hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/TaskILL[.]exe

Analysis

max time kernel
94s
max time network
67s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
28-05-2023 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/TaskILL.exe

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133297621872685576"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe
4804	TaskILL.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeShutdownPrivilege	2264	chrome.exe
Token: SeCreatePagefilePrivilege	2264	chrome.exe
Token: SeDebugPrivilege	4804	TaskILL.exe
Token: SeDebugPrivilege	3216	TaskILL.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe
2264	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2292	2264	chrome.exe	66
PID 2264 wrote to memory of 2292	2264	chrome.exe	66
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 1408	2264	chrome.exe	69
PID 2264 wrote to memory of 2692	2264	chrome.exe	68
PID 2264 wrote to memory of 2692	2264	chrome.exe	68
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70
PID 2264 wrote to memory of 4744	2264	chrome.exe	70

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/TaskILL.exe
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff845919758,0x7ff845919768,0x7ff845919778
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1704,i,18376897298707200954,1563384022624885776,131072 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1704,i,18376897298707200954,1563384022624885776,131072 /prefetch:2
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1704,i,18376897298707200954,1563384022624885776,131072 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1704,i,18376897298707200954,1563384022624885776,131072 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1704,i,18376897298707200954,1563384022624885776,131072 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 --field-trial-handle=1704,i,18376897298707200954,1563384022624885776,131072 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 --field-trial-handle=1704,i,18376897298707200954,1563384022624885776,131072 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5088 --field-trial-handle=1704,i,18376897298707200954,1563384022624885776,131072 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5048 --field-trial-handle=1704,i,18376897298707200954,1563384022624885776,131072 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 --field-trial-handle=1704,i,18376897298707200954,1563384022624885776,131072 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5020 --field-trial-handle=1704,i,18376897298707200954,1563384022624885776,131072 /prefetch:8
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5024 --field-trial-handle=1704,i,18376897298707200954,1563384022624885776,131072 /prefetch:8
  2⤵
  PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1704,i,18376897298707200954,1563384022624885776,131072 /prefetch:8
  2⤵
  PID:4508

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1128

C:\Users\Admin\Desktop\TaskILL.exe
"C:\Users\Admin\Desktop\TaskILL.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Users\Admin\Desktop\TaskILL.exe
"C:\Users\Admin\Desktop\TaskILL.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Users\Admin\Desktop\TaskILL.exe
"C:\Users\Admin\Desktop\TaskILL.exe"
1⤵
PID:2144

C:\Users\Admin\Desktop\TaskILL.exe
"C:\Users\Admin\Desktop\TaskILL.exe"
1⤵
PID:3296

C:\Users\Admin\Desktop\TaskILL.exe
"C:\Users\Admin\Desktop\TaskILL.exe"
1⤵
PID:5032

C:\Users\Admin\Desktop\TaskILL.exe
"C:\Users\Admin\Desktop\TaskILL.exe"
1⤵
PID:3304

C:\Users\Admin\Desktop\TaskILL.exe
"C:\Users\Admin\Desktop\TaskILL.exe"
1⤵
PID:1460

C:\Users\Admin\Desktop\TaskILL.exe
"C:\Users\Admin\Desktop\TaskILL.exe"
1⤵
PID:4900

C:\Users\Admin\Desktop\TaskILL.exe
"C:\Users\Admin\Desktop\TaskILL.exe"
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5cab65ce5f8ce44bac1cf56111515d9f

SHA1
e35e91bb685142bd23f784f2f62e403f506fd0f5

SHA256
34082b53663f51a7ade17daa2437ae7fb028a6d3aaa6a0456576d6e4c89e0574

SHA512
6f5e7db893d1a96e806fbbb107d9802b0272bb307dfec62207130ccad5e2e82dafc3751d0f4f48795f0ca634fabc2d2e80f427ffad51668fd0de2583819780ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
79f283d47a6f81ba8d12bb40493bac88

SHA1
ab4f84950d32cd459263434d7a174582dc13e240

SHA256
45f4f591c721641a9b6d27ff87bf7cb204a7ae1f43904e025e9c0cc74aa3f105

SHA512
ef03d974038f0c078c0025889e3955f4b53ff13d3c4574ae1b1e82a95acbdb612c4928987ef9a0f2edd7e0806279a4bd808365011b884b0a97f51097a4734cc7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
9c22431c336bda44bb702bfdfafc6c6e

SHA1
1138a9b043d4b2db789a992a11d7b5e865aaec5f

SHA256
ff3c4ae921850dc087010a0e6fcaea8095d510748b2b4a131e3c32fceceb464c

SHA512
67f2dffae1846a651d5bb6ad28bed0bf37c70d945a42f0d27dbf59f062dd110560a3f0e18270f0374949a9f0939be11c90c465eae7bbbb808e5ca5c9df9158ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ea9c745356630a4a42c61fff672f55c7

SHA1
fc67138ae40116855e80300e55e2b923789b97df

SHA256
a0ff069d4ad9b697af6763c423a9550669a2aab623b8a332ed6d2af3256ee434

SHA512
33328cc6b4baeddec4ee5e20703cc9dde0c47360c72dffbcca4dd152f9bfa6efb711da0a4c989322bb8cd7a2de5ce2fc3df9cf91348f76f2d47da6336406b186

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c25f57cc4dffbc8da30b3cc545139d34

SHA1
f94a37690761a318085b91da2a0b3a6cc233e7f0

SHA256
494748d1c7e5369939fe192f0bb0f3cdb0b9bf61401b53b8f668e452981d0765

SHA512
b2ee82212f1d8dc95653f50f62326147402f8ced5c23f65070710bb97ce65a8b1641e61d52bb2e381d8463333e0802dbb52df8770d37f9bd0385807d3a76a575

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
e78bb103192988ddb2841acb4401c53c

SHA1
058f3bcbf843ae8683ebc77f0c709fd98ff7a719

SHA256
d35c4894bea5d7b145a14af569f6a7c98b936873fbd604f5c19305be824bdbc7

SHA512
8a4c82cf3fef1795b615cc1ab5f0161a926a4f600e5cc514d6cdbfb4ecbbe160e0168f8a4985beec0b5d746ffb5bf63dadd473a85d7337d7cdb7469c3c04048c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
ef3e30840d17106596b0f3713ee41e13

SHA1
cf718142c5b4b68be08a38b717d972f398958999

SHA256
95a067d03a4b5dae1d646948ea8001a5df72266f79770ef95a9f2212cff4fa03

SHA512
e90ee34e1fbc165900e614568f08d86288559da6112df8a9d109088102ecc6b9eff3b93c9ab68f7d5156858e00308f3ab17ff4fa359b98313eb01035080d7d78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
bd1fae73a885b1b7c698293cea6bfb60

SHA1
148084b808477fdc80f3885e7049fd42a5cf397d

SHA256
4745dfc4da3f2e68a14fe47b61a089d941ab264923cbdda0d5f22e63a71e9035

SHA512
f6a1dcdd4ca78a7bdb45cb837d009ea1e1fd117da3bfb6dfc64d369efa772ca407f016e32fa0cc108793d61cd3aad91c30c87cc589f01485f4c4e360a68422e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
153KB

MD5
02b3e3cba9c2a2099d5dc6e5471e06ac

SHA1
fdd25cc5b0c8c9aa510c66cb970cde7f323c29b1

SHA256
725d9b5a5471efa15fc931e454041c8fced049523f504e0025d1f029d5f3c3af

SHA512
8ccd661ed3d6ba32b809706d5d048d78aa391120aa7ef97f30bae28b8b0d45c3b1e8024905f1281813f710ab5dffdb8859860c3d194e5080e6dc94ce711099c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
153KB

MD5
dfef0570cb4983f3ef60db1539653474

SHA1
b0d59bf441528abdbab77401a963645e9a47ff5a

SHA256
23bcc3f0ec2b4136fcc026cbd15c64d22b3896dd9d2fb5a1242b745eadc0d51d

SHA512
e3bae433b073c7a4080a3ecaa3381b5e1dc65bc57626417fd1809a4a01537d23519f03e5dbb451dcbb04987c3d72cd49c263acc28566983d2a0cf15a6a51dad0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\TaskILL.exe

Filesize
31KB

MD5
c261c6e3332d0d515c910bbf3b93aab3

SHA1
ff730b6b2726240df4b2f0db96c424c464c65c17

SHA256
4663715548c70eec7e9cbf272171493d47a75d2652e38cca870412ea9e749fe9

SHA512
a93bd7b1d809493917e0999d4030cb53ab7789c65f6b87e1bbac27bd8b3ad2aeb92dec0a69369c04541f5572a78f04d8dfba900624cf5bd82d7558f24d0a8e26

Download Submit
memory/2144-357-0x000000001ACF0000-0x000000001AD00000-memory.dmp

Filesize
64KB

Download
memory/3216-356-0x00000000016A0000-0x00000000016B0000-memory.dmp

Filesize
64KB

Download
memory/3216-363-0x00000000016A0000-0x00000000016B0000-memory.dmp

Filesize
64KB

Download
memory/3296-358-0x0000000002280000-0x0000000002290000-memory.dmp

Filesize
64KB

Download
memory/3304-360-0x0000000002100000-0x0000000002110000-memory.dmp

Filesize
64KB

Download
memory/4116-362-0x000000001ADB0000-0x000000001ADC0000-memory.dmp

Filesize
64KB

Download
memory/4804-355-0x000000001ACE0000-0x000000001ACF0000-memory.dmp

Filesize
64KB

Download
memory/4804-354-0x0000000000040000-0x000000000004E000-memory.dmp

Filesize
56KB

Download
memory/4900-361-0x0000000002C90000-0x0000000002CA0000-memory.dmp

Filesize
64KB

Download
memory/5032-359-0x0000000001090000-0x00000000010A0000-memory.dmp

Filesize
64KB

Download