socelars | 8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2023 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Size

600KB
MD5

adf3f9eb71d9777153e35549006dd8f3
SHA1

3fa3b8175e764fdd3fee4bd447e8f7c840154e65
SHA256

8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7
SHA512

4586569432ed579e23963423918f48500cca852cae3f1edf91e4f4ced0d23a86176f771299d426e5f04f09649a43546534c01169b3136bef3306f820198d7e30
SSDEEP

12288:xnYfLNWN/O20iI4l8TsJYujO3JQ7OLWs5v2j9aaWUTy:xnYzNW4JCawOyCsjP

Score

10^/10

socelars spyware stealer

Malware Config

Extracted

Family

socelars

http://www.iyiqian.com/

http://www.xxhufdc.top/

http://www.uefhkice.xyz/

http://www.wygexde.xyz/

Signatures

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2600-643-0x0000000000400000-0x0000000000581000-memory.dmp	family_socelars
behavioral2/memory/2600-1205-0x0000000000400000-0x0000000000581000-memory.dmp	family_socelars

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops Chrome extension 1 IoCs

Processes:

8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\manifest.json	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2928 taskkill.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

664 chrome.exe
664 chrome.exe
2956 chrome.exe
2956 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

664 chrome.exe
664 chrome.exe
664 chrome.exe
664 chrome.exe
664 chrome.exe

pid	process
2928	taskkill.exe

pid	process
664	chrome.exe
664	chrome.exe
2956	chrome.exe
2956	chrome.exe

pid	process
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe
664	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exetaskkill.exechrome.exe

description	pid	process
Token: SeCreateTokenPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeAssignPrimaryTokenPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeLockMemoryPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeIncreaseQuotaPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeMachineAccountPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeTcbPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeSecurityPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeTakeOwnershipPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeLoadDriverPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeSystemProfilePrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeSystemtimePrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeProfSingleProcessPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeIncBasePriorityPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeCreatePagefilePrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeCreatePermanentPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeBackupPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeRestorePrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeShutdownPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeDebugPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeAuditPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeSystemEnvironmentPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeChangeNotifyPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeRemoteShutdownPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeUndockPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeSyncAgentPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeEnableDelegationPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeManageVolumePrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeImpersonatePrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeCreateGlobalPrivilege	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: 31	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: 32	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: 33	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: 34	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: 35	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe
Token: SeCreatePagefilePrivilege	664	chrome.exe
Token: SeShutdownPrivilege	664	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

chrome.exe

pid process

664 chrome.exe
664 chrome.exe

pid	process
664	chrome.exe
664	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.execmd.exechrome.exe

description	pid	process	target process
PID 2600 wrote to memory of 5084	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe	cmd.exe
PID 2600 wrote to memory of 5084	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe	cmd.exe
PID 2600 wrote to memory of 5084	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe	cmd.exe
PID 5084 wrote to memory of 2928	5084	cmd.exe	taskkill.exe
PID 5084 wrote to memory of 2928	5084	cmd.exe	taskkill.exe
PID 5084 wrote to memory of 2928	5084	cmd.exe	taskkill.exe
PID 2600 wrote to memory of 1748	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe	xcopy.exe
PID 2600 wrote to memory of 1748	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe	xcopy.exe
PID 2600 wrote to memory of 1748	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe	xcopy.exe
PID 2600 wrote to memory of 664	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe	chrome.exe
PID 2600 wrote to memory of 664	2600	8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe	chrome.exe
PID 664 wrote to memory of 4184	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 4184	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 3340	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 1940	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 1940	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 2484	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 2484	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 2484	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 2484	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 2484	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 2484	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 2484	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 2484	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 2484	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 2484	664	chrome.exe	chrome.exe
PID 664 wrote to memory of 2484	664	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe
"C:\Users\Admin\AppData\Local\Temp\8e1583365db274efce4b128f48402afff97bbdca14340b2e41a26ec22bf26ad7.exe"
1⤵
- Drops Chrome extension
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:5084

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Windows\SysWOW64\xcopy.exe
xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
2⤵
PID:1748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd0dbb9758,0x7ffd0dbb9768,0x7ffd0dbb9778
3⤵
PID:4184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1868,i,15177484950517325044,6024222846943562596,131072 /prefetch:2
3⤵
PID:3340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2144 --field-trial-handle=1868,i,15177484950517325044,6024222846943562596,131072 /prefetch:8
3⤵
PID:1940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2252 --field-trial-handle=1868,i,15177484950517325044,6024222846943562596,131072 /prefetch:8
3⤵
PID:2484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3428 --field-trial-handle=1868,i,15177484950517325044,6024222846943562596,131072 /prefetch:1
3⤵
PID:4364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3168 --field-trial-handle=1868,i,15177484950517325044,6024222846943562596,131072 /prefetch:1
3⤵
PID:1052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1868,i,15177484950517325044,6024222846943562596,131072 /prefetch:1
3⤵
PID:3892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1868,i,15177484950517325044,6024222846943562596,131072 /prefetch:1
3⤵
PID:3228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4896 --field-trial-handle=1868,i,15177484950517325044,6024222846943562596,131072 /prefetch:1
3⤵
PID:4020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5072 --field-trial-handle=1868,i,15177484950517325044,6024222846943562596,131072 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2956

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1928

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\background.html
Filesize
786B

MD5
9ffe618d587a0685d80e9f8bb7d89d39

SHA1
8e9cae42c911027aafae56f9b1a16eb8dd7a739c

SHA256
a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

SHA512
a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\icon.png
Filesize
6KB

MD5
c8d8c174df68910527edabe6b5278f06

SHA1
8ac53b3605fea693b59027b9b471202d150f266f

SHA256
9434dd7008059a60d6d5ced8c8a63ab5cae407e7152da98ca4dda408510f08f5

SHA512
d439e5124399d1901934319535b7156c0ca8d76b5aa4ddf1dd0b598d43582f6d23c16f96be74d3cd5fe764396da55ca51811d08695f356f12f7a8a71bcc7e45c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\aes.js
Filesize
13KB

MD5
4ff108e4584780dce15d610c142c3e62

SHA1
77e4519962e2f6a9fc93342137dbb31c33b76b04

SHA256
fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

SHA512
d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\background.js
Filesize
15KB

MD5
3f906a68fa9a6d7f98da3724187912b6

SHA1
16f5ba4562b13146146d18ab2c48cd0127e1a18f

SHA256
aca463d9322b6aed317c308d9588471ee3ceb8e05ac1dee3ef36dc02e4ff2ad7

SHA512
3d4041dc5abebb4dde393155cb4a5266b6ae4d68c20e9c45d88ed1f2eba4afc06f3f195a1e6363674b09f9d5bc7338398930fa186028b140c8f4dfd024c1a0a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\content.js
Filesize
26KB

MD5
029c53effaed86331055c63d264c3316

SHA1
859bb39d27b462a73fc9131f694b69c8c118b3cf

SHA256
3c1453cb6fe4c7ae8945d96db6c19e3eb58702df65ee0244f8f2444b20e93068

SHA512
68d115d79428c906ca377091f30c207de92ee9450e22e94a35fd7753547cb582ae36434595f1c0e444bb19d5c6dcc214fe58a9987f690486800c8ad91c9642d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\jquery-3.3.1.min.js
Filesize
84KB

MD5
a09e13ee94d51c524b7e2a728c7d4039

SHA1
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

SHA256
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

SHA512
f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\mode-ecb.js
Filesize
604B

MD5
23231681d1c6f85fa32e725d6d63b19b

SHA1
f69315530b49ac743b0e012652a3a5efaed94f17

SHA256
03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a

SHA512
36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\js\pad-nopadding.js
Filesize
268B

MD5
0f26002ee3b4b4440e5949a969ea7503

SHA1
31fc518828fe4894e8077ec5686dce7b1ed281d7

SHA256
282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d

SHA512
4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\manifest.json
Filesize
1KB

MD5
6c60a1967cbc43f39c65d563fd100719

SHA1
a90467bcbc38e0b31ff6da9468c51432df034197

SHA256
6afb68b31d74314a31e752c8e0b8bc36946ef783fdc68a0b072e2632a2b752b5

SHA512
91c23ea68ffaa5b5786b3120e78607042fa5fbd00369f36b4719a5bf8eaf480a94b87115df4cc66db5abf419cb57495093f2023b1b9f6d30a85214fc3d347aa3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
18KB

MD5
975563c63a435f0909a15ef540d37391

SHA1
46cf6a6d1b870ddec8767c884d48f7568af5f23f

SHA256
44651e1d2a478a2d7acee4ce1d12a2e0ef0ad8e7aa84d9ee85c400cfcf7a3a5e

SHA512
ea770a6497b4c23dfae8a6e4f0fef9bdf8ac3db0dbfc992b93071eb16d2833ef49269da0ce76edba35c6d1cf876d51545210750b0d2fb8b3f7c8aaae82f9be23

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\CrashpadMetrics-active.pma
Filesize
1024KB

MD5
03c4f648043a88675a920425d824e1b3

SHA1
b98ce64ab5f7a187d19deb8f24ca4ab5d9720a6d

SHA256
f91dbb7c64b4582f529c968c480d2dce1c8727390482f31e4355a27bb3d9b450

SHA512
2473f21cf8747ec981db18fb42726c767bbcca8dd89fd05ffd2d844206a6e86da672967462ac714e6fb43cc84ac35fffcec7ddc43a9357c1f8ed9d14105e9192

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad\settings.dat
Filesize
40B

MD5
a585eb2d83cd802e066ccef3bb88d092

SHA1
09e95904f834489ae85ac2007025e4bfe6f3016b

SHA256
0cfb17e6a2ab35d61855c36307258d7f5bd683b0530198c52d2637f1b878926f

SHA512
eb63f7996b69835c10b42ea0b45c40f9eff5aeb25adadfa8707228377a537d37241661fa21bf514e7f4a4f63e3ab0bbb226dfef7e6ec1bef08b61305fa833a9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad\settings.dat
Filesize
40B

MD5
a585eb2d83cd802e066ccef3bb88d092

SHA1
09e95904f834489ae85ac2007025e4bfe6f3016b

SHA256
0cfb17e6a2ab35d61855c36307258d7f5bd683b0530198c52d2637f1b878926f

SHA512
eb63f7996b69835c10b42ea0b45c40f9eff5aeb25adadfa8707228377a537d37241661fa21bf514e7f4a4f63e3ab0bbb226dfef7e6ec1bef08b61305fa833a9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Affiliation Database
Filesize
32KB

MD5
69e3a8ecda716584cbd765e6a3ab429e

SHA1
f0897f3fa98f6e4863b84f007092ab843a645803

SHA256
e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

SHA512
bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\data_0
Filesize
44KB

MD5
7280d43ab0edae40edf7119560296800

SHA1
ebb46e71eb13ef998ee72863177f47b2182e3efb

SHA256
8ce964da79c1acb0e6555a05368e21705e547ee7f44e194719fe509a2ac0a79c

SHA512
b46a65713053d5e10aeb78b48a347ec0ca4b3725eab55b9e5164ba5a0cf54e94dfc4227549fd9380aa4e9f2c671467359186f9ccf0915134f2ac0c5f9021c290

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\data_1
Filesize
264KB

MD5
fcbc8095025b8e1628dbd5a232afd453

SHA1
5bcd78a79a42fbfc9a482108712cfc561cf771de

SHA256
848d4f485b91de0eb1b2e4dce35edafff41a927e456ce8649a98a4107c288d01

SHA512
e80018f1a93c6c5d146e2b98d2347d3094bff00390d8692cd174395560bccea3ca1cf5b4117652e3f4f3537f66e24ea6eb21728a8386199668f8c4a0da039ead

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\data_2
Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\data_3
Filesize
4.0MB

MD5
0a8e9a79c7f12d667e6f44307991095e

SHA1
9a89a0d715e9daf173618149e5601e723d64b9f7

SHA256
15ac6c62446125fb84fd536dbc12ad2809b11bfb60515254cb54dba2e3bace0b

SHA512
33293a86a75bea444a403f14965f4efa9933efac1695e207f1663ada42004672316612a3ada9bccd1abba9d6d9fe90b2d66637a308beac7345d30126e29b77d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000002
Filesize
53KB

MD5
908f31d9161795706460bdfe9198329e

SHA1
be109906a6f29f66183eb3279a5c10341104f928

SHA256
144d8ca174b9d23cf9c86310cc8b8389d3c20959d13cbf68d5686158ea2495f2

SHA512
95732f15a85c1b4221fd040941472c557a236d9cda760a3975db33eb0e1cd81994606de76563e8913ff15ff7b8c247ef4f891205abc1b3dfd6157d910637eb60

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000003
Filesize
39KB

MD5
8877fbc3201048f22d98ad32e400ca4a

SHA1
993343bbecb3479a01a76d4bd3594d5b73a129bd

SHA256
22f8221159c3f919338da3a842d9a50171ddc5ac805be6239bd63e0db78046af

SHA512
3dfb36cd2d15347eaa3c7ae29bfa6aa61638e9739174f0559a3a0c676108ccc1a6028f58dad093d6b90cac72b4468eb1d88b6414339555c9f872a5638271d9c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000004
Filesize
37KB

MD5
8685e309b262e84eeed6d7817005e5a3

SHA1
17c64e178a4f0d37052f36361ed7ee38a2fabd7a

SHA256
f9ff57686f9f79f7aa5872c05be3c15d5746f571a8770e2a8eab6ceb827a9136

SHA512
cbf6c33497d4c4f4a385018ccf6eb15558be35e4d84a39dc156f3b1a585161ccfbdb854bf83490dc5e270990734225050900848418479c43c8a029cf3d50b5a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000007
Filesize
21KB

MD5
3669e98b2ae9734d101d572190d0c90d

SHA1
5e36898bebc6b11d8e985173fd8b401dc1820852

SHA256
7061caa61b21e5e5c1419ae0dc8299142ba89c8169a2bd968b6de34a564f888a

SHA512
0c5f0190b0df4939c2555ec7053a24f5dae388a0936140d68ed720a70542b40aaf65c882f43eb1878704bea3bd18934de4b1aac57a92f89bbb4c67a51b983ae3

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000008
Filesize
20KB

MD5
c1164ab65ff7e42adb16975e59216b06

SHA1
ac7204effb50d0b350b1e362778460515f113ecc

SHA256
d7928d8f5536d503eb37c541b5ce813941694b71b0eb550250c7e4cbcb1babbb

SHA512
1f84a9d9d51ac92e8fb66b54d103986e5c8a1ca03f52a7d8cdf21b77eb9f466568b33821530e80366ce95900b20816e14a767b73043a0019de4a2f1a4ffd1509

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000009
Filesize
34KB

MD5
b63bcace3731e74f6c45002db72b2683

SHA1
99898168473775a18170adad4d313082da090976

SHA256
ea3a8425dcf06dbc9c9be0ccd2eb6381507dd5ac45e2a685b3a9b1b5d289d085

SHA512
d62d4dddb7ec61ef82d84f93f6303001ba78d16fd727090c9d8326a86ab270f926b338c8164c2721569485663da88b850c3a6452ccb8b3650c6fa5ce1ce0f140

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_00000a
Filesize
16KB

MD5
9978db669e49523b7adb3af80d561b1b

SHA1
7eb15d01e2afd057188741fad9ea1719bccc01ea

SHA256
4e57f4cf302186300f95c74144cbca9eb756c0a8313ebf32f8aba5c279dd059c

SHA512
04b216bd907c70ee2b96e513f7de56481388b577e6ccd67145a48178a605581fab715096cfb75d1bb336e6ad0060701d2a3680e9f38fe31e1573d5965f1e380a

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_00000b
Filesize
49KB

MD5
55abcc758ea44e30cc6bf29a8e961169

SHA1
3b3717aeebb58d07f553c1813635eadb11fda264

SHA256
dada70d2614b10f6666b149d2864fdcf8f944bf748dcf79b2fe6dad73e4ef7b6

SHA512
12e2405f5412c427bee4edd9543f4ea40502eaace30b24fe1ae629895b787ea5a959903a2e32abe341cd8136033a61b802b57fe862efba5f5a1b167176dd2454

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_00000c
Filesize
61KB

MD5
22d7a7807a73c982b3a4ac128fbce1f4

SHA1
b9e581a120aadc2b788173cad1a681a5c82d6d21

SHA256
5e7eca67f6131d070c1b625b30e5da8d8ad41ae7a9fdc2e94ff75c7f4356d007

SHA512
cdcbeb20355618233fa17179960f4577bb20decc2047ea8a6afd98505cae71699e0a3cbd78a432948f898e0c12781ed346f30322df6008f804ba3c1c018536b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_00000d
Filesize
46KB

MD5
beafc7738da2d4d503d2b7bdb5b5ee9b

SHA1
a4fd5eb4624236bc1a482d1b2e25b0f65e1cc0e0

SHA256
bb77e10b27807cbec9a9f7a4aeefaa41d66a4360ed33e55450aaf7a47f0da4b4

SHA512
a0b7cf6df6e8cc2b11e05099253c07042ac474638cc9e7fb0a6816e70f43e400e356d41bde995dce7ff11da65f75e7dc7a7f8593c6b031a0aa17b7181f51312f

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_00000e
Filesize
46KB

MD5
621714e5257f6d356c5926b13b8c2018

SHA1
95fbe9dcf1ae01e969d3178e2efd6df377f5f455

SHA256
b6c5da3bf2ae9801a3c1c61328d54f9d3889dcea4049851b4ed4a2ff9ba16800

SHA512
b39ea7c8b6bb14a5a86d121c9afc4e2fc1b46a8f8c8a8ddacfa53996c0c94f39d436479d923bf3da45f04431d93d8b0908c50d586181326f68e7675c530218ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_00000f
Filesize
37KB

MD5
01ef159c14690afd71c42942a75d5b2d

SHA1
a38b58196f3e8c111065deb17420a06b8ff8e70f

SHA256
118d6f295fd05bc547835ba1c4360250e97677c0419c03928fd611f4f3e3104b

SHA512
12292194bb089f50bb73507d4324ea691cc853a6e7b8d637c231fadb4f465246b97fd3684162467989b1c3c46eabb3595adb0350c6cf41921213620d0cff455b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\index
Filesize
512KB

MD5
a78ebbf050864d70b027d8db1b8734aa

SHA1
a0de58684b98ad27091f0ec51c27696b2e574ba2

SHA256
db6b8290074f46c5a9ec06a613166383f6c9a817405dfd73ad275ba393f4ef44

SHA512
e9d499e428eed3df600e35d2f4772606340db56c069cb0d5b4c2d2c791a7c54a57930b5aaacbdc98a4b8d3cf4c876f954e0948d3844542c952806f1ab8abe8fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\index-dir\the-real-index
Filesize
48B

MD5
a39448579097b9271b18cad75dbbb702

SHA1
6dc1303d4586538e3eea33ef6652afabd153679d

SHA256
1c39144796632d2ddf640f8c5e4d5c22e0285a131f0a57c0f43ebd1f578c16ee

SHA512
90ff5310ccc79208568ffe00a0315144e7e2608220d7dc885de3ba7882ede8de3693f884f7edbd2d993c5ac7a182d60988a413f6a96035938c00ca597e67ef47

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\index-dir\the-real-index
Filesize
888B

MD5
81c29fefac0864b38d7d901a92482eed

SHA1
120c9d79586f1b85724b3f301b58fd67163eca36

SHA256
ef85b464201d5878d1848f8ab01e751c90d2eb48f09fee1f7d0538a0a4b63ac1

SHA512
162dd359480925056cdf510b952918e4789101dfb1a000a35c9991d6b4a7244a7bec8766008a32ece07133f6393b4060ff461592121899b12df7ddfbae078a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\index-dir\the-real-index~RFe581bb1.TMP
Filesize
48B

MD5
965b7b10a15a8bc25c877abcde13a82f

SHA1
165bf645e8ef47eb64affff50c26c14306a02ed5

SHA256
46a1a8174031913c36af8c026f1c07e3487b0f06b3c9581ac5cb2884c03838e3

SHA512
0acfaadcf20a74ab18922175ebbc2bcb038a742305da324893fe7e222509be3f7e051ae96c09aff5250ec737e6bb322291553d28a01aa4187474f17b51594a8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\wasm\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\wasm\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\wasm\index-dir\the-real-index
Filesize
48B

MD5
a39448579097b9271b18cad75dbbb702

SHA1
6dc1303d4586538e3eea33ef6652afabd153679d

SHA256
1c39144796632d2ddf640f8c5e4d5c22e0285a131f0a57c0f43ebd1f578c16ee

SHA512
90ff5310ccc79208568ffe00a0315144e7e2608220d7dc885de3ba7882ede8de3693f884f7edbd2d993c5ac7a182d60988a413f6a96035938c00ca597e67ef47

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\wasm\index-dir\the-real-index
Filesize
48B

MD5
a39448579097b9271b18cad75dbbb702

SHA1
6dc1303d4586538e3eea33ef6652afabd153679d

SHA256
1c39144796632d2ddf640f8c5e4d5c22e0285a131f0a57c0f43ebd1f578c16ee

SHA512
90ff5310ccc79208568ffe00a0315144e7e2608220d7dc885de3ba7882ede8de3693f884f7edbd2d993c5ac7a182d60988a413f6a96035938c00ca597e67ef47

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\DawnCache\data_2
Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extension Scripts\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extension Scripts\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_CA\messages.json
Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_metadata\computed_hashes.json
Filesize
3KB

MD5
02c8ed2627b526edc7d74eda75b9a924

SHA1
2984ed94ccacb55d86da2e38dbc3b6b7b3ae9a25

SHA256
c4d3d374611fdb6e970a2019cde28482f8b92230941cbca6ebf7699815c152a6

SHA512
16197b17c6e244c11d1804abc5a739eca5ec05858c9784f919acd634d72b8da2d4ba12b2e68f04145c5fb6d39bdfc187b9a5bc49c60a11435163445a04ba3103

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_metadata\verified_contents.json
Filesize
18KB

MD5
2f0dde11ea5a53f11a1d604363dca243

SHA1
8eef7eb2f4aa207c06bcdd315342160ebacf64e8

SHA256
5a2940c7c5adba1de5e245dbff296d8abc78b078db04988815570ce53e553b1d

SHA512
f20305a42c93bcde345ba623fef8777815c8289fe49b3ec5e0f6cf97ee0d5b824687674d05827d6c846ee899da0d742407670db22ff0d70ebee5a481ab4a0ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
Filesize
593B

MD5
91f5bc87fd478a007ec68c4e8adf11ac

SHA1
d07dd49e4ef3b36dad7d038b7e999ae850c5bef6

SHA256
92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9

SHA512
fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json
Filesize
10KB

MD5
90f880064a42b29ccff51fe5425bf1a3

SHA1
6a3cae3996e9fff653a1ddf731ced32b2be2acbf

SHA256
965203d541e442c107dbc6d5b395168123d0397559774beae4e5b9abc44ef268

SHA512
d9cbfcd865356f19a57954f8fd952caf3d31b354112766c41892d1ef40bd2533682d4ec3f4da0e59a5397364f67a484b45091ba94e6c69ed18ab681403dfd3f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\verified_contents.json
Filesize
7KB

MD5
0834821960cb5c6e9d477aef649cb2e4

SHA1
7d25f027d7cee9e94e9cbdee1f9220c8d20a1588

SHA256
52a24fa2fb3bcb18d9d8571ae385c4a830ff98ce4c18384d40a84ea7f6ba7f69

SHA512
9aeafc3ece295678242d81d71804e370900a6d4c6a618c5a81cacd869b84346feac92189e01718a7bb5c8226e9be88b063d2ece7cb0c84f17bb1af3c5b1a3fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Favicons
Filesize
20KB

MD5
3eea0768ded221c9a6a17752a09c969b

SHA1
d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

SHA256
6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

SHA512
fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\data_0
Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\data_3
Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\index
Filesize
256KB

MD5
8e22979cb6dc7c9e7ea5928154eeed6d

SHA1
5b9aeca112ec23f96d5da55e7804a9348bf4f7b2

SHA256
01767baacbbda0727940eac3e70547cc710f28676cdcee697dc59a55001be010

SHA512
728426fbfa852945340ac9a1253c39274d8cfe238ddb97d70ecb1d76a4de79f4875ae0509aab0798a524d162cd5487aa1e462838ba25be72e374e3034b8edc34

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\History
Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Login Data
Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Login Data For Account
Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Login Data For Account
Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\Cookies
Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\Network Persistent State
Filesize
1KB

MD5
3a6ef9e2bc0b7efba89f961049970454

SHA1
d000b25aedd941d9b86ce0c105783fdc434a71a3

SHA256
9c77b403fa0f79f0a0728759ed3807db30b2d6fbd0b25a3dda895815ebbcae6f

SHA512
a58ee441f2da53f5d863f1ec973fbab577902b45b000f35b31df09b7550d217c5710e19a9336baaa7c56a49a7821efc2a50b515022eda9c6f1bcf4ee79c17331

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\Network Persistent State
Filesize
1KB

MD5
6b79a680ae5c531a849c63863b99e832

SHA1
e2804bd98d94f75c675ef1cc4b7fd6571e853925

SHA256
af8311ea4c645e5855e181602ffb4693ca5bdcb61d1c29f61a55eb7792a4eb0f

SHA512
0c31fdcd8b4fd2547fe104d967ecb7689bfcf74b76c6e76cc090ab2455fd410581e1b8771f8535294779f9230292b4d78048979273a86cbce51ff65059f3ec40

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\Network Persistent State
Filesize
1KB

MD5
7ed4327b84d5d03767480281f93f5e99

SHA1
bdc752d77a91c16efb3b69f0656ccca1ad0236ca

SHA256
5b29c29f07bb38aa4da8290afcadf0987e129794b52fe417b0ca8ce7b963843e

SHA512
6ac599cf7d646d2113c8ee08bd255efe3f7ca57d04315be7447b8f655e8899f5c47656dbf97a36573566f765d84e7c0267fa02a72367ae2485b315151b261160

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\Reporting and NEL
Filesize
36KB

MD5
a49e2c58117054d46c7e4f19afe0bef0

SHA1
d76041b01e87d6b2924495e24953b88377554292

SHA256
03262c5bd002de133838c1fa8781dc12b3811b59e2cda2806bc42655f5ada85e

SHA512
f4edf1ebbf336d5293d118c8d9dd4a00dbd0d3126c661d91687ea067d2fec9639b4324355168808e9466a774189068985f59fff13c6485d9ba9f1b448588d0fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\TransportSecurity
Filesize
874B

MD5
1826e78958e27a6bda9c108fc3587be1

SHA1
9e562f09e77f3879ed0a617694afc9403cd1c28e

SHA256
e28de20e467e7752d20ab2b3b1d4b2ff48b2d8acaf749b77e0314410d815bdf4

SHA512
9480a3d81f3b1183fcb57e0406b70e56d8a71678bd7ad8d8a8bcec4d19dc578f30b09ecb1af5ec7412cd0b2ba6b09613a0cdb763ca85099e5505f8cccc39842c

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\TransportSecurity
Filesize
371B

MD5
00aedb8a1318d6d189871a861a4b4876

SHA1
e43c4b1f1aa367d34fda1780804f62ab56af5cc2

SHA256
6b2d54498c930dd1d1db608aec833084fd1a191ba1a6466c6d1dd7ce7f3d8724

SHA512
2a5b3821ced7fbdf1decd63f59a95b1fdd0f289dc63b66a1960b2a4ef40b72945348ac9329ca42e765ff0cb5d95c09e9b1d95ed2258d15f028bc8c8d8fd15aea

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\TransportSecurity
Filesize
874B

MD5
37bac5f8e094579f9c39dd9b33ca611e

SHA1
e41e0e85a2c0387e878661bfcd26dafcb0907d72

SHA256
a458ba66b029737779037337aee981830eb57d80ff0f93b0e3f877c63147c76d

SHA512
490a03a2aed6db5718048ff3ae69c9b9cf99d62ca5ecd679fe6ec86b7f5f334d71773c3d0200d5a2079d97684847a503a7404fadbc74c797849f4f88c3465df9

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\TransportSecurity
Filesize
874B

MD5
cd1d124617ad1b663fe25100990d2731

SHA1
d131e9f028f6a81d28cc1343d707474316db72a4

SHA256
76635b4d743e077ab3cb5c8cab214ae1832e84decea7142e73df7e4f479a7be9

SHA512
f1430fcd5fa33f09e1589ac5bd8f4c31ba00720438da1866c27a95f48cdefbd43cf0d2e31b33548654b600cea79793b20976297b345c3b38167ec75da3645ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Preferences
Filesize
6KB

MD5
0806818220d6e47398f13d52598b5fae

SHA1
ed99aae44af0081e5cea0a9d6c9ac7d2e4d82061

SHA256
81341c06a42088a254a416a06164b69e9040b636c9d93965dcfa4bfa61202468

SHA512
1111dd6f7d74dddb4db2495aec1c0340dad1f36dc89e5bda35d8cf3c852ac5d9ddd847c145136b5d06bc8d150a97601bb5d312fd169be47852303c9ade652040

