hxxps://youtu[.]be/J_h2JlU7w3kAre

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2023, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://youtu.be/J_h2JlU7w3kAre

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133248776913840949"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1013461898-3711306144-4198452673-1000\{7ACDF9B9-C2B2-4535-9CB2-4B4813C8845F}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3368	chrome.exe
3368	chrome.exe
3084	chrome.exe
3084	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: 33	2548	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2548	AUDIODG.EXE
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 2196	3368	chrome.exe	78
PID 3368 wrote to memory of 2196	3368	chrome.exe	78
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 2268	3368	chrome.exe	80
PID 3368 wrote to memory of 3052	3368	chrome.exe	81
PID 3368 wrote to memory of 3052	3368	chrome.exe	81
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82
PID 3368 wrote to memory of 4316	3368	chrome.exe	82

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://youtu.be/J_h2JlU7w3kAre
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeaaf09758,0x7ffeaaf09768,0x7ffeaaf09778
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1836,i,4692479129797216872,14730061113638379896,131072 /prefetch:2
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1836,i,4692479129797216872,14730061113638379896,131072 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1836,i,4692479129797216872,14730061113638379896,131072 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3180 --field-trial-handle=1836,i,4692479129797216872,14730061113638379896,131072 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1836,i,4692479129797216872,14730061113638379896,131072 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4536 --field-trial-handle=1836,i,4692479129797216872,14730061113638379896,131072 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3188 --field-trial-handle=1836,i,4692479129797216872,14730061113638379896,131072 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4980 --field-trial-handle=1836,i,4692479129797216872,14730061113638379896,131072 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 --field-trial-handle=1836,i,4692479129797216872,14730061113638379896,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5448 --field-trial-handle=1836,i,4692479129797216872,14730061113638379896,131072 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=1836,i,4692479129797216872,14730061113638379896,131072 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=1836,i,4692479129797216872,14730061113638379896,131072 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1836,i,4692479129797216872,14730061113638379896,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4336

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x494 0x49c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004

Filesize
50KB

MD5
40333c9d07daab8ba8a53f73ee3f974e

SHA1
36c2b17a7c48fc28036534f445b79fca9658f0a4

SHA256
998313664fbeab2403238a77e6c50a4541d20805b30533f67de1a12c624fee54

SHA512
4a893bf97a02f88a3ea7830b5f72eb56295566a2c6ceafa33fd80f74f81edadbb4172f71c0e12e4a06b1e927f9d7b0cc62c5ba070cd50f3f25c8b670a1270de4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
c329a35894cfe660a913210dd88a9c39

SHA1
4d6ef90df72ca1e11e3d14c873e00bb681582e2e

SHA256
f0dfb1750e444db01111ca1b198a31d67bcca35c16a89983536df440ddab43b4

SHA512
b70ed842580c014dd925557393d34c75a3a7ec326fcdacd6b501ae02107ca3b5b1738fa26c961c25c273317c7af63519dd1ac745acd572d4e48007b1df9ec047

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
3f62f1aac8b708d4609b95d9477ee432

SHA1
7b6634edc52473f6a30d389af922f64036685dab

SHA256
f12a1afac5bf63ecf9a916847d4446f0dfed0c5757ea82d451124886fd6bbfa9

SHA512
b3406b2491ada91613f390a3de399bdc88196ac1396c7f50cd8a2eb9323c165f3ee831ccc02a614fcbf3fc280e310951237d0614c40e0317b5dc0d11a238a00d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
eeb31229d5476a83ee9a81333314c18a

SHA1
5e884f70927058b6c0ed85747bbb34f3ba3bc037

SHA256
5267ea888c4bd2bc27b4f35d86b16427c875eba8824a810988ee757a740792b5

SHA512
05e28482b0d9dc335ca417a71cc8903697104e041f3d25c6c5f8bca63554cff9b362e6696644dc96e2bf350c3a4e5774496ef1b51e7d041f79b612a60fb10bc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
875B

MD5
2cb7b2e7b8264c53360a076abf3b84b2

SHA1
389b8768d59ddaaab96d07629555385dd80bba32

SHA256
188a6f03f8b9f7d45b35491c3b4cb7a79a821efe9dcb5828d348e65f06ed8904

SHA512
2b454e1e607684621941592bc4732fca7fffbc83c3eeba51fc69400d04472ff93a2ccf60e03854c92e2fe11fbcfb162e3fde5a685d98c240eb8a32217fd2ee5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9d85c7c0fd907612730f28ac030e5fa4

SHA1
65c49fa562d2b0c447943981a3c0e45da6cbe7b3

SHA256
e1ff2a5bf4a67378f2721911cfe946390d39af3a66c8089f4398c8dffa720911

SHA512
6814499936464682a2c0ccbc75f413947ceb49f471c99d1c42e32a69fd20841159865d5a63460c58db4894f0d8e4a0788338a34a8fb689bd81eb537d1b2c2d02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
875B

MD5
37e2afb9d2b4efbf7b5c9a08cc1d0208

SHA1
1b836bca48bbf2938c10c504de61be8ea681d007

SHA256
ad3aaa049622e0fa5933a6c2a51320c753beadbe66aaebe6cb6a2488a9971183

SHA512
9792d18674509c39b313acb36b34c7309348ca74e621a579a4bb2d6b4f96160c297a20120aa39613c5658d4e3ebddbd487ab7eef78a91d6b292b0efe7d20278a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
346c5f29853e4da77b5d0ef1d6b8bfd5

SHA1
890a5a8f20f746bb2da8f7b92a42cf9f1d73a745

SHA256
5f44279cbfb5155005d3029c327474802f967148f54d3bf2e166d54b4b2903c4

SHA512
2fe8558e3e9766a2c657fc2793ea5b2e901df8d8b58833f0870ec477357e18c1b415665d8159d59b7f7acb02c32b6c4e18543a53b6a168e863bb5aa3f383c8c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a09f446fa97e540da2fd2fbdfc51c703

SHA1
4f99c5c6f7b201075dadd9d20c4dd5beefa07092

SHA256
1bb70873533867667f67c03c9376c4b5a35512da3864e3f79b44ba608983c9f9

SHA512
5168226ef3c3032ee12de89f167305802168790e057d2e2c987f0ed3b60a21226bb1198e7ed854c9a1778b997252e737ca879a857e51ff885e1a4fb83ea4af71

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
07961430bf23f3762b38ac187e2bc207

SHA1
896eb74425e30559963946b97912c3e80bea4a28

SHA256
b7dc8e690ca18d5a49ecd72265d545c2c2968f24bcddbdef3c151564582ec23a

SHA512
90c466e92d8afa462e4eeb7408b5f918f0eabcc568341c2f388651ea5564c1f2589d0d178a6b1b0f4a270092be870ab18fabf9daceee766c3ddbccc3b870dd19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
848f932607c2faa0c845d64b9dfd9831

SHA1
1c57e09fceb1899b5e4ad9f9dfd35eba513f8751

SHA256
26062cea69fceefd359e334e4e6f3bad7196686afc6297ccf054fb40f2c87a39

SHA512
4a039db206b2575f8555f2e54f20ed85443ead747096ce359bdf7cd75f4ae33b5b37aad109123cf217f97c5efe9b5b986783201413b543d79e80c8345c245185

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\fc90dd3b-b9f1-4a78-a9cc-f5765a057f1c\index-dir\the-real-index

Filesize
624B

MD5
05ea994bc344a69e09fae2d1506ea82f

SHA1
79ad1d5f0de70bc998cb5af51ec0744d7e6707a7

SHA256
c69287c4ecc3775fbf145846aef4b8591425a660a206eabbe8895955e32d728f

SHA512
29d531092e7bc630c79017fec867a411b2924402fcf1dd9650300f0739457ceb29099534cb49276d98c0805f0a334812e74d4cb4ec02b3bac6db5b8cb80ed4c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\fc90dd3b-b9f1-4a78-a9cc-f5765a057f1c\index-dir\the-real-index~RFe57510e.TMP

Filesize
48B

MD5
91ec563d002c575fefcca60daebd08f8

SHA1
fad9bae5f9cd108a2a12c120b7a7f10f354310fa

SHA256
f8447e10743b1e710510943dcc09f6fbf9d6b4d9eeef59693ddc82d41276c402

SHA512
65121ff14ef1ab67109f7a375bd5547224f0660407ea5717422964c86ddd79d58d99a7b296cb61a880a4253a4876f79f976f8450facf37930b1c7297132baaad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
125B

MD5
c4520ac8940ff4d64d42e98532b7dda2

SHA1
c0a60e1180ea6d1eb42618968d783637bd42d04d

SHA256
8d681cb0e791fee7b07e7a8302558e03c6b6b271b851f8f9f4d9e960c407ba74

SHA512
20213db5e58a5ec7a4075262b79dd688474b7b7952e9d41210655782a07a0f80600d2ba131bbeba789a60a09ac51ff5b38def81a9e5430e9e33af5bc44ecc1ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
129B

MD5
d06cfc26e1f925da0514d969456d962d

SHA1
f739684ea15114fad0df72d852c28c55b43fe0d2

SHA256
8967fec1de8b06da87556943de97a870f6d15df365601e722d76c8d2a1d38fa0

SHA512
8fc84500b18dc256ba9bc383af1953fec846744389986a2ed8543eb05bf03ad66b1e761d860403d479da485a78356e5ee95eb926ebf2f59e2f56db7470566215

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe569d00.TMP

Filesize
120B

MD5
e9b364f2a1859c3d73da0dfc3e3d13e7

SHA1
285d6e4408e928584f5d2b7bd5c6c22d48853e30

SHA256
1016dc824b0deb251be10cc201e02c8edfb763e1157b9b6c1a1f501cf25406dc

SHA512
7b9b2afd728259c365a4c002dd6c97f23e1c0135a476f02746834dfb83e88248e43b76b8c99d02b6c85d24544b69e3b4779eeea7c4fe707e6d41266325546d76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
65744c7190e9ac395ae55495469ddadf

SHA1
34d9a77a7ad13bcbce620745a02e31db441c94ce

SHA256
d96d4b5abc23b188754bb7e1462299320b45838173de92640ec2c6b5fb7359ce

SHA512
94103be8ab8555225e27b1a771f4227aa66a26a590aaaf97f0e47d76f84a664b29e94eef7f851b768e5ec2b7a0ba2355aeeffa35076ddae1c4eabaf9a3f9cb92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe56fa33.TMP

Filesize
48B

MD5
b472c31e727d3fa7eb9baac3809e1952

SHA1
727e156f7bd02894291c7178d015cb9d2d93ec97

SHA256
89d9452cd58bd93321780131bed1d6bda14db379be92c112446583ec8fb08617

SHA512
c2ecccf53aa6a605bfde9fc6b8a009ede72bf55983a4014918e8dbc7e3ae987d9517307df41b8ad4c2ae3da1edcc358091403d60e703f03acb86a3a8438f19a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3368_1315749712\Icons Monochrome\16.png

Filesize
216B

MD5
a4fd4f5953721f7f3a5b4bfd58922efe

SHA1
f3abed41d764efbd26bacf84c42bd8098a14c5cb

SHA256
c659d57841bb33d63f7b1334200548f207340d95e8e2ae25aac7a798a08071a3

SHA512
7fcc1ca4d6d97335e76faa65b7cfb381fb722210041bdcd3b31b0f94e15dc226eec4639547af86ae71f311f52a956dc83294c2d23f345e63b5e45e25956b2691

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3368_1470128650\Shortcuts Menu Icons\Monochrome\0\512.png

Filesize
2KB

MD5
12a429f9782bcff446dc1089b68d44ee

SHA1
e41e5a1a4f2950a7f2da8be77ca26a66da7093b9

SHA256
e1d7407b07c40b5436d78db1077a16fbf75d49e32f3cbd01187b5eaaa10f1e37

SHA512
1da99c5278a589972a1d711d694890f4fd4ec4e56f83781ab9dee91ba99530a7f90d969588fa24dce24b094a28bdecbea80328cee862031a8b289f3e4f38ce7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3368_1470128650\Shortcuts Menu Icons\Monochrome\1\512.png

Filesize
10KB

MD5
7f57c509f12aaae2c269646db7fde6e8

SHA1
969d8c0e3d9140f843f36ccf2974b112ad7afc07

SHA256
1d5c9f67fe93f9fcc1a1b61ebc35bda8f98f1261e5005ae37af71f42aab1d90f

SHA512
3503a0f4939bed9e1fd5e086b17d6de1063220dffdab2d2373aa9582a2454a9d8f18c1be74442f4e597bdba796d2d69220bd9e6be632a15367225b804187ea18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
4ad13b183c275de84b4b95904bdbfd1e

SHA1
1d686193c9ba721c132ab3013c7037680dcab41e

SHA256
cd0579f716844f972c457fac5333af8eaae3714e386bdd790af55dba5c1e5deb

SHA512
1678bce561dc73fa3e9908263761abbdafece9ea4f13b0bd5bd6bb3dd3333402a7d93057d739141c8e787681a312ab39b03ea87683fd54cc9f625ef0efb3e55f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit