hxxps://barreiroturismo[.]com[.]br/?ads_click=1&data=471-470-78-74-1&nonce=099d3c447f&redir=[//]artlifeicmimarlik[.]com/admin/view/stylesheet/cv4/index[.]php?etus=test@outlook[.]com

Analysis

max time kernel
43s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://barreiroturismo.com.br/?ads_click=1&data=471-470-78-74-1&nonce=099d3c447f&redir=//artlifeicmimarlik.com/admin/view/stylesheet/cv4/index.php?etus=test@outlook.com

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

48 cloudflare-ipfs.com
50 cloudflare-ipfs.com
51 cloudflare-ipfs.com

flow	ioc
48	cloudflare-ipfs.com
50	cloudflare-ipfs.com
51	cloudflare-ipfs.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133536713451623421"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

1332 chrome.exe
1332 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

1332 chrome.exe
1332 chrome.exe
1332 chrome.exe
1332 chrome.exe
1332 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe
Token: SeShutdownPrivilege	1332	chrome.exe
Token: SeCreatePagefilePrivilege	1332	chrome.exe

Suspicious use of FindShellTrayWindow 30 IoCs

Processes:

chrome.exe

pid	process
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe

Suspicious use of SendNotifyMessage 28 IoCs

Processes:

chrome.exe

pid	process
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe
1332	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1332 wrote to memory of 2428	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 2428	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 1412	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 2536	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 2536	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe
PID 1332 wrote to memory of 3276	1332	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://barreiroturismo.com.br/?ads_click=1&data=471-470-78-74-1&nonce=099d3c447f&redir=//artlifeicmimarlik.com/admin/view/stylesheet/cv4/index.php?etus=test@outlook.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7fff01a39758,0x7fff01a39768,0x7fff01a39778
2⤵
PID:2428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1864,i,1188088555718047436,2680346722164731248,131072 /prefetch:2
2⤵
PID:1412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1864,i,1188088555718047436,2680346722164731248,131072 /prefetch:8
2⤵
PID:2536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1864,i,1188088555718047436,2680346722164731248,131072 /prefetch:1
2⤵
PID:2372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1864,i,1188088555718047436,2680346722164731248,131072 /prefetch:8
2⤵
PID:3276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1864,i,1188088555718047436,2680346722164731248,131072 /prefetch:1
2⤵
PID:5052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1864,i,1188088555718047436,2680346722164731248,131072 /prefetch:8
2⤵
PID:728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1864,i,1188088555718047436,2680346722164731248,131072 /prefetch:8
2⤵
PID:1632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4976 --field-trial-handle=1864,i,1188088555718047436,2680346722164731248,131072 /prefetch:1
2⤵
PID:100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5024 --field-trial-handle=1864,i,1188088555718047436,2680346722164731248,131072 /prefetch:1
2⤵
PID:1508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 --field-trial-handle=1864,i,1188088555718047436,2680346722164731248,131072 /prefetch:8
2⤵
PID:1120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3360 --field-trial-handle=1864,i,1188088555718047436,2680346722164731248,131072 /prefetch:1
2⤵
PID:4872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=824 --field-trial-handle=1864,i,1188088555718047436,2680346722164731248,131072 /prefetch:8
2⤵
PID:4412

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
240B

MD5
4564f7d2c40729cc74938411a9c887a0

SHA1
50afb946f2586ae7da2303628504b3a86d1d17e5

SHA256
f187c81aba75fe3a309334fd4ed1c33734b757fe9e4adbcafbc150e76ad3a389

SHA512
ecfa10df6bfffa741218fb2b6392d0713d93f2989df08aa67cdb57e75e5c31047325377899bf4d0891b9326b3126f22732826427750eb3b66e6441b261180d11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
315afb4794af917ed4786ec8315b4b59

SHA1
d7d31649f3d4feb9be27f9975a0c707745ea0447

SHA256
e9db9a2376ef9ff6b40b766f6c2fa22f57af793686fc0aac1b80966722d645c1

SHA512
f0a9be97fc0f1a511b9ac6be14716511021a27c75469bd726909939d2aeee89e33a49298114d0ec9722c32e467d880ff96156ffb164b9b2f471c346a4194532b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
3ed020c15441a0d4fbb9439f0e008484

SHA1
648c92667c5bdd07402031299f5c06a2166876dc

SHA256
c53e2407090bade5a8435e0d3c1d184109bb14f1a12fbb10c7043eeef1702973

SHA512
4b436b87680c8eed8d9cf9ebd4d648f4f3a3d9167d0efc7a39317ecd9cc668e3acaa362440eea7606cd896f59e8aedb3fa485d8e5d60226f9f45304042aaf7da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
ab5eff909d38d3f7c1ca2f40ccef2054

SHA1
97f6d1c9c8d27d55249e3b651bf2c65c3bbab008

SHA256
245bfb74f8fffa5c7274fe318c442f4c4165fb42c962d215b26de89a133b0a88

SHA512
ecb25a923e007a0ccbb8a815fd900086e6ff16d645e2f8c43f0968669e01d771c9f72f5315da3d7372ffef0300e7822df057838b96b612e4bc2adbfe9c4478cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
d0b9ff0e6ca285e698bac9221bac80a3

SHA1
037cb902e42d0d3cce1b66a33856b11634c2ec91

SHA256
c68a6fa31bbce40098aec3a463a1a48966bff858f9cdd59db6ad1afa6ff648f8

SHA512
498adebfe7d8d60c9cab48efffdc51c1d5ce92756993a561f20f0963da5e2030e770250c4172b4f5ff29d7cfa550328cd0c407435b36acdfa8902bb501012f89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
253KB

MD5
cbf9fe44e9aa9b243125ddfc0ec412e6

SHA1
e862b898fc7e2ae58af3a4b85e2dc77c0dd0d0fe

SHA256
a9290829d0caf48d340643471454dc8ec03743f44cbf32f83e402dfba0349c63

SHA512
8bdf838a7a198fc4ed5fa36b40fdcd054570525dc79a0813c965e0724eed1103285528193079e49cbb78c97d14ebb3f3111984cd5597805de83f6c4eb5092dc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
101KB

MD5
c84cd2f12cd8607151f806e1f4626b01

SHA1
3442d0f4f0fefb2e840851422cac7ae83e08cf7f

SHA256
fe973fb195f119e8990b1271b5599a733e3ba5568d240d67a92217ea05ed9b77

SHA512
c53055a698dd3226bc2ecdd7b15ca83cac750470ca0fc61799f5bd377a9fcabac9cd2ddf454f2a27a6c70d53f4cefee83de2219e5b0132057d316cf059719a79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57bb61.TMP
Filesize
98KB

MD5
2128b43a570c86ddf3411834dca2155f

SHA1
ed727ea31f1159bebe9645a587bfdf7c66f328f3

SHA256
c71374ffcef2a9b6c4880f3437d5f47ea7f4cea8477673a0686818fdf414f6f3

SHA512
b494241842108a26fe06d0f60a6366dd41e98e2c5a1d9566b162f95e6e046b3fbd481a1c98b9aa95bcab6e39949eb8c87036e3f75900dfff19fe360f631a6bae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_1332_URHSRBNWULAZNAVI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit