c9e69

SHA1
15096258b015be8ff41669da46d06e7d128869e5

SHA256
4bcc25256cc6c5499339ddf9ac4da7b06d54c0ff113a3ccd44a7244279004e5b

SHA512
68feaf2a89e13a031ba8cce642947d8503449b1afcd43967c87264bbb90332a4c35c6c9946a4b2d6c0ce6788f235547ea27fa71cf0a36a4f9cd98bca3faec12e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d503e2e86a0daaff87970ff259a54849

SHA1
8419d4cf5313b9e2a09a29c558ac7a8c01149bcd

SHA256
396ffb952047f486c1f079921065553305950a8d49f6b8b10e7e6989acb8eb51

SHA512
806d6ead02c7541f4438efaa56845e4b457b28bcb436e321f719c4cf33a64442ef24ce7fbcbe64abbbbf1562cd8980dafae74d71b4e651d395befaadd37a8ee9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
997c1267321928b028c19d840c8171ea

SHA1
5a99714005ba0d163c9df8933cfc310e32efad39

SHA256
1e195da33bc243b809769de052f6adbac60fed2975b04de9fd1379ab135c3726

SHA512
69738e4b406cb97f55ddad9511eb6794bdedc8c926ba961aea48fa09abaed03373342139d5681c0485a9c884be383ff957de787c056b90192724a882bf1e5d5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c6259d0361fe1e94d67c8981479dea4b

SHA1
aa1254cf3680b62704e83ceab1d238276eb73af2

SHA256
7360d8c07f140ae9ab88e725d6f52ef565a1eddaee037ccf0aa60012942dfdee

SHA512
61d53a76684a7078f52f1527b8587c3da35f6f1555eb7373d1f80e6fd93b32b4854a9114cecb775ad9eb9593a73ec690de89143c2b26f37779cdbf090289a15d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4551196dc9d8aa39b7235c2999cd5b20

SHA1
b8446f646a210c303273dd6ae585c91e3f3099e5

SHA256
0bbbb917c621ac31f3171d18636d1cbd7ccd6019c529b7660cdad6e3c56783f9

SHA512
daca162da57f09023437e3775557775bbaa47d19e46682cb45db1359eede90a7ea002616590b58aeb1e1900a8a02ea41734395ad26fa97a2e53de60e8a03601e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
579cf4ae67e4df9f061314783dda75d6

SHA1
c2f860a339a638e2b2ed0aaf9895de86674ae78e

SHA256
cb9d3aad9e1979c2bce947ef0ec4adbac724044df298c3287ff82c9e867855cb

SHA512
4a57c22402932bfe8df0da8159cb6043efa175eef5832f519e4087e70fee0b7c7a8219e42715126dc4511f5103b4de044b3a0edd4dc5062fdc1bbcf281d10812

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1b71a1fcaf5abd7c7a2c6683640fd402

SHA1
410b6bd24d3875dba4be1c14d80bae92466163d0

SHA256
e613353b56f098a65ce6426c088fd295833008a39e9c8694fb610bc31ab427f7

SHA512
cb78f4132db4a31b3a8fb67268d3f58a71e6ee01b35581bc3c5d4b3c9e26ea4cb3c59f14b68a9a1be074b41f84dd5e0619c99319ebd7f9d4a2fc62ae339b16b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c4a8aa2ceffea80192a3e82f02b97cbc

SHA1
adddf6f8064be6dcbe689b8752b2be1765858928

SHA256
499f2a2a3cad179d4af79e2b8403c50133c0b115a4f620c1089aafbd0e699bfb

SHA512
7629fd54c9b5f3ffe8f3c81ed5924b6762dbc5de6a7f129fea6e607cd503145ffca19b811e2127792a4b0b876bf01e02e90d847e53af139972d0165c281fe41c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1ace9567820fbbb24a06b015782102de

SHA1
a45abb92ef16f4055ead60c4f6c5acc8765eed13

SHA256
fccebc6d61850df0d88ea387400a93ddba8822342afe62789d0e77f53b7add7c

SHA512
f448ccf987b64d78e634c212511f887b2a7343d6d761cd1b03d8c1b182730574f2c1193ecee6765dc7a3ed1b2a8a6d9ff7cb308ae6a0bcf4bb17b7f66c449eb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
152fe5e25bb1152a9888723917ef25ac

SHA1
d0c272d0d00e843a99c1f11c7a87325b58343b57

SHA256
3268c401317025d39ff3506931932ee135b5c58c240d225fac475ad8acb2c593

SHA512
fa5519bda1d264cee8d602de8ed70449b3b9e989d3a7426593d33006271811f8676cb62966207b4c6b0b96fd93dc2f359cd07373697e31480284613c8e5c2dd3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
fb4a724fb8ef8a1204457ed1379028d4

SHA1
4e3461f5bbadbb345e4c20f90022e0b4dd5959f3

SHA256
de17d548ed2e69cd2dde8af79fdca0cdfd942f787166a60445da06204c751627

SHA512
9dcfbf46d60f161e5015718bf947f39557c40e3a9852504485a0e93151ecea4029b387f2c7c252dc65e1fbd0895eeaf21b530ba74d2fca4ec220df6b1f66449e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b43f21a6ba24078255c675c9cdc46923

SHA1
3f02a91594323fa4177d608013efd18d3ec66806

SHA256
56fbb8ec03efbc0103a24ddcb33546179f0424dcef90280975ae0d02a1740808

SHA512
d052efe923e2e30b3de12dd2a46afe6688d60f73af89d1c6f40e53e5ae141cad08d776da42ece99050817a21ad2ba3745f93bba8a9f1e56cf6b9dc30bd395b5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f6d55abbca9dfcb2fb33ab76e1a6326f

SHA1
adbcf381b97d1c9bee8cf66d8822ccf64569e795

SHA256
815280ec812eecda19595b63ac3ef16b56bf72eb745eb6773cb21fca97dafd54

SHA512
8051621ad489ec4edd1664b7db2c7e6225196dd43011f0888e4ab40aec81f44e9d62ab4297852cf7fa29a3c587cedb5410360ac457b3584604e187060f741caa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f3a23d51c868dea355bae66385ffb56c

SHA1
33b9237a3e8ec558d470c7e7e6f7a51a9d3aa25d

SHA256
70c47e80066ed3521eba5bd66d785606fb189a3dab81a11aa01d8539c30e5412

SHA512
9189ca6a32c2f89b4cbbe251fab61ebd99a81aff5a7a4f5b3cd4b719dcfc4778fa6024d566421ea519d36806ce88a7a2a89feba145f68cdb60e6901086fea55c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
365102c7e8002eca7dba604136cd6fce

SHA1
282aca22c1d3b9d31d85e7775f16f331672e7b14

SHA256
94cc5d9b080450ee9f29789bd366270878a5e8b580aa7bb40d2a87ee9d72fd8b

SHA512
57f8d2d44d91b456769ee41a1168c2e7af5d5c13e2bc8f7f4f36423aef09e2243874b398d5a27ce180636be885df6c4e0dbc647530b5005740270982db92465f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e9d00b130e01c2d1a4f7ee6bc59bdf2d

SHA1
ed69b8c874675c6219adc03c523c3a493987eb44

SHA256
37ca318a0d1577f633a9480d281d42a044020b58f9719a53c2e8e23397889a34

SHA512
5f829decf08474c5f3c9d7cff9b88cc77a57eb857636caede518cd09eb01d77baef6e63b8732361b8df444ec164abc91610828d76063bc69ae86df2d47188c8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8da3311316a83eedb17cf858e741f589

SHA1
3e25fd3388511e45b5027ecceba1f9b9c09446a0

SHA256
970fbbf623f5849b519f16f62eabe419c5843cc99693a48179ef0f04887d74cc

SHA512
496ea8da27df841df4a1d04597ee762cafc94e4a507b39ed74f8847f9115e6a33dc99f0dc8216f168152d13d8bc8ca8ba022eb707f893fd1d1e50c8562b6cdd8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
9ff975062e8cc5c36a648079c92a35cf

SHA1
822cea932cd1d0ec097afd0973d75e2e9d8f226d

SHA256
a98643e9b685a597051b07f2a36188f11404296a37e59ce329b6680c7f8f1b96

SHA512
50304fd4ecf8b3a2558ba9ea53721df3673c642f4618209207ddfc4c624595adbcda6d0be3a2b70206d89b79233862d31e5e3171b9a61f15e6d9b392107c1227

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a10b5a41ffcf0dc46f09e5d78310ef85

SHA1
070b9424814cd7830211c60614e24a79449be600

SHA256
bf557026235f1e2b155f4a0d1627f8c21d23c44169df55d0dd2fb7595b9dc85b

SHA512
10711f435326fe87895f2669df84a453e501306bb0726160b0a9ad68221bd967b9f5742e3a3cfde777a18100c76d216079ef6cf42a26657d725af148714d8936

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c8283e506d21d263fd92fbed1886e3f9

SHA1
8f7dbe2f9cfe70928746b1dcaae604a883031e2d

SHA256
58dc3409185fd4efee04bc4dd4ea4e3b62ee0a3eb065e40018de9150741720ad

SHA512
d9f98288e697b5ebad0cd30329a723f14d1cb61cac4fb34834446658a5f4bcb34c5c53bbc512993a07750e9c68aef3455d931468c8dca87bf785b645a7c7a952

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
33653a22a2d1d98b0651d67f2bdb4c80

SHA1
92ad4ef00dc25beab239627a779520a25a1c8a28

SHA256
a787faea3ba0f112236d9b5c5af07e8f8be5cb5aa10cf58af8f3752b2a498831

SHA512
6fd325f82b2040c58c0fe5353d431c57351d14af97e46a5439b231a55b7883805949b2d1d25105befa9475699b3cbdc571ab58a322aa8036ada070b6ecdf8f9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e771195ce3a0eba2e17f088dae334941

SHA1
84dae5d63cd10a18aff03827c62dbd8cbd72365d

SHA256
2b9500f8a0f31e7e4c287e2923d92ae17e68e6c6803f2c2cf901c1f38b49bc89

SHA512
5fb0f7c3982ab2c28b36781d5cd5cb96d6d5fea461d824bd0d6e35e73127edd7278679f30144a682e4ca171ceb56cadfbb5ce42e3e086c1bc3d66d96d06ce202

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c06b67967d4ce4a19462d41ce52e90f3

SHA1
c25a278bd6af09a71e7d896e277f442ac6f25f80

SHA256
64747691d20fc3b7b6a291c0294887b412b3b430d06d26f6ae2c5b3d48505b5e

SHA512
31e70f8ff596caf686c2f12a7239a3d7929255741e647d147646654afc3382c400981bb5504aef320aae9eb9ce3d343b6ed6053d55ff82c0596688622268cee6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a756981edd074d07f00fcd701e32a0f9

SHA1
d07483cb9d2f79c75b9be58fad153b2803e2d8be

SHA256
7f60dcabccd317c82bbf6b1c2b0a803ff99166929f1cbdbfd4e4e65489a3d7b5

SHA512
a696057083011d5eee317cb2cab681d9fba07ec80392aac2ced842d0f271a23fde58c42650cefd4dc6926e321ccf3814d43b028bf010c5bfbe378eea57e63176

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b9bc8e79df50d1f728dc82a9ce58e3e2

SHA1
8664211f820fe400f86f92ca1405d2cdc120bf9f

SHA256
3b87c44b6355ca44af51121849e8493141b68e16e1d086dc2b60377c4d8bcb5c

SHA512
8b2e7023880e462b8f7cf87bc9f1e8e44be628bec0807ad8a63bd227a9721b319f06ebefcd19bfc486371a07e00e4709027290f1902fda29336dc4c02873a1eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
468b2752240a44b839c1d3f605ddd63e

SHA1
07e2306a7e1d31c0c0a1137d13311eb4f3964527

SHA256
4a44ebdec6651499591688617212c25d39de0b424a8f3876f96ea442ab96fe93

SHA512
4ad36398cc8bbc8f77f0d63135be7873e6bb72a1e12c3835816ae10df8a2b4c0816ef2a3f11931317ca4f4aabade86c13cf2b61ffe74b2316d45edc4325b9753

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8d38231a11002fec5efa8e2cd998a6bb

SHA1
7aff84b5d374732cc97831e8c7a8c4ee1fd88c0d

SHA256
b750d251cf385e508d82be3b03bdc2654547a3e118f3bba31f4eaa17651de3b3

SHA512
512e60d28855b782833eba65e6ba0f9e6eeeac676fb8f970e1b153349d3444ebaaec8e4cddaaf64a7efbf02bc7a18a6d616d06e0f38c8be93e1275e0c0b642ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
61baa7d16aa6f5872e8d39d406682ad3

SHA1
61e37260b6e6eaea2a7a4fc88b565d89a98888ac

SHA256
6aa1fc9a94734040b8fe4d681d79c7690867ede1fdcd5b8a5eccd73974764ebc

SHA512
893c512ac047e85be9bb36d1a68e28a0788377179495c8733e7c2b8101b38ab026da49b09fb26ad1990464a4dcf831bbdf29abc482f64d626a9fe0b67c99b0ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c20fd5bceb343afaefcab30c0901cb6f

SHA1
840b0b6ca5ce75d5839aa5d24fe3a5736402a2da

SHA256
cbc9a174b655dc008173b3382effa24d7c4ffa96dec5c66efadf2e7df9da7fce

SHA512
cd0c4cad2764dd0cb3deb437e968e3a97aa215f35df4a8c282e16525472954d00287536d4faa3a221c55fac7b24c44ff8f22c6a39811cb728e5361790dac752e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
91b7ab1955323e2a716495aa2d8f911f

SHA1
95415fc9940fe4b75066d2d12cc9ea117c7c2043

SHA256
4d58e9425431f1d3a858e3ee372533bad428004b4618c354adaa102d622b5578

SHA512
be9952afe4dc786be91f56400f72d2d847c4363d53702acae18efcd541b322320c7bdaec3639b3afb26b34a5ec451e933c8ce50218763f7181fc7df5d4f3e89b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
aecf70edc334318d8016f85ceef15904

SHA1
8aad9df61eb7a7d8e88cedca87bf9156cb8b5353

SHA256
b7cbd26f11612bb4251d0651e0e0502a95e7c19ed3c000e7f48e2ad5cb91007c

SHA512
3ad5dc5e51c1fe5fcdd662903a7ce6aca2d9c987c3c38c3e66ac867230c59a171d805e68fdc5750e1dbef4cc33ff350887c4776d3387b804b8d7132c1fa59f97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5d45f44787ef22025ef243beb8a495d3

SHA1
79c94f70c2bca128953ab7738f96d99d11ba873a

SHA256
50c1d8adbf08725275a8e90692c11689a3308e6986571ac00de743743a7b14c2

SHA512
b7ddbb686fa96d1a2e69be72832df86b32c9b7bcc4bc920b7648387317efde3a747ce428264295caa2462e9e75cef6c2027a05d56c7fef325abc92e7cc9b198e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c3002a252f3ecbe7e88d3d2d51385d9b

SHA1
14d9f7c1fbda190bfd9ca3e4f972785146b6d570

SHA256
89006af9d714a52d06c7860e92567b326ce228b33702f1b50f39512f66e0ce48

SHA512
4da20ebdb5deb21f860817f3f55ff427cb44bd494b1228791339bd64ab0505bd470e8343d9b97c7636732a1ab4910b48bf0d5fd3aa1663877bf354e5417a702d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
1615372a3ecc728f5ce325848f6f6f85

SHA1
59808d84f62c452513be2d7ef223e2b917f5c4b8

SHA256
baab2a850c6d9a429d87f532056600f26bd07e1501470be6e756ef14a125ea8d

SHA512
50a655e28cd3d292d0d5643db1051e37bf11b2e0a9d91375eb3fc1686160f507dd1e9866598ebaebf724ad941da74f1693ec0a51861294da354161963f13ee94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6d9aa7e41184943107c2708d13324d16

SHA1
d0d9e01c4073c93beeae22ce204dc2a68e7c0f19

SHA256
1d773c9d6f35ef9f6906cf9e4b930e773e0ab5d1f715d5c5e0d577ca4bb6b938

SHA512
2e626daae17bbca5ce5a53b48682b77d2d6e5b558ab93bfc67d3af6615d3b5a925f1e8502520a96ca6e6d5783c0edecabcf1ec1072ae66857e698bc92c6f6e6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e1146eff9cdd820d3a0b5c1066a93e89

SHA1
25796a675f8745fae3ad2320d74d29e3badc7f08

SHA256
c69971d0649607618827c5e3da1c7e7472c0c984f6c75522080ab72def5d1576

SHA512
af5bf14bd87b2353bfe49d2ece5d649453ddf9941930ce9ef311dbbfee5cb43330a6270d537de303ce3ab831c03b6c6592acf4b44ac1fbdadc400bf8291af329

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
7a5ec5eba704b67ec0d0bf3d4efc0578

SHA1
3050c47fd53903de3fb4d3b69992d73530c5c06f

SHA256
bc57f1556b6bb6ee023b52f3758ca00d4716f012230116864d1d91bc31b4969b

SHA512
6db4ffa4b14fb9f5dce0daff7541d0bda8ab34c33393fa900f0c6b081fe6afe7f207ba651588cd69a145be1dcb887dabd30e3bfa7851016506d9f575c91e5da8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
69db7e3ec82585a880c789498a99fb0d

SHA1
f59a42bb5ddbe2e6ba1f9445005dc03fb9ae736e

SHA256
06a723079013d86ea36af3b75c471713cfd497860e4539a139d08e0a33f88ccb

SHA512
664a35ae170ec61ae53a1ab514b16c541d7278879b2733aac060caf5d34cfe5090211c4d1ff622b2d995e1e26e8da8ce5303924157ab1b65f7ab74ff4b8d6dca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
ee0f44b5fa62bccc77631580549306f2

SHA1
31ab0fa3cbbcef6e0b9b5dde74c0cd4d065f044f

SHA256
42da89d6545095e447239fdcce22bce2fd96ea43a55002dff71f9726154066dc

SHA512
92e9acd43038144803181f195c14065643889c1941058f28bc436fdc72f9ae7dc19bcf746346635c35a1b7cff084cb38a02b288630ecc15779681667867ba697

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
431c37571912f4b8e16847e9b879bf6c

SHA1
38acdb0fdfee200d0b204613ef4b45041aea4642

SHA256
8671d467a588c9b64256cdc6aa9ff8081703ef49732feda5eb958bf677a1dc79

SHA512
ea8d048d288d971ae69604e44be0c5d5d30bde4f8a3f410734a7e4294c01f6d0b1e6b9821ef0b71f3b3a814d816acead1f21d43212b9ee403a9fa40025aabcec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
687225fbf8808c52fc298c6f2abdc720

SHA1
1881c2006e51016bb249053b627a2ac4c1ca07ee

SHA256
ae7f9be43cc15257535d29e5066530e22b36fdb4a99c867ecfdc282aa1cf129b

SHA512
5da684ff1fe8bb9966b2195a04e8d3bf45cc42fa6bd4ef635dc18df0aa522a8d7da2bf45ff5fc4ef884da5c51491aadc14deef15ef9bec6e9715f8b166e5e2d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
236KB

MD5
06047bf9f32136d47c3468971b55ee4c

SHA1
b28ca5ce0808a1ca7340f23399997ec1a7dfbb7b

SHA256
7877a8c4906ff96daa29f2737525ebfa4cead5adf33ded730aa4f119ef5f584c

SHA512
8d8ae92de6802550fe4de44ed38d4c71d4a1edc14acd8db57a2c0831eff4c7eb355b68258929ec14fd859619fcd2c8ac3d9591479a6977634203fb7e6bbe6ffc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
236KB

MD5
d888743e1d67774f7e8d4855ff0e0786

SHA1
27d66eb5a4ec54e83570b871461a56bc41290f7c

SHA256
a829d5b043c2253002d0fb4caced48d1a000d909a4a63b91c8cf25a937c3a1e9

SHA512
77efed9ae2a489df5ee932ab70a5b8398ebd844554ba2248072dd755f3318a84e0ad7f81c603e37358dc284ba53bc75c33aa06fc713c6acf078f4d0b377c14f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
236KB

MD5
cacc507de876f790f323e50d6a496348

SHA1
2949601f9d25431444b06470b812f1b0991d4b4f

SHA256
c7479c2a1f517f6d50d5292523fb6777c9cd59b5a86cdaac52fa52c32d37bf79

SHA512
600c1b62c12c699cd7f62b60b585646862a17304780ba24ebf4f4c9ea5643ccf59057c6aa49de69d1faec5e4f08c36b03a65cc706816e1f3904ca0679b41e6c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\xRAT 2.exe.log

Filesize
580B

MD5
83393c2da93cee4fa46221b486aa5ec0

SHA1
c9c980e5a5d8bb91eb89f18293fe4b4716430d42

SHA256
e167dd5d5ee239573981b7917fbaa402ff593a392bc5e953ee1b8081d6e6a6b2

SHA512
8ca57830556a3ee801bf8386f34c6d485ca2f8120e0a6e586054cc8543873514d0aef110f49c5f1f5bba446b37228aa6ab9d90d74e79c1ca01ef9fabe8956fc9

Download Submit
C:\Users\Admin\Desktop\Client-built.exe

Filesize
222KB

MD5
2b0041d1889ffc5523df7827c7df83ff

SHA1
e856496eb976187636c0ba59392117f6a398920a

SHA256
27224bff6bee2a68a6cc42ae9df601da16cdcb3f60808908e5212ba79f8446b6

SHA512
a77ab1c3c3a93bf58aba4c436a9acb090f2628acbed1ffe2754d382862172fe2fda1448e9bf1c46c4d8a8344eae2869684363eb1f5c787e061c853ece9484b11

Download Submit
C:\Users\Admin\Desktop\Quasar v1.0.0.0\LICENSE

Filesize
34KB

MD5
b39ca9d3e7e80dd37db7d1985b6b74c4

SHA1
73c817f47edb1206308a44f966704557009b5629

SHA256
6b837c7a5f07d14add009cc2795823f47925a53dd59197eccb868bd520227c91

SHA512
f1e6718c9f7e9fa6931d774329c3b175b879e4e18045c24d7d6917bb55d0b359e8150e4f7a873f0eebbc6bcaadb0d0718c07bb70e768083c85bc32d87f241b8c

Download Submit
C:\Users\Admin\Desktop\Quasar v1.0.0.0\Mono.Cecil.dll

Filesize
275KB

MD5
2f1d2b580f22c8b14426cc793cafa143

SHA1
3debfcafb6d1f94f999e02f18785ea9b13978767

SHA256
c1c9504393fb9ae1e5130a70afed53f26a26f23bcbd655c3d79bc0fb846d2b2d

SHA512
807789490cbde1ec11a473525de3d953d95e3889ec112dd2f0a4fc2aae504a2afa4ed66b6f4ce6b956e3ddd392ac8289621fa42d1b4cb9818896780b42c1c03a

Download Submit
C:\Users\Admin\Desktop\Quasar v1.0.0.0\Mono.Nat.dll

Filesize
46KB

MD5
07104f5e5709661e722a76a1aa9b4ec2

SHA1
7c65c0ede3e9a7916b7a53f39f5c8bddb2971247

SHA256
cda6e89b45af038619b2cb0eff185d842e7401805c527866bc00f4286a7b0124

SHA512
79d6c028d48008814863b1a7b321a61ce5568afa30e372230a82808e19c5dab8d3a4a34ec6d8a122ddfbbbf384d2c62fe4c516f1fd7e8561ac8acbcac39ec446

Download Submit
C:\Users\Admin\Desktop\Quasar v1.0.0.0\Profiles\Default.xml

Filesize
805B

MD5
aec199a921083b7a31a7b2a3c036c592

SHA1
72b88cbc5bde958c555e6142d169a7fa8f065927

SHA256
333f3d943a81c20a2b77fa5e5bcbc670db8681f8b548534084145cd4491a2b49

SHA512
a58e54700554e3502472a1e6d29c27b6f7ae92b3d00276474a0a1cbf9d69da565955696873b1c72448abb9c0c0c67d13fba29f73b29386014f8922e7d3975998

Download Submit
C:\Users\Admin\Desktop\Quasar v1.0.0.0\Quasar.exe

Filesize
1.2MB

MD5
f9c2ad22d3417ff13db3e1acb49d634f

SHA1
fcb8de5fb576d0e259d69ce2d605b3ed7901fcc8

SHA256
858c92a9e421e8588c79eac6aedc270e5b5bbf539372647bd3a9ab79e15a4388

SHA512
c531011bec1abd5ed1262fc6ae354b5eb01ec5ba492e11dc237ac6ee6e7a1bd361bfe3daff89928016a127dc9711636a0f3ef800ce75c78930a58ef1fc5c4e27

Download Submit
C:\Users\Admin\Desktop\Quasar v1.0.0.0\Vestris.ResourceLib.dll

Filesize
76KB

MD5
4c2fc3ae1f21d55a82464f03de977899

SHA1
0399fd6265cb54369043080ebf4d013574f9f208

SHA256
13e08cc54e2238592424b2d337333631f5b7dd804c682b8781be08de53d7889a

SHA512
4abcb8b26b7d6636d3d9858b39f2d4171b1baba05f476f4c8f9c9ab0fb2b8da2d3fc5fe685c2873af98fe63d3e68c78b91f42ff7ea8a8a37a34276132904d348

Download Submit
C:\Users\Admin\Desktop\Quasar v1.0.0.0\client.bin

Filesize
203KB

MD5
491456ed651885e19bda4200103dfdb7

SHA1
bf2c3e3d35e3b2b4a6c61a861137cb19905a320b

SHA256
f4bc845e5cd12ec0fd60696f84c38fcc13760940de5de969c266ba356a1933a0

SHA512
cafa94e95ac2e3a040273199377abcf61b4eb806a09950771a2dff74043254afd04079946f238055df346a190f47eadbcf7ea9c8b84d67a439af0163b75a94eb

Download Submit
C:\Users\Admin\Desktop\Quasar v1.0.0.0\settings.xml

Filesize
51B

MD5
8af01757cc429d1347430084913566d1

SHA1
e4ec570a0b1a5c99e0613da232eeff4b42ffaa75

SHA256
f1a33cd5b1c9368f73b8ff144bed026664577317df27baff774b2bd2acbd52ef

SHA512
3edbca5a661d0fbdd0f8aac994b50e3f844e1d6ee6bfeadf0d8aa89fab1b7cec69b9f687a704c7a989726bb676604e2cdb75ca30441e94a05fdd4027ec9a494a

Download Submit
C:\Users\Admin\Desktop\Quasar v1.0.0.0\settings.xml

Filesize
444B

MD5
05514fd9c3507ca22a693969e679fb84

SHA1
1c740aaaa61d69b6d9ee69fe7ba5d5bccfa78324

SHA256
9bcbc26191ccc6636f82c3fb7b9f69fab6c9a969a619038524cb79fccdd14fbd

SHA512
aabbf870e54f3931e48aded1001a836a4f5c740b2a0ac75ed9ec628770a08c7a5a10e2a6857cb84d8e41ea748badf10a102bbe0865bc7a2cacd9d3f487ba0294

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.0\BouncyCastle.Crypto.dll

Filesize
2.7MB

MD5
15aa796ed57ccd117a6afd57841a771a

SHA1
241b161607d83f1fee1447199d06c7affa761737

SHA256
5b34a7d3f968e37bd052db2654105b00a5bd46c2aa4ecc52e4a0aba969e5bd08

SHA512
4b7f3bc47c19180e015bb2f73c7039a3eca5edc8949d786c87dd8e67fb9117713faaadc09ca3119268c00d6fa54f787d3e349857f5bd43e4ad118102f912e252

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.0\Open.Nat.dll

Filesize
68KB

MD5
cc6f6503d29a99f37b73bfd881de8ae0

SHA1
92d3334898dbb718408f1f134fe2914ef666ce46

SHA256
0b1e0d8f87f557b52315d98c1f4727e539f5120d20b4ca9edba548983213fbb5

SHA512
7f4c0a35b612b864ad9bc6a46370801ed7433424791622bf77bf47d6a776cb6a49e4977b34725ead5d0feaa1c9516db2ca75cb8872c77a8f2fab6c37740b681f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.0\Quasar.Common.dll

Filesize
62KB

MD5
5bb536c906f18989e442327616c6a12e

SHA1
3108f7f99b9117f10e7ff3e296e0ae132b31ecb4

SHA256
68af05941efa6757cb7aea5ec4b8962582e6be4cc54901d7f2ef072c947b5db5

SHA512
3c45bc47d778dfa207436feb67fcf017c6431fe443b768390f4bb871b203b1c3be0806e1c2c577c545603dd5c3eab5d42c75d41763e9f26e2731dce60386415f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.0\Quasar.exe

Filesize
1.2MB

MD5
a6cacde76e95724c4211a5239f1c2c4e

SHA1
8a306457ccfcb7e3027b35ad752b5c74c115db94

SHA256
7b8499114a3b7db8f52d2f960be8f48760e02de45dde0ada69ebc785833ea801

SHA512
cae26ce0909adc2f45f1e89ba1c5f6595d2466a2b4549c3a57b6d5f96cc693ba383bc9da18cdefde79ea7a3719d10e120defca19df9758eda06ced9d4ccd9bb8

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.0\Quasar.exe.config

Filesize
176B

MD5
c8cd50e8472b71736e6543f5176a0c12

SHA1
0bd6549820de5a07ac034777b3de60021121405e

SHA256
b44739eeff82db2b575a45b668893e2fe8fdd24a709cbf0554732fd3520b2190

SHA512
6e8f77fcca5968788cc9f73c9543ce9ab7b416372bc681093aa8a3aad43af1f06c56fcbc296c7897a3654b86a6f9d0e8b0fe036677cf290957924377bc177d9f

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.0\protobuf-net.dll

Filesize
278KB

MD5
9fbb8cec55b2115c00c0ba386c37ce62

SHA1
e2378a1c22c35e40fd1c3e19066de4e33b50f24a

SHA256
9f01d9f2ed07e630ec078efa5d760762c3c8ad3b06e9e8a9062a37d63d57b026

SHA512
da0211d1c9ba0a59616bc15de80a1fed62b0405cad3b11ae4220ef1488c7837634aad67cbc8b484621a2a6288ef5e424cd816a2523bdb6167abcab76f3ac1a04

Download Submit
C:\Users\Admin\Desktop\Quasar v1.4.0\quasar.p12

Filesize
4KB

MD5
079b7ec8879e418cc81a3c7efca41a46

SHA1
e3cb6f04f08e105963234e2835d73ab08c3e92f1

SHA256
2910d22bab7125e27f6542f40277e08f592732df404b9c80b4810bc2404c442b

SHA512
80bdf42862ae148123dc60b7602fccc6c8fccb477b666123521dc87a9ed1472319dac6349053738dda92fd97a8a3f490c3e79ab432e3f9b3d84a2bd3f8c75867

Download Submit
C:\Users\Admin\Desktop\erg90ij.exe

Filesize
227KB

MD5
8a6f6a600b3c53b72bfbc5a61ad0d7af

SHA1
5b8cdd70906a4ba7c4c0f29008dadd5a75f62c80

SHA256
4c10dacc255d1f94bd4856d92ddb7b30ce1f29f5e52377209e8fb4b129198d64

SHA512
fb97d0dc4efaed383d146c49b357dceef9a6e4330757911dfa9fc622a98144abd154aa9742c2e72dfe2f8d1aebcb4870b7e0f9da96b4c4d6b47b8310ff19ea8e

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE2\Mono.Cecil.dll

Filesize
273KB

MD5
2c5dbd6db1b8decf336433c70b02f0f4

SHA1
aba260436f798b3e6020cb0111857b8196cb3f0b

SHA256
ef92130cde35d1b2167db6c4c035cba671d589b4f82822e6b9dd3af9136df62e

SHA512
8d7790eb08e93e74db1786386335ca1a4ea2c4b215324f9ce0664d2299ce5ba37faf985d8d255f81d8ebb926d7121d5e3e663645a33aa0c0f1d230382823758f

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE2\Profiles\Default.xml

Filesize
603B

MD5
247f7db55f3a826693d3b3af82356b1a

SHA1
7076819d4b18cc6088eb667ab3c74b9ced3bf7ce

SHA256
b80ce4e47cb76f8ccf9e437a45daab0410231ddfe7e193848cd669f57fddbab6

SHA512
eda31cff7cb578ec58bb6877c23fe264bca55aed795a364031c0ad65674d9493a1463ecaf5bb8d30144494260d8fe691a4d0dce634497f4bd7577ef8513f900f

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE2\Profiles\Default.xml

Filesize
772B

MD5
9c14e5d4a752c696db328b413f0897b0

SHA1
7d86d86db16154e8b8067ac9bba0bfaddfed901a

SHA256
bf6bcc22b058363d5a8a21387d3a0caa5b1d856bc722967d53a3ed5f7304e369

SHA512
5654afea37ab8917b2c4c661f07ca80a1e19e995b20f697d21c1e41255845acdcdc30c935cbabe70086db7c603968de8888c6f7cbe56f797dccf7c5e29afe656

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE2\Profiles\Default.xml

Filesize
772B

MD5
d50673e1a860a7954fad3fc434aae987

SHA1
48dd5a519a84d0f3ff718c9fbbeccb30a5f6a7f5

SHA256
7a65c63909851e86e372cecbc2b9ebede0755207977f3920c0ee9a7a1e3d97c4

SHA512
6e05fa5a1b3e00d5d4671d08314abb6c0c1a3ea86215e2c891e6c87d5715a5f6a0fecf2efd4ce3737114a47f68f91a85acdefed7575ebc91b284bb095f5073c2

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE2\Vestris.ResourceLib.dll

Filesize
76KB

MD5
3048628799c10059424491e174851f91

SHA1
16823786160a48f3ba4b61f6ea6b5fe02a5fc01f

SHA256
fadcf9b9f02b540b33c31817445456dc36e8ab2a066dfc3e63256b9706638399

SHA512
e7cb2808a72c2ea6bdd31e0cc65456e35119830eae21519a93248ffa5e5405dfb86ff1e06d1176f6d4c10945a034a21a8839d60b49a6545f8c0db28e10d81ca1

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE2\client.bin

Filesize
216KB

MD5
6c82bafb59c822084e046e2d48ddef95

SHA1
c6e296133b1258970b68e03fa56ea2913b5ee3c9

SHA256
4898eb68ff09f2bd50c223f04664a8a86b373f50ed7ad1662c0f7e5ecf3b3ba1

SHA512
e349f597a001741c69cadb4271ca2aa67ac6bb97b5d651482e62087a79de63ca445f7ea585920144772b7ad3fd8f35bedf8d086be177fc8832b0741851a3e807

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE2\settings.xml

Filesize
178B

MD5
b17f6004385ddf8969c9ac7573783fb1

SHA1
ccfe11f5073bc71d0ac95cda044692f07a574f6c

SHA256
f222a0fe65ae36fd84fb39f90692fc550cea18add7f8325a0a00201fb54783a6

SHA512
978e5c9678fefefdd424f16d7bbed23d25cf305246189380b694512b378339b45e8b38bb9200ca41bb9a49e5afd86653809429f8b3060b6467372912b85e2f97

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE2\settings.xml

Filesize
179B

MD5
e9ec981a776fa85b9c97f505cb5bf30b

SHA1
fed15cde42a83c123a95bc2e5520bb2adb160c3c

SHA256
a8924ca7e45a3eeeb63149a6d4473506abdad433089384c05e9c57e6f66de66e

SHA512
59e815741ad9461ae33169c1053f0f99f4f7a140fbfa3556d168740f19fe38d9ba5473826b0cb684824a67844620b21883d79ddeb528a1c8802dff24378dfdd7

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE2\xRAT 2.exe

Filesize
931KB

MD5
83243ff7c19e632aa4a3dc082b0de687

SHA1
12df259bb003717be7cb8f8249e7f453c47baab3

SHA256
0e26c0df0f4591d3e7a767ed6db6d7037b71123fd22e7d5408ab70bae448a975

SHA512
15aa711f78a667cd20dd5086797fd7ae6a43214fd4ed302c758dc64f51161540c286e0ac66a4a166d69f604c3125ab9a47932b3c859b9331c3cc386f693b86a4

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE4\Profiles\Default.xml

Filesize
635B

MD5
b71943f686068b294a9492f883ac844d

SHA1
eb356cf8c2305c0e1f8b631646eb43163f2af175

SHA256
fe0f805fda8596b27d72627e0b3bc4abf4a318adcb454f69d836a405517e0644

SHA512
63fa04538e91dc64c3124228d02f02f069c3d12f0530c4eb42cd66a361ec3afd9b1180bfc72d52f38030d24c004e60fcfe1b03298addcac5fb433dcfe49a7c96

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE4\Profiles\Default.xml

Filesize
648B

MD5
06c97dfa4c87923b389ee99340eaa2de

SHA1
7094ccdfa609a27b4bf9e88920e832c8765ca53e

SHA256
c40f23e9639190803c4a43852408dfaf9c4d31744f9cb3b3159735d656dd405d

SHA512
6c113cf65899122ba45addac8881865e0c926bb5488d1ca1bc2adb2d1fe83d4406e60b3972c6e8363648ae8a5af75803dd008d4fa464b958ee9984f2ef65ccd6

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE4\Profiles\Default.xml

Filesize
867B

MD5
badbc36ff5cf838f769a029cb1cdaf69

SHA1
551effe68ccb4bcbc21de218159b931f1ba2abe4

SHA256
923d96e801085ac039022bc1fc85db7760444fe49258e72d929d885e408ea8d5

SHA512
f868e8cc599ab1e0da561f63e6d75d120db9ff45f046eb81b0fa41f1a5569499896a1053ab7645cfb450e38aa1fc6cb6138db045c07797670ebf7b0dcc573f0f

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE4\settings.xml

Filesize
393B

MD5
c2fd64e9c69c2898d27653b3b47db2ff

SHA1
610f9e4105fbf0f668897bec7be77b8bf708a6ae

SHA256
f07f40e283e8d07742a7743dcd5de22933e1c6a6e39513fe0164cd8a910fa030

SHA512
77f8c240db2afef34228e3cc59a2d46a18e5f757d8e20ae670dd1ca4eb420757afa5b7003e5ae8ef98806b52605c8828393418b7ba6f120267303d611630d664

Download Submit
C:\Users\Admin\Desktop\xRAT 2.0 RELEASE4\xRAT 2.exe

Filesize
1.2MB

MD5
6d8489e8ef02f1dd5d496bfa3a4ff48f

SHA1
d8df172354f75d100db674e52654f35f53129e5e

SHA256
63c0c9e03586b36bba16e6cd2f73a71d675f39e9a4c87b09aaa2253cb763c833

SHA512
99f3ecbf5b4596f663d7b6bd9bb28e0967de33ebbc08b02272ed4a5fc0ef29bc04cf3a6537ca6e2ec5dc7acba9a0326708e0f09be9c86b827d670e833ee51e40

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.0.0.0.zip.crdownload

Filesize
539KB

MD5
87dd942c8330f2444d9cc9aa72b05911

SHA1
23d47849588c0d78ee23be40af1ba75ad7df965f

SHA256
b69ba39c3d0e8d01fbfdd87c3dc1af794be711fd3e2e5a4046deaed8e47d6975

SHA512
689ec80aab34d38082e9fb394144b776c023ab82bee509dd0584414d4457f7ccbc1fabae130b519b6c4cae0739ddcac8aa64bd7e37ca4e79ede5546f5d19d47e

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.4.0.zip.crdownload

Filesize
2.2MB

MD5
2f783db7b6db0b3e48aa984710fc3ce3

SHA1
c6cf2b055c1be0d5ba41f986be49c82378afb0e9

SHA256
f2e8a0a730be436eea5cdca3b229b945ad149a0e9e2cca971cb998f88a08956d

SHA512
39e9b4a600a2ae0f4473695c11f669d6541519624043c87fe99b14bded8d32372d4eea139e1ece2f0f5d5d2d9981a3f542fa60fd5162b95a5efa9414d3347e61

Download Submit
C:\Users\Admin\Downloads\xRAT.2.0.RELEASE2.zip.crdownload

Filesize
499KB

MD5
876a659a486869492123ddd74464ee0b

SHA1
d080b8cabcf10a3933a8b1b19f952b84c90c5bca

SHA256
08b04104962a7f9635a3e44f5553a3a758270d7157b052f04ba884705cd7caa6

SHA512
8f1d5ee6299f634716b9af7bde2c1998b235dd0618973d03ebc4b73d8d1e363ce593b659c3c9b5be91464d8b835ac63806e84859196efe25b40d95403edbedbe

Download Submit
C:\Users\Admin\Downloads\xRAT.2.0.RELEASE4.zip.crdownload

Filesize
577KB

MD5
b80a545d266015562b9a29cc4644fcc2

SHA1
175a67a0c45982fd40938f458091c78cf4813d5f

SHA256
bdf28c9d6d24430d92f6f103aa8114a8b399d3d44149812f5be8548cd2fd387a

SHA512
83a35121706342cdef78af187475d88b72fb9098e235870cd5838f7fccf9b11f47ac8ca16680b96eebfebd2ef93d9aafb17e122c2ec1fbdc605db5dd5de5544e

Download Submit
\??\pipe\crashpad_812_ENXCTGLORTTTEYWM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/772-855-0x000000001FFB0000-0x000000001FFC2000-memory.dmp

Filesize
72KB

Download
memory/772-880-0x00000000219A0000-0x00000000219BA000-memory.dmp

Filesize
104KB

Download
memory/772-878-0x0000000021950000-0x000000002199C000-memory.dmp

Filesize
304KB

Download
memory/1712-443-0x00000000212D0000-0x000000002131A000-memory.dmp

Filesize
296KB

Download
memory/1712-354-0x00000000011C0000-0x00000000011C8000-memory.dmp

Filesize
32KB

Download
memory/1712-352-0x000000001BB30000-0x000000001BFFE000-memory.dmp

Filesize
4.8MB

Download
memory/1712-445-0x0000000021320000-0x000000002133A000-memory.dmp

Filesize
104KB

Download
memory/1712-353-0x000000001C000000-0x000000001C09C000-memory.dmp

Filesize
624KB

Download
memory/3840-1123-0x00000141F7650000-0x00000141F7702000-memory.dmp

Filesize
712KB

Download
memory/3840-1098-0x00000141F7860000-0x00000141F7B22000-memory.dmp

Filesize
2.8MB

Download
memory/3840-1122-0x00000141F6CC0000-0x00000141F6D10000-memory.dmp

Filesize
320KB

Download
memory/3840-1085-0x00000141D96E0000-0x00000141D9818000-memory.dmp

Filesize
1.2MB

Download
memory/3840-1125-0x00000141F6D10000-0x00000141F6D5C000-memory.dmp

Filesize
304KB

Download
memory/3840-1121-0x00000141F5490000-0x00000141F54A8000-memory.dmp

Filesize
96KB

Download
memory/3840-1087-0x00000141D9BF0000-0x00000141D9C06000-memory.dmp

Filesize
88KB

Download