fe48483ed05985fb571993d276aedb1709a40b17665491a965971ca376262b09

Resubmissions

31/03/2023, 21:16

230331-z4sq6ade43 1

31/03/2023, 14:34

230331-rxnjvsdh8x 1

Analysis

max time kernel
139s
max time network
241s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31/03/2023, 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aseprite.exe
Size

5.6MB
MD5

cf7a98ff971ccf52d301d7a5bfeeb469
SHA1

e50bd0c4f754b26e98cc37d380de372ec2c6bf59
SHA256

fe48483ed05985fb571993d276aedb1709a40b17665491a965971ca376262b09
SHA512

65ca40f933da6edee8e701e8a5dff3b921d5b62d04ddb89c7ddc1ee28113a77432e6958fde24ee3d45adae08afe7ab82ededb20b88d9df05b4eac8086c6d243e
SSDEEP

49152:4wrlRLSVJ/l14enrlK+yKJ3Bm1u28axzMAX8jZaMrjWqPkT6rYnu2r/23P:3Z4D1rlKqJ8R/voGu

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
524	chrome.exe
524	chrome.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe
Token: SeShutdownPrivilege	524	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe
524	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1772	Aseprite.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1924	1000	chrome.exe	29
PID 1000 wrote to memory of 1924	1000	chrome.exe	29
PID 1000 wrote to memory of 1924	1000	chrome.exe	29
PID 524 wrote to memory of 1724	524	chrome.exe	31
PID 524 wrote to memory of 1724	524	chrome.exe	31
PID 524 wrote to memory of 1724	524	chrome.exe	31
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 524 wrote to memory of 1880	524	chrome.exe	33
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35
PID 1000 wrote to memory of 1376	1000	chrome.exe	35

C:\Users\Admin\AppData\Local\Temp\Aseprite.exe
"C:\Users\Admin\AppData\Local\Temp\Aseprite.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6639758,0x7fef6639768,0x7fef6639778
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1184,i,10339296751492552145,18165117508171162583,131072 /prefetch:2
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1456 --field-trial-handle=1184,i,10339296751492552145,18165117508171162583,131072 /prefetch:8
  2⤵
  PID:1728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6639758,0x7fef6639768,0x7fef6639778
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1224,i,18238274498751238746,6826503399212722554,131072 /prefetch:2
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1456 --field-trial-handle=1224,i,18238274498751238746,6826503399212722554,131072 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1632 --field-trial-handle=1224,i,18238274498751238746,6826503399212722554,131072 /prefetch:8
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2212 --field-trial-handle=1224,i,18238274498751238746,6826503399212722554,131072 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2184 --field-trial-handle=1224,i,18238274498751238746,6826503399212722554,131072 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1420 --field-trial-handle=1224,i,18238274498751238746,6826503399212722554,131072 /prefetch:2
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1148 --field-trial-handle=1224,i,18238274498751238746,6826503399212722554,131072 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3904 --field-trial-handle=1224,i,18238274498751238746,6826503399212722554,131072 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4024 --field-trial-handle=1224,i,18238274498751238746,6826503399212722554,131072 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1312 --field-trial-handle=1224,i,18238274498751238746,6826503399212722554,131072 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1616 --field-trial-handle=1224,i,18238274498751238746,6826503399212722554,131072 /prefetch:1
  2⤵
  PID:2728

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0746521c-b723-413e-ab57-a3c03aa3c5bd.tmp

Filesize
71KB

MD5
c54cf14e414efdc2a9874a82643448ff

SHA1
083e6ae034599e3596027c12909a820b2c3da204

SHA256
a76b0cb7a5385c4a167b9a095b21b0dae52d0fa3d4e68c34518c1eca3253ef76

SHA512
bd3ad7ea680ff7c46c23f4d2a1659e3f8f1e057b30447146fd4f5d367e0b3a0350d0ee1f4eb5238ea344a42a86e241ca616addb91c14ab3675656dc3378472c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
c6e4431d295a1842fea0a903fba97f96

SHA1
b61072829b60b8e757f84812d1e44ce318b8eb12

SHA256
775ba22acda7362b3b8913914d10b3df1610e9ef9e11619c36c6607811bc9f93

SHA512
15761feea1df597afc51529909961187188ce64601193513ecbe41bc8b22fb5877d48a8ce85ce45fb874c8ac51049bfb1eb6cff16164104bc53cbcc38737f5b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
c6e4431d295a1842fea0a903fba97f96

SHA1
b61072829b60b8e757f84812d1e44ce318b8eb12

SHA256
775ba22acda7362b3b8913914d10b3df1610e9ef9e11619c36c6607811bc9f93

SHA512
15761feea1df597afc51529909961187188ce64601193513ecbe41bc8b22fb5877d48a8ce85ce45fb874c8ac51049bfb1eb6cff16164104bc53cbcc38737f5b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
c6e4431d295a1842fea0a903fba97f96

SHA1
b61072829b60b8e757f84812d1e44ce318b8eb12

SHA256
775ba22acda7362b3b8913914d10b3df1610e9ef9e11619c36c6607811bc9f93

SHA512
15761feea1df597afc51529909961187188ce64601193513ecbe41bc8b22fb5877d48a8ce85ce45fb874c8ac51049bfb1eb6cff16164104bc53cbcc38737f5b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
c6e4431d295a1842fea0a903fba97f96

SHA1
b61072829b60b8e757f84812d1e44ce318b8eb12

SHA256
775ba22acda7362b3b8913914d10b3df1610e9ef9e11619c36c6607811bc9f93

SHA512
15761feea1df597afc51529909961187188ce64601193513ecbe41bc8b22fb5877d48a8ce85ce45fb874c8ac51049bfb1eb6cff16164104bc53cbcc38737f5b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RF6f5d4d.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
dadcf70b540ae9e41099639a0927d30e

SHA1
b4d39f8015a05238dbdba9c8285a2895a76de699

SHA256
9e2d6a2b6c0347ee84c7c49299dd093621043a210fc3ce2476c1da1641b8c683

SHA512
3f7e22d34cedc94ea83f2c3dfdac360df0bc36ce89e03d15dd3c5426a236ed8f75d16e1ccd7a2fc216c9f1d9735ef912bb38b2e6ea98f498edcb6e4274788188

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
ba5ca32aa891bd61fa1eed089de0d05c

SHA1
c3d93d88c97b99ffedfb7487d4766afcc2ec811a

SHA256
25e47072f22e261a045e21eefbcb94ee1c8c78df5a4305704d7281c0cfcf4a49

SHA512
0c02b519b52b3c745e60ca25709d0bda5bf4a6d771c344ff6419ae910131bc428baf272ad98cbce65283088dc4545ae2651db7da386fb5b6759999b7b97803e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
0b4ab7f3426ab1f2ad7633fdff1aa98f

SHA1
57465e36a18e5f918e34f35b514c1a72ba38a238

SHA256
b9c12fdf446fec77aa720889d2167052874092f45f724d5a9b1977fd524ac11f

SHA512
b47bfd1ab8774b174b2da7879a080f90b31c63f9cf8750f34d74f9f533c6b7bd06f1f69a5751c1e35fad69ce12672f9e45cba18738ae617fd7723a2083656d82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
662558fb530edd5cfac7b004874f57c6

SHA1
8ae17a489b2efe535476101dbd8ff2bb969d3938

SHA256
7c93b4239a1039669e18968a77fb4617d0f6b28ae326b99d79716b08c2fd0971

SHA512
54ab130159ce9431b2edf5b0fb220636f1b320f93cfde6c12f923b55f16b41464afc9b12ad3fa341e644f8acf3524b771c827b121c988140b265b9c606d0ed74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
eb3796d878632b8b4d5b465b8452d657

SHA1
0a9fb13029827b2d179b2fed56b8b7047de14c96

SHA256
83014ef2837030faa5e5ea51094f8d74e4ebd42a267bdcc2e2941a05d2938a8b

SHA512
b8c71748a6f522c6865b13034292577e663a439de199fb462f3b08eac31ba4eba0b05397bf468348a22b1891aa88f5d946c19c428a5bb12b568ef499fafc1e96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
71KB

MD5
c54cf14e414efdc2a9874a82643448ff

SHA1
083e6ae034599e3596027c12909a820b2c3da204

SHA256
a76b0cb7a5385c4a167b9a095b21b0dae52d0fa3d4e68c34518c1eca3253ef76

SHA512
bd3ad7ea680ff7c46c23f4d2a1659e3f8f1e057b30447146fd4f5d367e0b3a0350d0ee1f4eb5238ea344a42a86e241ca616addb91c14ab3675656dc3378472c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit