quasar | 0ed68bd071d4ada79ef6ae867bef72436e980e4b8295ef5c005058756cbaf1c7

Resubmissions

11/12/2024, 06:44

241211-hhn3ea1pdy 10

Analysis

max time kernel
261s
max time network
263s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
11/12/2024, 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

e0699b38d78bd176894b991247cf6403
SHA1

bcd66b55530c7ed68983c7a01f6ec867ba5b5649
SHA256

0ed68bd071d4ada79ef6ae867bef72436e980e4b8295ef5c005058756cbaf1c7
SHA512

d132f2dc2f275cb02050e765f86db40951824a86edcbbcb937a6c444a5f151453a0aff859676b974e1b90baea1bc59054ed27fef6e523eb6e0c99120c67781c1
SSDEEP

49152:LvbI22SsaNYfdPBldt698dBcjHv/43OarfLoGdTTHHB72eh2NT:Lvk22SsaNYfdPBldt6+dBcjH437

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.1.58:4782

Mutex

1d5a53de-53d3-4349-abab-ee1b0579f85f

Attributes

encryption_key
56B4C4DAE2FF0461296EBCFD733DDB88E29C8E38
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/4952-1-0x0000000000970000-0x0000000000C94000-memory.dmp	family_quasar

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133783733454038663"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3024	chrome.exe
3024	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	Client-built.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4952	Client-built.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4952	Client-built.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1376	3024	chrome.exe	97
PID 3024 wrote to memory of 1376	3024	chrome.exe	97
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 1824	3024	chrome.exe	98
PID 3024 wrote to memory of 3596	3024	chrome.exe	99
PID 3024 wrote to memory of 3596	3024	chrome.exe	99
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100
PID 3024 wrote to memory of 4720	3024	chrome.exe	100

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x204,0x22c,0x7ffec8eacc40,0x7ffec8eacc4c,0x7ffec8eacc58
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1988,i,16505604516733211954,16572929283599730793,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1888,i,16505604516733211954,16572929283599730793,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1772 /prefetch:3
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,16505604516733211954,16572929283599730793,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,16505604516733211954,16572929283599730793,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,16505604516733211954,16572929283599730793,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4544,i,16505604516733211954,16572929283599730793,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4876,i,16505604516733211954,16572929283599730793,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5088,i,16505604516733211954,16572929283599730793,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4912,i,16505604516733211954,16572929283599730793,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5228,i,16505604516733211954,16572929283599730793,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5232,i,16505604516733211954,16572929283599730793,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5124,i,16505604516733211954,16572929283599730793,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5052,i,16505604516733211954,16572929283599730793,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4896 /prefetch:2
  2⤵
  PID:4352

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
6f44308e534158ab4402ddf0f2093be5

SHA1
405c36db1dc0a065b36a871580a9e73a76bf8559

SHA256
f3390814a60083b0f8d7e753ccfcd89ab4efc9e1f4175fed9df91331a25a906c

SHA512
48bd4bf18272d0ccd16e2ffa0233ad7257dd8ac6d6accd51bd4d2759333a8587bf3b0840cd7b856b960e3176b67f4f1bfb2d0d610a3cf61ef09a3df7b93e0bd8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
71ecd691ee550f6a1ed06257d9b60e45

SHA1
2c6500ea13a855c165ba0d69ac6235ed0f3d2738

SHA256
a579529429f21f36b6189fdda8af804bd9ee7ae4d650e33f24c3449e573d4e2e

SHA512
d2941911b579ce7189ea87596a7dff28dca5c77db623b0db1b36cd03a4e17c14f36ea06cbf97d60456915d27869701c21c3a5e5e9019e3858daca25531e3f9eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
22b611c9b9cb3c1aadc751f873a4e3f6

SHA1
0f3f3591524198ee371a5ac6fe5c778daa612b91

SHA256
0224dab6cb1142ba1d4c377360f4b8b8b151f3d7e31342c54569b281a951ddc6

SHA512
3f5fcec64e8bd2f6d02e35e34b242801e5a64c0ac79bd173709dcf528f1bbece8fa04ab3cb612cecd96265d8bcf6cb500a315dd804e0eada31fefff3cd3d1871

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
24a663eaa8296066d49d60ccc90f81d1

SHA1
a40010c305f2871362de7a712dfb9e1681ac7b45

SHA256
12d8b388125a214beaf9b2b371932845520f0bf23709a25180ee22a53c545a35

SHA512
8158abd6c0520c5d876627f43636f77e13191e60840f9fa0b3fe82cdf4978741ac0d2b98a269b6a278ac58c3759fe1126b8539d82a7fa2a0819f4895d46ee691

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
c2ccf60f05259d58756e341edfc84fc9

SHA1
ba8c98cb6d3a15508aa9f75cf56fbdad349b0177

SHA256
3ba893ed7e72674c745a0b85e817541743ffe69aebed82ae9ecdd3511ff2b0ca

SHA512
3d6b48f8e1cc90edf7e3676df1d6e0e79703900f84b3759fbed35095d272608f56f465e62136267248b3f934fc900b632bd7bbb7a5a6df6fc2aa9c25833bcd2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
a2c265134e3cbbcee8f489642c6ace94

SHA1
c56ed61daeb2b7bc9928f3f5af07bd1d1296e767

SHA256
b9c435fad0d6ff52f8d247d45dc76e71844bfe262d7df578f2fac563db5a8b28

SHA512
7ebb9fe554a295ef736883598d9ebe928d5ea447a748dbef766c3b6534fdbe42870e5d7a38ca05ca37b9b7d1485a60b94f9554e6291aab8d3eab9d76ac0e39b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
cfae88644a70930cac2c9d0b8ba0b71d

SHA1
858a616a41c2c580510e91f81725ac37363e81be

SHA256
f31f9d3c73cd3f965acffbb2ad269830effcb12a662ced155440be8496fd224c

SHA512
f96c6bdc8721ef18c3fe6f04757efb4615c85a60ae032fcfe175657120c0187a79bf4e996f057e393f3b548f2b422af43972cfabdc5019d5fc228092fa659ba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3024_775357229\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
memory/4952-1-0x0000000000970000-0x0000000000C94000-memory.dmp

Filesize
3.1MB

Download
memory/4952-2-0x00007FFECE450000-0x00007FFECEF12000-memory.dmp

Filesize
10.8MB

Download
memory/4952-3-0x000000001CC90000-0x000000001CCE0000-memory.dmp

Filesize
320KB

Download
memory/4952-0-0x00007FFECE453000-0x00007FFECE455000-memory.dmp

Filesize
8KB

Download
memory/4952-4-0x000000001CDA0000-0x000000001CE52000-memory.dmp

Filesize
712KB

Download
memory/4952-6-0x00007FFECE450000-0x00007FFECEF12000-memory.dmp

Filesize
10.8MB

Download
memory/4952-5-0x00007FFECE453000-0x00007FFECE455000-memory.dmp

Filesize
8KB

Download