hxxp://google[.]com

Analysis

max time kernel
85s
max time network
90s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
26/11/2023, 06:33

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133454540145907921"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2964	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1760	chrome.exe
1760	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4696	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2072	1760	chrome.exe	54
PID 1760 wrote to memory of 2072	1760	chrome.exe	54
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 1096	1760	chrome.exe	74
PID 1760 wrote to memory of 4992	1760	chrome.exe	73
PID 1760 wrote to memory of 4992	1760	chrome.exe	73
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75
PID 1760 wrote to memory of 2608	1760	chrome.exe	75

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8d9599758,0x7ff8d9599768,0x7ff8d9599778
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1916,i,5485861666647062666,15477036004246191407,131072 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1916,i,5485861666647062666,15477036004246191407,131072 /prefetch:2
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1668 --field-trial-handle=1916,i,5485861666647062666,15477036004246191407,131072 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2600 --field-trial-handle=1916,i,5485861666647062666,15477036004246191407,131072 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2592 --field-trial-handle=1916,i,5485861666647062666,15477036004246191407,131072 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4288 --field-trial-handle=1916,i,5485861666647062666,15477036004246191407,131072 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 --field-trial-handle=1916,i,5485861666647062666,15477036004246191407,131072 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 --field-trial-handle=1916,i,5485861666647062666,15477036004246191407,131072 /prefetch:8
  2⤵
  PID:1128

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5104

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\sex.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:2964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\sex.bat" "
1⤵
PID:3832
- C:\Windows\system32\shutdown.exe
  shutdown /s /f /t 0
  2⤵
  PID:2576

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3aec055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
e1aed2b765dac3528130df2e215cffaa

SHA1
38835d806499c48d265c1ce5542122fa38aa2259

SHA256
177b71c0d0cb5136ffc69c515cc1fea5e8f2cabeb27b6a445fda497f3bbe0351

SHA512
ede8a5a819e4ea53c8ddb71bf3afa5f5006ce714b6fda5e318a5d5bd11402f37a2edad5d51494fc3cc069893c334f05c71830804ee79c6b5558e23f868f1e89b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
c8f06712d1fb8b925558425c16a83c63

SHA1
c821bc3827a42d6db63fb4f0ea8ae5b3395477d6

SHA256
a556770bd15e1e323680d9515bc9a1e799aeaa6e34d02b2ff4cf8bcd5cd4a93e

SHA512
14c0ca10f800e12a0f48f46b04b0b82706f8fda1d514db3dffcecea1db9a347651ace3c5a7e3a9e6eb7291ddd040c9faefec5fb9bd4f4590d47a3226f26674e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
537B

MD5
de7409f0d0476ad3ed4c5ea0a69c341b

SHA1
3c7b3a682a443cc243e5a81f9096bb1e91d5a18a

SHA256
31b2210c077928473a91b88302399cf08a22b5c116a4f25d278b6b22c508fb9a

SHA512
ff670042ce19d2d816e10539b3ec14c7d378f0228ff93eae3c1fe9df544bd7da780586d63190011932a4abcf562a8d121aa3ba70b18c3cea8431fe10b0956b05

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
92e9313ef5ed255cd50a5b37ea414ae5

SHA1
b5e4407cec076efbc549eefd3a1213756d97f22f

SHA256
ad422109aabef60c401f16e68f521c9409250b0e7b51bbfd3ab52c7a3e02161b

SHA512
8be398367bb7dc42014f2e1b1060bc992abcc371f8d7d8da19b559d57417fa2be48e6441bf4a5e1adcfe30f05d3f7189e70830763139448b4c0b2e70d11ce9ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
09e194c13566a0063e94c7e6895119fb

SHA1
4519975cd88338ab33235776555e7c4840262e5f

SHA256
0283c03a4d6bbd6eda25d907ed278df0ecd24b72e78fd613074974570a95fb69

SHA512
a730e93fd109df024096b7fc87a14b451f0f8f061d7f92b68d6ffc565cd2fea74a5aa150ed868c3c48bfe41800c4b51eb701c271a56ba9b06d8ee1622373b199

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2f6b7b4689e87f9af25a51cd0629b221

SHA1
a0052c82d50c922db3132160721b3ee01a9b008a

SHA256
f669dd2cc4a35b403c4d70a3460ccd92a1971b7c3de58eb9c64e25684e8c551d

SHA512
394227d8859883f0fa49c58bbafe04135d95fe46cc9b4ff671a43cdb3b84c05980800d93099485822a972009df48268a889dbc9f1f7f1ca3b7d80a6f0ce790f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8225999f0df3d829f980a047a86d6e82

SHA1
ff753792ca54129937c6327db1b11c25329e5f91

SHA256
03540cf0da9e090f3e2b8b009a62e133e62034fd15ecdc3cfcd5aae42f0d7f78

SHA512
c366f209f2a3212d7740b2728b038fe2d712ff0e591c58a4f8543ba1528bf6700ae74104dac320b61f6792cf7122350a7381cdb79e51268d4debcd399b3343db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5468a6243edf854eb3045ae69244ce9e

SHA1
eb84b57bc1eab75a1f25c8463e6948c0a461a49e

SHA256
c29307d6fa981635836abd58a28a6210060b31852b1d9822e11724abb70941d8

SHA512
05d43a9a6989c53ee2c9954e7194818661214c98029752a0a109cfc60fb3b295a1960bf2c4bad8fecad812fe14722ec2afab73abfe3da8e4551f27929dbb926c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
108KB

MD5
cc3f359833931d1761fd1d282acb0bf9

SHA1
0c250beee2a47d71fa12c48e59c47772745c625f

SHA256
8ab3f171705d09dcb27a4cb8b123581b1e3bda7e3411409e916aba6f0cc1b94c

SHA512
504f06e8e90f78035d71df1303cb3af0e67c5cd003cbe485f3b36b50a1b550fae61c015c40f24df72ffcd6fde5fce3f94c88ff9738c8ebbbf63db2ab9ca18adb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
108KB

MD5
cc49132072c307b8c8a8813539f2e30a

SHA1
7bdca117ff3710e22ce736da4f599526f9de4ff1

SHA256
13133a62dc115d41bd3aba28953cdbe4f253bb8cd7fbccd7b195793c3dcd3cf4

SHA512
bddae878b93cd4b2cf1c49b30a55a513c4d5de6b3d990b71281d9ae9d6eaf9df2eb79228a56fa641c9a9b7d15bf35deb1a267f829b27c91e3eb67760d74734f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\sex.bat

Filesize
30B

MD5
73fcd21a4e34523401f7efc9e52b9207

SHA1
e60fedb9ce500290ebf5fcafe90496cbe43722b5

SHA256
bc119de8365f71ae836f19d91706c4b4a86f839ee54fd4e20f63c83a61917992

SHA512
90468d902b2ab188a88f26ab4fa5489471c5c21af8427a602a980aa81c36afba1a56347fa6f996ec246f4ef404cf48980e5203d5bd43068964475292ca40193f

Download Submit