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Preferences
Filesize
6KB

MD5
51d2864beed7069885f805fd01d541bb

SHA1
0af143773c3a9f2e7fbbba228f9283294905edb1

SHA256
94955111420033fc2874bbf529915e8dd80b500acdc119839ed9c7aef75020ec

SHA512
985c7945a7e8cc2fec2291befc682f3500f3d08a4fecf1ffd3d6768fd2a45c750de7d580197b81df172dbdf7661530644ea8d0e6d10141c1db7180b77264bf81

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Safe Browsing Network\Safe Browsing Cookies
Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Safe Browsing Network\Safe Browsing Cookies
Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Secure Preferences
Filesize
18KB

MD5
975563c63a435f0909a15ef540d37391

SHA1
46cf6a6d1b870ddec8767c884d48f7568af5f23f

SHA256
44651e1d2a478a2d7acee4ce1d12a2e0ef0ad8e7aa84d9ee85c400cfcf7a3a5e

SHA512
ea770a6497b4c23dfae8a6e4f0fef9bdf8ac3db0dbfc992b93071eb16d2833ef49269da0ce76edba35c6d1cf876d51545210750b0d2fb8b3f7c8aaae82f9be23

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Secure Preferences
Filesize
15KB

MD5
432e9c5b26f13146e3dbadd06fddc950

SHA1
5e4f4e28ac6ef488f0ea5ecee59fc551af4d331b

SHA256
6799b3530127956bad05507e10248148b765eedd64b7ecf9f41e539ccd8fc262

SHA512
ce3c8f8f6d951ca5207d740bc2722cd9e25043968ce34a2006ca324bc56146d66ed4e95d8d8e6ca8c66b7c3f824de11067e224411acc0b28582c5e09e3a7d599

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Site Characteristics Database\000003.log
Filesize
40B

MD5
148079685e25097536785f4536af014b

SHA1
c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

SHA256
f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

SHA512
c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Site Characteristics Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Site Characteristics Database\LOG
Filesize
345B

MD5
0ee6ffa2401ec82213890e3d2b7532c6

SHA1
e9b1b21a391aba5cc48b0a3c1ff2cf657bed0a57

SHA256
7ac0a199dbf144f3ffc90f3ca9a068bd6b3359f393239cea83bc500fde1c0358

SHA512
7e905e4fa4a5b0609b0aafdb88b6292fa5fa1668a710bfd2fb474dc729c99bdd1c1f3dd16c2d93613c51349115c363928b7c52239766a7281465abf2e4047e3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Site Characteristics Database\LOG.old
Filesize
305B

MD5
fd085accc9f150c4beb2adb041009e61

SHA1
9578a36c67ea8c1391aabb8dc7e5c3c60bee5b22

SHA256
a23e104d9d2e8924a338f32cdb20828446fd8a018c90b0286b34329465582ed1

SHA512
20fbd67c88f42047f7eddfaf8bcd3da3258bf865d6768ef32156279c677027c9946885a1a53d7e39031e693848c2166e48959e124fef5513f530c9414b69ca50

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Site Characteristics Database\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\the-real-index
Filesize
48B

MD5
fd2de4cff9345bdf74ae47b948143ff9

SHA1
f55ddf0c2cd292593e3d0c86bee581ecbc2fd6d3

SHA256
c9a92265d535d2130798b3c6e24a79379f2290f8733f1a1f3c5cf1b562682837

SHA512
d7a0b611149bb59f89fca54ac57fa9cd1cbdd8ab4c8b6b6c2adf774d48150960e7f8413702b6a9fffcac348041967df3e643fd8e3fed43ac491a0a65dd6e8471

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\index
Filesize
256KB

MD5
21bbcd3cb72ee0d6c043e6febb41b8f1

SHA1
522929b68d85f3f3cfab47ad2545ff4b1b3bc959

SHA256
b7387d4780135fb2336158a6fbb117504dcef05974edab48ac01497b8ce3aa43

SHA512
67be7557db2aa414bc035c6a848a9f20d53ae64a690b6b70607655a1804a14871df07e3c83d6b42d1cf29454ec6de85223721babc967092c1aa0836b2d4018cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Sync Data\LevelDB\000003.log
Filesize
6KB

MD5
d8bb6bf819be44d63f737bbe0b7210e8

SHA1
df0550dbc1e4bbc10aae6fb5e0c99f697d9ff501

SHA256
4b4a0361f6f132c5b5c561796792987307e4c2ac48887a88a4c5666ab203e5ef

SHA512
32da74165e9e793b57e6fe0464388b4778ea6e3d91d7811b82dedf9940395fb46210054727cbad55e5078c8888fd4e7458c9c2f0813db758507e9c425b05323d

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Sync Data\LevelDB\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Sync Data\LevelDB\LOG
Filesize
321B

MD5
0a104e5540f95f9f447e7148e3b76f5a

SHA1
f435402bf133852046321e1abb0ec0532ea680a8

SHA256
fdf3fae68f72f41f3af506d0f4cd296bc27416e33a6d65926a8c1ff727f1880a

SHA512
cb6947212746880279a4bba51088f10bc82eebc590f45d7bbecd5f6c84a1f56d2f67247d0c8c1712bf4404f81e0d6f4c3858a6a8dc7d61021f27cef988ca4f9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Sync Data\LevelDB\LOG.old
Filesize
281B

MD5
321af48c66040d9354a3b723eafcc13b

SHA1
3da470ad49e32e12c1edf512bc0e1bba3cbf15bc

SHA256
6fc9da12aeecfcd167aafd3dad41301224033342720159e6760ded85ed3abf30

SHA512
444e44da79d478632c66ff0130eedbcb0899c624c9be8c11c60e92181e73c8e2505816ce82a93819c4b7b6ad11b8c63190a0f308a5592e9fe1b1475e5c264be5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Sync Data\LevelDB\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Top Sites
Filesize
20KB

MD5
f827a28f6100a85bd8217d338ccca5a4

SHA1
2a180393edd7109c3ab03db4e6edf07ddd9672eb

SHA256
82ee998a4908774d5f55d1d65c897abb5c36458bafada8dc945a09c6b9f21429

SHA512
77fc5289c9d5f954e789f2c0b908a39e8e988201b0ff89efc1002d2d5d7808a8e60e9332be4b9838490d48e4a4385d8cd9b3b18c8716ceb9d6f2117cb2e53d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Trusted Vault
Filesize
33B

MD5
f70071bf863318412e39478b0da503b7

SHA1
fcb55d48388261a00a88ef747280a1068fab8dc5

SHA256
7d276245c680327aae3357961282164aa787014292696b060e0a66dbfc1a923e

SHA512
0898183c305bce0b8836d0ef902456b13335b519c64fbf9c61185bad45fdf2b522551a332b701d094c480df01017512475660fa5b9b01a292a2e491bb9e32e7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Visited Links
Filesize
128KB

MD5
21d062ab9b8a1cc648759dc2ded5bc25

SHA1
8fd2b93245f1cd228376c1a61947c4e2521b4e51

SHA256
43a6c0cea4bb1fc45049fc762336cd2e5c3b6acaca613080eeeef8da1b13d0bb

SHA512
185e2c8ca283cfcad4b48dc506df4ab798cac7edeebb9cb4b8fcf34e46672dfcb1f3f884bc7efb37904ba2bfe8f49c2617e6ef3108c02c33d0e40ab468bdf1ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Web Data
Filesize
92KB

MD5
395af5c6fe8e84f27b3be9b1a95e412d

SHA1
386230fc368fff5ba685322a8177ebecd9a665e1

SHA256
4c8984d8400a8ea0c4f407c91c9e2be623b6bbbb0d4f418a7ccee8f1c96f6ae6

SHA512
376116e25f7b5d10b724c1a9ca40aebf17bdd386b9858ef34b05c66454984b88f09978484f770e2cdc477cf2a0025a35a8b9c8f196c2aa86d5c68a44d0388a7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Last Version
Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Local State
Filesize
179KB

MD5
cbf3c628e3b3294415b03281bcc6a4b3

SHA1
86fd7db5088ee0d1ae85b35f565afd20efb28923

SHA256
d053b83c3364371a870198595dbfb96e8c07dffbdc1ce6d8ee91309be3107f25

SHA512
a9b2aa2d65882f9e732253cdac7810f71abad2f22f9d2a7cab395a82c63c8bbce7f65686cbe4a7701631b64b10622d984dd9d00544521df55ba318debcaefe85

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Local State
Filesize
87KB

MD5
f6a8d13bc264b27b25cf72b72a5f8677

SHA1
26696bbdfef174b0a78c48150a7dbc5f5f69a68c

SHA256
f3ffc548afcd71a4e24bdada8b6436a17d20932d5e3f2f1a22088ec33148623d

SHA512
b443efb61d875cd2c23ee22ecdf82e8b6ea699c01f622ebf32bd8b936069e1de26c278bba3e7337172bbf666ecb4247eb6849bb4473b3f7ef3049346e58bd879

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\ShaderCache\data_0
Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\ShaderCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\ShaderCache\data_2
Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\ShaderCache\data_3
Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\ShaderCache\index
Filesize
256KB

MD5
8659df039b2d353215a4e67aa10d92df

SHA1
b913b34380a2ab5425fc82a060e77d5fde5ad17d

SHA256
899a21385bfd24cc7971ba5c7938310c817347bc485bd1bbacfa045c0a7373e0

SHA512
83706225dc4400916b6bb51835310182d5af367ddae15d6c21cf35116e957ef9b8ff322a0e4f1ccebd523d38bb03f7566ccb30298b611eaa4b66537005b7875e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Variations
Filesize
85B

MD5
bc6142469cd7dadf107be9ad87ea4753

SHA1
72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c

SHA256
b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557

SHA512
47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182

Download Submit
\??\pipe\crashpad_664_EERJOMKFBKKPCKXT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2600-133-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2600-1205-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2600-643-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2600-134-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download