hxxps://marketingcuratednet[.]com/31159-238498/123912?uid=4MJtH8eHfu2e52DLGY1Ssn&prom_type=regular&prom_id=232441&pld=26L81sNgpwNGg5

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2023, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://marketingcuratednet.com/31159-238498/123912?uid=4MJtH8eHfu2e52DLGY1Ssn&prom_type=regular&prom_id=232441&pld=26L81sNgpwNGg5

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133443639931934596"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4896	chrome.exe
4896	chrome.exe
1100	chrome.exe
1100	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 2900	4896	chrome.exe	87
PID 4896 wrote to memory of 2900	4896	chrome.exe	87
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4672	4896	chrome.exe	90
PID 4896 wrote to memory of 4532	4896	chrome.exe	91
PID 4896 wrote to memory of 4532	4896	chrome.exe	91
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94
PID 4896 wrote to memory of 4880	4896	chrome.exe	94

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://marketingcuratednet.com/31159-238498/123912?uid=4MJtH8eHfu2e52DLGY1Ssn&prom_type=regular&prom_id=232441&pld=26L81sNgpwNGg5
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffe129a9758,0x7ffe129a9768,0x7ffe129a9778
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:2
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2932 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:1
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2924 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5336 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:1
  2⤵
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=888 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5704 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=932 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5200 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=6308 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:1
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5720 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6292 --field-trial-handle=1948,i,4420156266237465754,5059498352856509889,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3700

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x338 0x33c
1⤵
PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6425df3e29e5f5c1fe770079d3323f3e

SHA1
c589bcedd48b1d7063a0c6e42573b82784c70eca

SHA256
5843f6c0ea236bed45800dda89cbf8641a9658c6734e8074ecc1574efc0d8f1d

SHA512
329c9a7f2addb201130ecc06f3d3246899634d5e2041ee64b9f0800d222c3b779a313924227290648bf90e356b547e1ccb6a419275b0a03fc0a7de3d782e7d3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
ba341e95a641326993677b5605216c80

SHA1
7a6d729603331d0cdd528ae4b5fd2fc9f5911946

SHA256
58c08292100baeddcfa0cf5ae53ae6909a2b1f324fc9d10875648f0f8045dedf

SHA512
fcb7069968b06d679df19a7b738fe0fe578a75007ea85838972bf19c449e933c42e6a2734ba997b063597eda3f55c4b344e500a5c0f6d941a0d4511f98a2c32c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
3e17e226bd7afb8861a9e2430dbd8670

SHA1
03f0410745ca76286a1be3801948ef3533f296f8

SHA256
71ead48051c99d082da5a8f85c5bf7d87ad1b8b43230a5ad8bf4370f35842834

SHA512
9ee9019bfd23a5484974e296b692acf6b95292ecad45697baf171545f7c33e222cee0eae538156cb6b584a8d274a081df5143a4d54c3d8b192de82d2fabcb767

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
02562a530e33cee373140875b9f47e6b

SHA1
e46aff5242df828e10f2533d240281790a918696

SHA256
ac38f1645183c20e8cb2870252e077c4e63973850889e362bcec26a242af0bcd

SHA512
c4232cdc9811670bbd661ce7486e67751eae6c338ec95610ae99508772d0910d5780a886b2dbde776b1929806a3776bcfcefdbd8d5a10a29fc2304aa8141cd25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7089dac894e96d226ad4f02795d69551

SHA1
10b6bcfd2b3ef58e666b58e728c11d9db6fa4fc2

SHA256
d15ee8368e9347edf21f6fafa480b6b9b48de04288501fe9e9d3b0bed0a1ce1b

SHA512
c81d30621d242da8aa5482ca8bb4216b86ce4b0982abad14a274e4a917236086f45607f54b9b90e17ceb2b6b0ac139589cddc38137276d4976f75eaaca514552

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
fdd752d4daafbb1b263219b8b083b289

SHA1
5682827efcf2715564f2b9e97bf306af9c6fed2f

SHA256
c4da86cabd85416cf480b9d68be7db01612f4635edf27be992d0886f9b5ce369

SHA512
1ace8ae5dda1a022e4b95b509c1a2e1a035cee1447e34ddd28d8baed540050254394c97587922b8b12e954123146d89e1ba249604a663d8bab7f7a2a58c400f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
6f5d86f06008a5b28a238a9fed5cf105

SHA1
41c3f100c0acc3b8f639972a7d5b3b544c72ef9a

SHA256
82d9c34906eb8137bb7510fe37eb8a29b09efad729bb500d4cc19125271ef84a

SHA512
9747b5a20e935034d8cf817d945399f7c725818ab1387b225310527d10c41dc013b4b2aff8fe235f74bd12283be2f75b909bf8ec1aceb0ff7187a0b707ed3034

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
96e79e69a67d2c42b3857da5f091389f

SHA1
a090b9062351bb9c749b9ff2620c1974853d7b8f

SHA256
8665807a6f1aaf04d8bc4c6ebdf48df6a6c6f73d15e0553384b39391e01fa4b9

SHA512
eee139b9090784c1c03229de97698fd1e2151e83efdc4cd167290c30ac02934c4f5d270d5568ae19a49a74aae23d5e5ac8ddec539ae83afa8f13c240658f31b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
bf537036404d2b38cc122872d41b467b

SHA1
ebddf8664602008f1050c809cc3a34b4143b15d6

SHA256
95259f13c5d25251a44c2c353a90eb2112ffc0ed1b14fdef99c72c88cb87731d

SHA512
a5cdab1108858ebca0f68a7a6079ef0b6ea8ad074ca1a19b1de25227654fa1a845f8fe8ec1e3159f0c03632cf292a96382c73b787be6d4fdda9cf173346ad548

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
693387c6e427a3649f7bd923a34545fd

SHA1
db148b9f6be02d695ad29fada6cfa1edb6dfc16b

SHA256
9d3f2ad7b8dabea65996a98d94084d9f7b1200b212c5179cb6541d9dc067817e

SHA512
3572d89055263411542defb84f73ccc02bea4f0dbee429fd142894e0f43c7d1a718d0b9934de0fb9b11298606ea37edbd26a7fc66c29100781207cc25721bf71

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
108KB

MD5
b94b17df4ee96579db00d2f3a5c7b8b0

SHA1
0e89252c8098ae4728b6cf3eb846b5c0490cc749

SHA256
f64c2025536a138203ecb4aaf70d4bd9053bae094d231eb3d483e13ab5c2a01b

SHA512
80d28e2ed796667213e33f1e5b4654abda93e03bd9bf40b4660f1aa147f7f30a7af3597593abb3b59db993bb3d504810206d51ae87ea1f4e7629906f692dd4fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe589517.TMP

Filesize
107KB

MD5
2fe7eb63bc9c58a018677cc20a8da1b4

SHA1
a34ed660dd8a6ae350c61221fa00b3fb049f73ec

SHA256
e5550f1ccba123cb1aededc9efd6c175a6b15c83f62d7abcf5324fd45434153c

SHA512
cde728741e4840e3465b6ff895afb79dea5706b2a2c7f2d9aa541a42852d762ac087479c2be03d9c484c461f17bb62262de51450f2ae20f34713e3cdc6169f47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\w_frek20.pdf.crdownload

Filesize
201KB

MD5
45ae79f32b0619a36347dc4eeb237dd1

SHA1
70da8ebbb21ecb1e62142e863a09150b1b65b484

SHA256
0bbef17eeeba8cd6806f77b5ccc1ac1389f9fb5e5b364d203e3818d1dd8fa018

SHA512
c78108e88a9d9731f27952b337beb25675889f710f3a9b097e9f3fdc0cd6b9e5e8485623d21ebb85145ab3bb22f709d0c2181912077217ebb83f25b0e0e07cbb

Download Submit