Overview

overview

10

Static

static

10

Client-built.exe

windows10-ltsc_2021-x64

10

Analysis

  • max time kernel
    283s
  • max time network
    281s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250313-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250313-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    27/03/2025, 22:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    c29f45e56a8e5440afaa649f1e487413

  • SHA1

    c30566ac9bc7b419293b5491c34953098b348ac7

  • SHA256

    66bc9a4e0f2a4227a412decc3fca0aac864ea03220afac1ec097d35635fd3160

  • SHA512

    c6098347f261b69e8d9be58ba069d23e0049c6c5682940aa05c158b98db864d99ab86aebb3968ba3745b23d2f76ca13a707b4615fd4d80ff192704a500406e54

  • SSDEEP

    49152:fvXI22SsaNYfdPBldt698dBcjHymxNESEVk/i/LoGdGTHHB72eh2NT:fvY22SsaNYfdPBldt6+dBcjHbxMD

Score
10/10
quasarskibdidiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Skibdi

C2

7.tcp.eu.ngrok.io:16233

Mutex

53790885-f84e-49fe-b0f5-533bcec24786

Attributes
  • encryption_key

    3428C8CDB24FFC56DF6BBDDEC9905C3058F7B092

  • install_name

    WindowsDefender.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    WindowsDefender

  • subdirectory

    WindowsDefender

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 60 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsDefender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsDefender\WindowsDefender.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3036
    • C:\Users\Admin\AppData\Roaming\WindowsDefender\WindowsDefender.exe
      "C:\Users\Admin\AppData\Roaming\WindowsDefender\WindowsDefender.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies Control Panel
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4356
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "WindowsDefender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsDefender\WindowsDefender.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4156
      • C:\Users\Admin\AppData\Local\Temp\B230uItJaW5x.exe
        "C:\Users\Admin\AppData\Local\Temp\B230uItJaW5x.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3060
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Drops file in Windows directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffe60a8dcf8,0x7ffe60a8dd04,0x7ffe60a8dd10
      2⤵
        PID:2520
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1620,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2156 /prefetch:3
        2⤵
          PID:1616
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2020,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2016 /prefetch:2
          2⤵
            PID:3984
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2408,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2568 /prefetch:8
            2⤵
              PID:820
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3144,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3224 /prefetch:1
              2⤵
                PID:676
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3244 /prefetch:1
                2⤵
                  PID:2152
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4276,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3944 /prefetch:2
                  2⤵
                    PID:3168
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4636,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4728 /prefetch:1
                    2⤵
                      PID:560
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5388,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5412 /prefetch:8
                      2⤵
                        PID:672
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5452,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5540 /prefetch:8
                        2⤵
                          PID:1072
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5408,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5472 /prefetch:8
                          2⤵
                            PID:2564
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5696,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5604 /prefetch:8
                            2⤵
                              PID:2100
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5772,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5876 /prefetch:8
                              2⤵
                                PID:3100
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5472,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5464 /prefetch:8
                                2⤵
                                  PID:3808
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5620,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5956 /prefetch:1
                                  2⤵
                                    PID:3336
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=504,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5948 /prefetch:8
                                    2⤵
                                      PID:996
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3424,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3404 /prefetch:8
                                      2⤵
                                        PID:4272
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3412,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3236 /prefetch:8
                                        2⤵
                                          PID:5104
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4392,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3332 /prefetch:2
                                          2⤵
                                            PID:4260
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1240,i,9955374525929669723,7730936326104489076,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4376 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3252
                                        • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                          "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                          1⤵
                                            PID:4476
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                            1⤵
                                              PID:4456
                                            • C:\Windows\system32\taskmgr.exe
                                              "C:\Windows\system32\taskmgr.exe" /7
                                              1⤵
                                              • Checks SCSI registry key(s)
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              PID:4084
                                            • C:\Windows\System32\rundll32.exe
                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                              1⤵
                                                PID:1404

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                Filesize

                                                649B

                                                MD5

                                                692436b220e705e0880d1bc1e10dadf1

                                                SHA1

                                                ad2f8929ccd4248186079fdebcacc8f46aea62a7

                                                SHA256

                                                4a5c3e4ba736e3d639e7f539f1d5fa36b1762a5cd491dc12cb26d1785acb68ff

                                                SHA512

                                                aa8525e676f0686ddc2a1731d3ee5042188336bcb732077ab3017d64ca7fcf12bddd5063d32dc1a441f33d004a1e93c59b66f37a0860768aafbb7f09a0b6fbe6

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                Filesize

                                                120B

                                                MD5

                                                9254b650c756ff28580b1640d6c717c9

                                                SHA1

                                                a7d7a3f42d412a02b96bf73173dc194da5fe5be6

                                                SHA256

                                                98628d48f0ce3b87d252265dad4fb0e013d98d9033035c61f385144f47bfeaa6

                                                SHA512

                                                7ced29883b60904a0547eebec60e02d94245d63caeea962b4c6d3e17f6fe3840beb8c82e796b8ca6526bebefe0b3e02dfba22f0ee1dbb5181eb184f44ec783fe

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                Filesize

                                                936B

                                                MD5

                                                817aacdf75febbc87f46c1ef29ec284a

                                                SHA1

                                                b055650c4ce03b667ac3d8c9c18a0fd10d742920

                                                SHA256

                                                012ebf71d80abe1087c8c27c3c880416e37b343eddcbf585a42f97a3398ac27b

                                                SHA512

                                                5aab0b0916ea9c072a773b6e62a6a93b6a0cccb7545c38d409e087a6f591fcbfc0a2cef58e1f669f471e30eb89b98bb4d3d2b5bca799ab20d3d8ce160044ce23

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
                                                Filesize

                                                264KB

                                                MD5

                                                87764b96bc434b65f4a60825c4012403

                                                SHA1

                                                5bb41d1be05cfb0d656c6b86a0d6c05d0067f8d7

                                                SHA256

                                                09136740674f8fc6fb48e4fcce6d042992db9dbdd5e06bc63692bec602be9efc

                                                SHA512

                                                a565960fb3cab47da2d59fdbedfe7be60b56c15d7ee3ffb674975aacbd4fbc432621a99394797b1b7b5f8d09e28e02412628c178a8f58fcc927013e5bb4b51de

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json
                                                Filesize

                                                854B

                                                MD5

                                                4ec1df2da46182103d2ffc3b92d20ca5

                                                SHA1

                                                fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                SHA256

                                                6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                SHA512

                                                939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                Filesize

                                                5KB

                                                MD5

                                                67590f3754a44af700107f181b903506

                                                SHA1

                                                3b86604026c8d14ddba3dead22b84c0b90fc9cce

                                                SHA256

                                                3dd117096ed364ee9de30faefc872c7c46e8acd238821424ec3452d5fcbf2964

                                                SHA512

                                                b59376f0375657678f4144180f4118867a9ca75ecec80b6c07aec5bac95cb356725356d0f5d41bfcbe5146ce70a7a88e43b6300deaf2469bfa0bcde5c37a508b

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                Filesize

                                                4KB

                                                MD5

                                                40e34062f65b9b4936871aadd476ce50

                                                SHA1

                                                01514cedcb0ce342dde7b8fbe795753d1102ce14

                                                SHA256

                                                b5a03d3fbf5f8b86b267f0f743440fc3014300895ed5282728c21a7bb956b08c

                                                SHA512

                                                849d227965dfbe293486554774d7a315a5f191bda40792c0008b276e18c131ef67ebcf5558403694183af25a3df886a61af4daedeb2e514dc11aaf248079506e

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                Filesize

                                                2B

                                                MD5

                                                d751713988987e9331980363e24189ce

                                                SHA1

                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                SHA256

                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                SHA512

                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                Filesize

                                                523B

                                                MD5

                                                66eae6b2554749489ff43eeb7bbd3dcc

                                                SHA1

                                                29505125519ae56d5667fc7ab680306cdedac37d

                                                SHA256

                                                daac70d597910692ed54603bf4e4d31c5ed2d7f95d2a141169b86f9cfbb7dc66

                                                SHA512

                                                aaebd3af409de76961cc30f0639d073ee479d1d53c2f866069166b40ee5b0e31ad122407b44524ec68e9f6dccd7f51c11a2028b0da62ed74ffd2dace1f31fa8e

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                Filesize

                                                11KB

                                                MD5

                                                1705f76b5b1d83d93030c8360a0f5f7e

                                                SHA1

                                                435ccc9adebb254ab354bdc784884c30a2a02cf4

                                                SHA256

                                                ece3b640c2d45253bd622c4ad1712a5fa4d9b9b6e16bb5882b1d5233a31ef30c

                                                SHA512

                                                84f5543aa78e2d95a50a055d98ff65ad4551b9953856d28a24497004419da2fa1f318ed58f8d2a02e8c9027a8d0219248afb949425691b7960fa279ef0f79841

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                Filesize

                                                11KB

                                                MD5

                                                2beda7d65e47223fa981c720ebd69564

                                                SHA1

                                                7fa6b8eae1ebfe58a5cf1ea0ed8223d67f057542

                                                SHA256

                                                19feed64dbe544e5649f485e7f6299399f3d7688d796eae2b7530be2da4be59e

                                                SHA512

                                                53a129b6e07cfc0ba289f2b40da7c67c111b311f74c60a47cf9237edede90007ad59a6c261d5fd17516b33b1af056644f4394a0910fc3b75398c366924c3b2a1

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                Filesize

                                                11KB

                                                MD5

                                                287df9e4ff671eac3023a55e82b556c9

                                                SHA1

                                                5604b9fb321040918f51189fda0cb282b8131fd5

                                                SHA256

                                                29a54919a092c88efebdebdf3e1856a8c58d2d23e8250af4fe32716d29713df4

                                                SHA512

                                                e0eb74191e61497590232a4333c368449da016261e8d5cd36dac0629e3579764178e2c784dd74a9a7dfb17b2ef73ec6bb1cdfea9881c016def28d04ccf37226b

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                Filesize

                                                11KB

                                                MD5

                                                86cfcad78339477700a1312f8a43d2e4

                                                SHA1

                                                29a30bd7a8e542ff5744577c729122ff443e6840

                                                SHA256

                                                4434a56a7aae6e61ecd60e50978eec018f448464f010ff0137f80ab0f22492dd

                                                SHA512

                                                c1c0ba81c767551454ee0e568f13647dff5a89e6bc3ff99a31c3bf7779e4f06f2bdad3c87787dd756e9b87cc9072742c69d5e97812f3dca4399279d2c884fad7

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                Filesize

                                                10KB

                                                MD5

                                                cd5dc4a32e1c8ad5001e735392c42c11

                                                SHA1

                                                a3b2d7697ca14edf03149a3beec0d92b9fa8646b

                                                SHA256

                                                bfab698f32787dab05241cf153c7d44ac19ef3ff4a8e38fbf8f53e4692921d84

                                                SHA512

                                                00b36facf9b483760cd3fc6e90088ef40aa0c58195c4fb5b07be89c4763c1c74cf5f12b1ffaf2637f6d70722f76b257649f20f621ac46389247a19b931f000e5

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                Filesize

                                                15KB

                                                MD5

                                                464a20c03efe3c8f7a27e57380e88589

                                                SHA1

                                                9d70a98526d4e53f26faca1eda9152ec5cedf8a0

                                                SHA256

                                                437fe2d2ce649545faaecea3db81ba357dba9f38b509f39f09e0fd0501f7f0c5

                                                SHA512

                                                e4c262efb435300df97c9e1cff4bf3a21b3f0437ec3e45c514703cdef0e616af229fe1b976d5b6c05f27a36952b3ce611c06587d6507b3f0157a57459b54a9b7

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                Filesize

                                                18KB

                                                MD5

                                                488485f34b003f37e65d8889ae582c80

                                                SHA1

                                                9f3e9828963f3e67e9effd39fb60a3d7ac96db05

                                                SHA256

                                                d8b6d442ce8f5c0ee63e3af1f78cf42e990ed8da94e22224a8b42ceba7c6c25a

                                                SHA512

                                                ca4b6767802871680388e884251d64585460189299e9e90278bae08f5f8aac03cab6ebf2034ccb70fdcca76179944dea3e17baf8d4d70e3f4f065ca88f2d3540

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                Filesize

                                                72B

                                                MD5

                                                ab8db3c1964af18092caafe1659afb9b

                                                SHA1

                                                f43179f968c6296eb441af8c0a6c19b3008a565a

                                                SHA256

                                                a27d5a76ac6fdfb5c28625e7ad337409e13f311595ef262d73a2a2f1bd04f226

                                                SHA512

                                                828e9ed5cfffdeb855c3390bd587faf792f017b64c21e7b380b22194145eec70b2156a0ef3f70131e9d2bfcda479066cfa7608e9a2f861b848c59707e84622aa

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                Filesize

                                                72B

                                                MD5

                                                344757ccf7904acd8ecfcbaa80e37c87

                                                SHA1

                                                b9ea349546949c97ff1649cb5a5793d805914d64

                                                SHA256

                                                25bc69a2a10fc549a721a50f05bfb8e00b8a2e04b2e2473f8896697103670744

                                                SHA512

                                                ae998c9036971c4919a3c99429e467698e15cb4891f42ebaf112078d7d3380a75d40240d4fd9e36feef1d75b304d792fdc12d501d247aef0d93b70f1188a2f3b

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e569.TMP
                                                Filesize

                                                48B

                                                MD5

                                                38144f1bdd1f937eeed32775ed4776bd

                                                SHA1

                                                5b44764fe8a1249c281ffe31cb3fa8fb01bb80ea

                                                SHA256

                                                622efe3c4a780cf0e15327fe4d6dc2e361d8d205de5c89fc9983be1fe531a860

                                                SHA512

                                                b7fd3bc6ec280208682577ea2a80fdbdd1a90a7d4c36d5abbdf903a888c22329c619a38fc9d6d79ff50f963b7e2c102b99f9d4e822869b2e658ba8776e4ce684

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                Filesize

                                                155KB

                                                MD5

                                                eb776d8f2b61db53c4eba98ad5edb9a0

                                                SHA1

                                                a24667e8b727a5a65ebb53f3e488e19536ba3caf

                                                SHA256

                                                31bf43e3c6826122a5032a38f7e1dc6ab482a03d91ae08596c476fad2f0d12f3

                                                SHA512

                                                83317394f785eef0dca4586cba23e0f80e54d0a852ddc2e1c4fcc3abec0af980e2666915f5bfe5f1ec6880ad85311731553564d8d3d58415fb4845c9d2d48956

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                Filesize

                                                156KB

                                                MD5

                                                d18037b302c115a6b20e38a955bd2471

                                                SHA1

                                                8b7e608dcbceee9e4b2a0ac3550a1f64e75bb3c4

                                                SHA256

                                                e878bff4e85930bd958cb75eed67d23bdbdac4c5c89a5522b4d480c0da340e83

                                                SHA512

                                                b90a341f33ef0a7515cb70d7ff75a6b1e7cd33a61cc242c9c917e7af8481c603bb1715cf7585e6f11d84a593b0964c8fdef69df7ee72748580e61b95c33654f7

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                Filesize

                                                80KB

                                                MD5

                                                2379e26e61f8d0252d28e8c4a810acd8

                                                SHA1

                                                2883f0ad09a9d51184aecff769d1d0008f532a0f

                                                SHA256

                                                d54149386a5e8a9237574354cd9a06de48ab528877dc92a7d32852ebcbfdcc1a

                                                SHA512

                                                2a822c6bb2d54cf0fa333f1ea4a3be5b164f5da3280047841f4e9aad897add6b20a4959a81bfb7597e37691a3e69e1ab1192427a56d40f62909076c8c629b518

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                Filesize

                                                155KB

                                                MD5

                                                c3b8ccb4b84564f0dc0db38fe829f9a8

                                                SHA1

                                                1daa2eee9ac97eabddd34fc8a20bba9222e26a2e

                                                SHA256

                                                1e5387c8c72f67b0f3c0062df1be48e75a38d4c8d2bb250f64db121ecbe3e3ba

                                                SHA512

                                                31ab0b031199530726f3790d8733560768b2c8ca7dd571bd21a7f3291c8e2293182277ff4300d78bd92d3027a3afc27b0c7a2ea32442a196554d0e25b6ee0683

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\B230uItJaW5x.exe
                                                Filesize

                                                555KB

                                                MD5

                                                68db0392dbf80b55348c20dc50fdcc62

                                                SHA1

                                                ff54852cec5ee705b0861d84dba7f569a56c33ee

                                                SHA256

                                                450127d599b1ac13bb322018823a943060fee3c4f81ecde1e2ce59ef707dab4e

                                                SHA512

                                                109536c0dbbea49eb1d088166c299629b24eda130fdd926dd4cc733ec457ab26be935cee1953f8084d8fb19646b51094cd54a5422d82407af922c95f0af9177d

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\WindowsDefender\WindowsDefender.exe
                                                Filesize

                                                3.1MB

                                                MD5

                                                c29f45e56a8e5440afaa649f1e487413

                                                SHA1

                                                c30566ac9bc7b419293b5491c34953098b348ac7

                                                SHA256

                                                66bc9a4e0f2a4227a412decc3fca0aac864ea03220afac1ec097d35635fd3160

                                                SHA512

                                                c6098347f261b69e8d9be58ba069d23e0049c6c5682940aa05c158b98db864d99ab86aebb3968ba3745b23d2f76ca13a707b4615fd4d80ff192704a500406e54

                                                Download Submit

                                              • memory/228-5-0x00007FFE658C0000-0x00007FFE66382000-memory.dmp

                                                Filesize

                                                10.8MB

                                                Download

                                              • memory/228-1-0x00000000005D0000-0x00000000008F4000-memory.dmp

                                                Filesize

                                                3.1MB

                                                Download

                                              • memory/228-2-0x00007FFE658C0000-0x00007FFE66382000-memory.dmp

                                                Filesize

                                                10.8MB

                                                Download

                                              • memory/228-0-0x00007FFE658C3000-0x00007FFE658C5000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/3060-729-0x0000000005820000-0x000000000582A000-memory.dmp

                                                Filesize

                                                40KB

                                                Download

                                              • memory/3060-727-0x0000000005680000-0x0000000005712000-memory.dmp

                                                Filesize

                                                584KB

                                                Download

                                              • memory/3060-726-0x0000000005C30000-0x00000000061D6000-memory.dmp

                                                Filesize

                                                5.6MB

                                                Download

                                              • memory/3060-725-0x0000000000350000-0x00000000003DF000-memory.dmp

                                                Filesize

                                                572KB

                                                Download

                                              • memory/4084-680-0x00000223D4940000-0x00000223D4941000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4084-691-0x00000223D4940000-0x00000223D4941000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4084-689-0x00000223D4940000-0x00000223D4941000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4084-688-0x00000223D4940000-0x00000223D4941000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4084-687-0x00000223D4940000-0x00000223D4941000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4084-686-0x00000223D4940000-0x00000223D4941000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4084-685-0x00000223D4940000-0x00000223D4941000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4084-679-0x00000223D4940000-0x00000223D4941000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4084-681-0x00000223D4940000-0x00000223D4941000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4084-690-0x00000223D4940000-0x00000223D4941000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4356-7-0x00007FFE658C0000-0x00007FFE66382000-memory.dmp

                                                Filesize

                                                10.8MB

                                                Download

                                              • memory/4356-8-0x000000001C440000-0x000000001C490000-memory.dmp

                                                Filesize

                                                320KB

                                                Download

                                              • memory/4356-9-0x000000001C550000-0x000000001C602000-memory.dmp

                                                Filesize

                                                712KB

                                                Download

                                              • memory/4356-12-0x000000001C490000-0x000000001C4A2000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/4356-6-0x00007FFE658C0000-0x00007FFE66382000-memory.dmp

                                                Filesize

                                                10.8MB

                                                Download

                                              • memory/4356-13-0x000000001C4F0000-0x000000001C52C000-memory.dmp

                                                Filesize

                                                240KB

                                                Download

                                              • memory/4356-14-0x00007FFE658C0000-0x00007FFE66382000-memory.dmp

                                                Filesize

                                                10.8MB

                                                Download