hxxp://google[.]com

Analysis

max time kernel
1799s
max time network
1684s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25-06-2024 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

Processes:

mspaint.exe

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133637819075330892"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

chrome.exechrome.exemspaint.exe

pid process

4676 chrome.exe
4676 chrome.exe
3636 chrome.exe
3636 chrome.exe
2300 mspaint.exe
2300 mspaint.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

4676 chrome.exe
4676 chrome.exe
4676 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

mspaint.exe

pid process

2300 mspaint.exe
2300 mspaint.exe
2300 mspaint.exe
2300 mspaint.exe

pid	process
2300	mspaint.exe
2300	mspaint.exe
2300	mspaint.exe
2300	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4676 wrote to memory of 2720	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2720	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 888	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 4348	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 4348	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 1420	4676	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffd6b39758,0x7fffd6b39768,0x7fffd6b39778
2⤵
PID:2720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1776,i,5549691962804605942,13891850366540048605,131072 /prefetch:2
2⤵
PID:888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1776,i,5549691962804605942,13891850366540048605,131072 /prefetch:8
2⤵
PID:4348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1776,i,5549691962804605942,13891850366540048605,131072 /prefetch:8
2⤵
PID:1420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2624 --field-trial-handle=1776,i,5549691962804605942,13891850366540048605,131072 /prefetch:1
2⤵
PID:5092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2632 --field-trial-handle=1776,i,5549691962804605942,13891850366540048605,131072 /prefetch:1
2⤵
PID:444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4384 --field-trial-handle=1776,i,5549691962804605942,13891850366540048605,131072 /prefetch:1
2⤵
PID:3500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3136 --field-trial-handle=1776,i,5549691962804605942,13891850366540048605,131072 /prefetch:8
2⤵
PID:1412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3020 --field-trial-handle=1776,i,5549691962804605942,13891850366540048605,131072 /prefetch:8
2⤵
PID:512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4604 --field-trial-handle=1776,i,5549691962804605942,13891850366540048605,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3636

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3916

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ClearEnable.emf"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2300

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
PID:3604

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2676

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
ec3cc82112f1e577c69d24b2e151b3a9

SHA1
0ba15363541dd1b41cd184665e2ca0d96e5941d1

SHA256
d02c8f8897a494d3309d5aef82daf9e50efeea7d3493dd6cce7e8c5a1f3eb5a3

SHA512
c43c1b9eb079490fe5771a51a53872a387d7e0027821f67be75d7cc5b0cb70cdee4dd40dd0ac4b1c051268518839e0470a92a204693b93b404b683545fe73bf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
5efa745f8e843846b2a09eef3d85ac73

SHA1
795cf0f2173fb29084da538266160abf456b1e78

SHA256
06446b6d262bf21577b991f2bf15ece49aeb94bad144c104ccae1f84aa78705c

SHA512
610826d52307f422ec3f7dc4371295d1ad3517aadbdb4c2895d9d122f5c434aaf1f63ebdfa0fec0c6971694027a6267b1f343225b9a57e1ecd00a17bbf23ef35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
cec9d8a826c85a17716460293d91060c

SHA1
518304f585ec56986fa28ae585354b1c2a003a59

SHA256
a6c05abae4f81edb087d52d9857d34a1dce0af3a35b4ddd891ffa819eb7a7728

SHA512
dee08d016488d1800551a9a18916f236694815ade51d281b63aa27cf513f826546d0578b271390f2d340f8a742ca02542135b7693118b888d2d727bbac05aaff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
ca31c06b1a15c7a44eec68493467065c

SHA1
007c8faec1e5fe5c2500297238f76d0e620bbf20

SHA256
2860a8badaa7a1e26ef7376abe3994b702cae939cafb81e43e6dc51cbaa41bec

SHA512
b6b0c1a949f2d7cd44e463976ed9ddb7337bc0ad3e38f4ee24cb2e84736f81bbf0be42e7722ef359429455dcc6b07326660661299af122216effce57ecadc1ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
cf54530b4ab2c69da838feff865971fb

SHA1
55c35c6b402f860ef602eeed40a460d6824a8a99

SHA256
2a8fe80506ff1f619f76d83b066d7bc2c721e3c5f912a2b6dd22e17318e9c8bf

SHA512
583d87208e539ee4086e028a58e923ae9fdc4ce12646aa1b53910f2ec26e16f02fd8a4789ecd5753c26bb7b1d0f7ed5570c551578b64e5bac821184764a0fae0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
4518c642292399b77ab87fca0a870d44

SHA1
ee9131c3367a3b9f20d624a5a241fefbb484c301

SHA256
72065f2b1b38325886f012ff5b6caaf1d51ee0b71b51420372bbc5f195947458

SHA512
5d95fe8e7ba739fc77b97aac032655f0483b0b89cf0721769ea77dc3d57adb44e51b48cbf31f94c351ef9fc5d04dad6c81ccfdb20f34627396a011ee9fa074d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
367B

MD5
34f7c650319b56b69734651b55869164

SHA1
a22324a1fc961ed641b3bffbf02d7af836d525b0

SHA256
725fb732dafd62f720780fd9e3d26fde0329f0d5891218c0df8c3e9adcb83d55

SHA512
1da0523c5cf509ab6d222ed2c588e6010e9ef9ecff6be24e528788a146a038aadcd12d75f7e284a326eb861e61c6552310c0b5a52047c3212e24bf6515214e8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
ff8a7089e072219680c12a64e6aa91cb

SHA1
e6df0b64a0485a62448ef87fb4f76baf00d593dd

SHA256
4da4e6052e30e14d6fb202c304aad19f61979cc4cc1ed065ad79e00597fdf05a

SHA512
8bb504b1e451635637195aca2005b36ebfbe1dfd9fdf043ed9ec2ceeffc3857bce40416d738a4135f4e111dc5283684c5eb178474bc911ff5e9258a2e07c085c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
1a963f6fce6871701d877ba71d835ea8

SHA1
52a2e33337ce9714e39983f3aa3b4a6790b07c4f

SHA256
76a23361ed039c616bc0f1ea79123c641279d4a479c66f5d19176c8d1302cbbc

SHA512
b4d69d61e7e60108a4eac610aa139e748c6f0650b86f92f31a03575cbcd0993cb76d1534d7d94be5edfcd0fbc4ced84efa5c43c5d2a4ca491cade98198cbbe69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
ba10d83a5d92b1ca53744a4f24e37b13

SHA1
38488deeeb177f90e1851c72d9a253c796600333

SHA256
83fdd370d95582ffc484b67c73d6bc7c4cf68dd09583d6bd3d3475fad660e0c9

SHA512
2a1da523503044a4e1433aac00d0ff3201b1f69168c76b6573759579009a1cd3e10f67f9b1ed3b2e5ac2c5862747153b9383280ab57eca591452c0f81e839ace

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
0bfc754e9a9576898e61e7bfea02fe0c

SHA1
3e5afe97e56110b96e684df9cf8de3614f89f488

SHA256
0efe32d3f8d2d2e053c076d288571e8c4bf830373a98c58e7e297ba631abf24d

SHA512
bd8f50e68ad88730d885000dabb0ccff34797dbd26c050519ae10278c17d17aefdeb791e936a7f3b23209f953d0328371abedf4316186045089fdd046315b5ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
907ae423d8cf555b9c8a4e3792a79e9c

SHA1
ba41b5c6ccde26f8a9cc6e53a5a3d08eadddb630

SHA256
989dabf655c3db81ab6259d1e269c3f537ed0743cadd274b1c1cd5698748c2aa

SHA512
36cc4309dc3dc82d88664e3ad1ef270167b118730d2fb8832ba5e763a329d107c058e603d3e138ab0908ada1ab6e512fa281bbbf5a88b9de267243457384f425

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
fe51a03a73e2d63409660af68f773637

SHA1
7d24d36c7dcff79501a1a763b317087675f1cbbd

SHA256
b182b9c847bdf46347421b6ad4189b3d45b6b5e31c63692592d3cea40c31c0a6

SHA512
1f4d7c84a6568d8b1fe154dc6f490bfcb20477652ac24de33da3d1a780aee7cd81511fc4283af08ccc72af130d907b2a26d5df7e37b79823a74220498b0d6e73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_4676_EIKZSNMBDPQUPERF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit