1a91e60510b8c6a5e113b9c089e3020fe71a13b7513392a09f84d3588dbf9c38

Resubmissions

04/09/2023, 12:25

230904-plkygsge52 3

04/09/2023, 12:22

230904-pjyrkage47 3

Analysis

max time kernel
45s
max time network
110s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04/09/2023, 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GeometryDash.exe
Size

6.5MB
MD5

8c73a34f740b59ee613c6128ad11c2c1
SHA1

66788bf78d32238a6a89110afe9ee663ca55f715
SHA256

1a91e60510b8c6a5e113b9c089e3020fe71a13b7513392a09f84d3588dbf9c38
SHA512

fa7b7426ef6d850cf658739c72f3be77bb545e1d228f09816cd3088d90b42958dede51b4381fdb93f6cabb5a59e74bbc82008e063ed3d4af29a5fd1f91c34b62
SSDEEP

49152:pxIv8Yz3qRzSpXyDOZF2LRr9BR3Qa2d1ww6xfS+w6xfSExIlvYqb3xCTjzDyW:k0FJSpyDU2LRTRNVxfS+VxfSgI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1396	chrome.exe
1396	chrome.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1756	1396	chrome.exe	29
PID 1396 wrote to memory of 1756	1396	chrome.exe	29
PID 1396 wrote to memory of 1756	1396	chrome.exe	29
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2644	1396	chrome.exe	31
PID 1396 wrote to memory of 2784	1396	chrome.exe	32
PID 1396 wrote to memory of 2784	1396	chrome.exe	32
PID 1396 wrote to memory of 2784	1396	chrome.exe	32
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33
PID 1396 wrote to memory of 2500	1396	chrome.exe	33

C:\Users\Admin\AppData\Local\Temp\GeometryDash.exe
"C:\Users\Admin\AppData\Local\Temp\GeometryDash.exe"
1⤵
PID:3048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7149758,0x7fef7149768,0x7fef7149778
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:2
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1536 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2372 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2356 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1396 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3224 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3516 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3492 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3724 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3744 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3892 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2532 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2420 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:1
  2⤵
  PID:344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3868 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3676 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:1
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=2460 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:1
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=2352 --field-trial-handle=1200,i,5964757310892832673,11471483421418281452,131072 /prefetch:1
  2⤵
  PID:1016

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\709fcd67-4c6c-465d-829e-ffa5290dd316.tmp

Filesize
192KB

MD5
a7a4eacc033a574df8e7724e94c7fed4

SHA1
89bcd5f0810f22690141dc5c3bb571bc22cae646

SHA256
daff48e1e9530d952caa294c33a4d5ede0b39785f38a6150ec613ce8decefc1a

SHA512
263dcfd139b52e06a4141228e83d09de845d9879eca51edf3aa7dbdab7ef843dcde0e9b562c61729c546756f0556315832b810d6e27b963b2610fe37526ea176

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000043

Filesize
437KB

MD5
c256755fdc161c250131152fa8952d2e

SHA1
f460f07cb47c3bd511a24787aae163c3c435a455

SHA256
5c7c1ddbea36ed92c3972bd9836e6b97a16f8490efceb4e60049e22a868e65f3

SHA512
b980d34fa57fdf517f84889638ea5ec4db31fe8a3b3ba748c908cd5d1698c5a319f3ad1ac35694c8e786e07a28faea00ec0cb69b2d67953683ced1e885bc5402

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
409add9cc0987ebd3ecb42b1c3a7db06

SHA1
c63824b6bec476bc808e1cf991b5413a97f4a7d2

SHA256
723e819538ea96d125defbed13df8399940ad40471c8025b22ea3b2f00e4e5b7

SHA512
595d368f48e59eeb69425e2ab7a197993508a5c31baf8d9ede7e4acd8ca113d916ceff9ef663f6fce46cf7f4d2346eb3c6af946b2de47254c3e22c44cdf756b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1015B

MD5
c9813942b331cfe3f0ef7e22a60530c5

SHA1
e30159152ec80b37d3483e32ef23e9819f7b3897

SHA256
b0016cc34cf12008400f8d2b2d0a7599a82d50af7ce7d53e81c0c8df647a83b3

SHA512
c5a17b28f76102cbad2047a4e52ca053ad85ca35c2f913f53cad135bdb3bbe304b356c3519fd3109023b7b982aa547a03221204810e0a228d54b0b92475bf0aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
1be802645ddf061c391dcd3a1dc02b34

SHA1
3f1386d33da5a024b793920cfef0de0209fd5949

SHA256
9481daa04bcdc7e0ae5babb17abd3458a43de267a21bf4975cc17d27f77ce01f

SHA512
e331894ac4c3d0ae3b0810ad964fe9486d94d194026e97cf6e4eadf7cf4e729f9a96e85347cfc398dac35e14868adcccf3abf014271bb8e854fef12a2e91f6f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
c33d07c798f010a9b0c39400ea84bfff

SHA1
b85bc731a1660452a9f1243021aedf53332269ff

SHA256
82f9d0a16731b110bbba054fd8a154c6c1f8da532f821f7386f0186a4d96086b

SHA512
0f97f51ff59ae562692e2db82cd77cd7eb73228bff2f994653bc10c02bd9d6870184c0b3f9746a67ea6deefc6a87c7eec7a303dd701ff8d6309c90b13dbc8bae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT~RFf770d4a.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e2dcca5f-c977-4a8d-83aa-f12179889ccd.tmp

Filesize
6KB

MD5
98c1de3b458e93cc58dd4eb89f36de81

SHA1
ce3211766527ade75b280fb36b7d0e4836b16af0

SHA256
6cbb100806b331184b378f3fdab9ac12095840645d666b418eba01d9324efa1b

SHA512
cba862c78c3a1daf0791ff5b83cf25c524f27b01817056bf33002aa09fcb3bb882d376f724070a283b30bb768183e0461ab8e7b737e985e1e6ed8798dbaa97f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
192KB

MD5
b98f035fb6b04ca9636dd497838bef7e

SHA1
93991b3793e8a2834a25435fd1d92de5ec15303f

SHA256
25f0cdd153a3e74abaac2bf082636ceb9e41f7ab3972d81388713081cf23d34c

SHA512
0493fd01c029157f4455bef813838defbbba5f7b886e69ab8b8622ab2ead1192fbdb16c72571bc32170ed88af65f050da2fce4cf6cb5dd8462afb27e4079446e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab476.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4E6.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit