hxxps://u[.]to/cgFwIA

Analysis

max time kernel
125s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://u.to/cgFwIA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133541620665950668"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

1148 chrome.exe
1148 chrome.exe
2436 chrome.exe
2436 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

1148 chrome.exe
1148 chrome.exe
1148 chrome.exe
1148 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1148 wrote to memory of 1256	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 1256	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3292	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3176	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 3176	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe
PID 1148 wrote to memory of 4268	1148	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u.to/cgFwIA
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc6ec9758,0x7ffbc6ec9768,0x7ffbc6ec9778
2⤵
PID:1256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1800,i,16125137500888458109,9144143252835842674,131072 /prefetch:2
2⤵
PID:3292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1800,i,16125137500888458109,9144143252835842674,131072 /prefetch:8
2⤵
PID:3176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1800,i,16125137500888458109,9144143252835842674,131072 /prefetch:8
2⤵
PID:4268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1800,i,16125137500888458109,9144143252835842674,131072 /prefetch:1
2⤵
PID:880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1800,i,16125137500888458109,9144143252835842674,131072 /prefetch:1
2⤵
PID:2520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4608 --field-trial-handle=1800,i,16125137500888458109,9144143252835842674,131072 /prefetch:1
2⤵
PID:4084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 --field-trial-handle=1800,i,16125137500888458109,9144143252835842674,131072 /prefetch:8
2⤵
PID:5828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 --field-trial-handle=1800,i,16125137500888458109,9144143252835842674,131072 /prefetch:8
2⤵
PID:5900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5424 --field-trial-handle=1800,i,16125137500888458109,9144143252835842674,131072 /prefetch:1
2⤵
PID:2692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1800,i,16125137500888458109,9144143252835842674,131072 /prefetch:8
2⤵
PID:4476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1016 --field-trial-handle=1800,i,16125137500888458109,9144143252835842674,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4020 --field-trial-handle=2240,i,16875000905773190493,11379096115878622792,262144 --variations-seed-version /prefetch:8
1⤵
PID:4848

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
480B

MD5
80928c09fc8144d610c1f67e248f21f1

SHA1
5b4237d61d7969bcabff910a3ec3c2eb4610a954

SHA256
69747ebe811c284d0238faeec2b11c93e07f1184bd80cd8d5dba8efefa19a813

SHA512
63ba0512bcef6105e60d629ef7bce7901b7554264002a3cc6d1d350ae5fb8c90b41385fce0701180b26261531744ddce508c4473b0592d41085bbf8ef7d3c581

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
624B

MD5
179e1d3406bfe0029df94f9e4ba5d61d

SHA1
6fe2f2b3e4fc9c84673015ff735a4ece3f6d4d99

SHA256
f4f614ae8837e8f506c9d3d413e791e9cd117391cedb4feb008279f6be6bc1fa

SHA512
e17b76707c4b7d25bb22aa01c7778d4ac3e07bc363b4a81bd66a0ea1ed7bf4d236288cecf9d77975dd462b7b588d393a74736456e24c5d285e56bb9a5fc1c10a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
8a765922cbcd2ce7fb4ce304d013f621

SHA1
6d26b024155b1bc7fee400770e0af7ebe93c7a08

SHA256
6193433b67abc062eedcbd65c8e219d6a4e46005a11d08ddbf3766a473abe679

SHA512
bef61d7857802120477864f4d38e6e7da735812b3615ad5a2c1f1fc5d2cd2766190e65d6bf9b3a3d39e261f562f0112fefbf6b8c6bea180514ddc179963370d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
f079eaaf7b564e81a49551ac7d30502a

SHA1
fed0e7e640966860b73fc64deadfaaa38c51f5de

SHA256
fc0291ea7c65729372fe92996d012efd757d646cae811a980460fc962c9be065

SHA512
1ee3b521e3b85f5366426ff9ac5c50abaa7f75dcef2e5404ef662ef1338dd975b52be2ef9065d7f9249f53b0661f4dfb6924a3c49ed83d86d88679ebe911c5cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
cab179b8a9551febfb3590f3bc1530ae

SHA1
dec5bc8b5423e475d14fa18cd5ea1d5ac61dbba4

SHA256
704e557138a1b1fb376767782c74dff8b0756acc89157a79609de3c90dd47f32

SHA512
3f265ba3086cdae75641ee3365c8bf5d5c89350832f625220de8cfdee648fce3094334a3ef01cc3692ee470531c516e224f475f02cf18d00ff8fd8a43c4d690c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
5bff34c135aa299c106aac9f01e50612

SHA1
6e832cc7662dfa885141957c13845af7af3ffe96

SHA256
eec82509321108e98f805cae6ea75a53a02acfe1a0dcb1c6a0563b6d01728a23

SHA512
f2b71a6174aaa48bd598bbfd1b5f109647c1bae84a241eec49ca3edd450f2ac616635fa68e1fe6ef911ef5112f623d3f8925a25b13c4296b5164146fb56b2ad6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
8b630861a816a0fdc5c285728850482d

SHA1
1bf18a9951081115750e52c54183ee231ecbd07c

SHA256
1c294af2f26da2509acb70c56328b92234821df2cdeb501c591965858eaf16c4

SHA512
15e6804d3ffa99de8a3f1e726e4cc71515d398399aba50edcfd9c3bfa5009c531802f41c9a19801fc76aef104103b7dd89803845e966819be6ea13f1762a6a1f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
65fbeebbbe9bdb5ef26b27778eca65b9

SHA1
32252a001635900ea433d00c59e25c7ac9c1b991

SHA256
86ba1651bf73c2bd8e060c600e9dbb4979cd84830e508a247b19b86a5026413b

SHA512
4339c7dd20fd1c1e1384dc1e7c6ee9acbc3478f4a8872e4d0943eeaafc74c23e2702e5dcc6f1f072d8c83f6caff2efc07d38d9c16d3c2b86c7343c37ae4ae791

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
3a83770267f868f4073b5bf573f9c37f

SHA1
7ffd64a9c5926cf7a3fa8f5906e55f2d37d8f96d

SHA256
4b5ab4997de4094c0c5af106ba50871fc211441843307e1670c7bf8b992899e1

SHA512
e6072afa8a9204f34ea0d940e40bd3cbea121f4b054deac8c2b45bd7635a2804ba58648ead2eb8fda4f5ef3d7c1d52e98b4902c83a42a4c821b091bd09ad9789

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
f0fb9ffbc501c151ac894a9a8d70eb14

SHA1
a11f5cb0ac995f049545df6e536418f43283c00b

SHA256
9aa08f2067d355fc0bd01b7cae3b1a0743ecbd5600d33142dba381315703992c

SHA512
3e52a9c9ea0b2e168d916d7cc68bbef7307bfd9ea8e0cb4b69196bfe0260067e8413b25e72aaa5804b4e60700ed3e54dd9ae591e500a8ea9f445d611243847f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
6944200c3ef608b3b6475275c32a84f2

SHA1
a800854991a4dd4782b8f6e3a8ae59787b1071c5

SHA256
3158d214e6c0f8c208b231d79bde337bb7e3768e6b8a69beee604f46dce7bda4

SHA512
9e8e7cc6ac5f98f485158c95c54f1459066b13d0b0ec41c972f288ca6c5fce4a12efad7af36b540c0a43f635650aaa36c83bbe215e90482968f012589b47c3ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
253KB

MD5
e134e7f2562afcebe1cab871478b5da8

SHA1
a6b15adbf0dbd79a705613d6ebaef5a5c58015ad

SHA256
be3275b297fdc24c764ebbfc46bb76e700cfa32debc834277228b8fa316a92ef

SHA512
61b6dcd694a8f5ee17c497aa7d11b4d9fb32538a9669fe41db83ea9a9999eb54e528dca1b79ced2bbef2a09ee045a6d56c9477d2f137ddc0510a60b7bc60adb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
253KB

MD5
6122a5bf64cd6901cb6fcc372d314b09

SHA1
b6fc29bb3960771e45a1b45f3f6e1f63ad59fb11

SHA256
3f1541ad25fe14f7380f9c85e0211cc2d6d5bb383c63ac6f6ee76a4b3e52fbca

SHA512
626b044b948d5c1f6a7103647ea0ac85eea836e6b0a9abd299ec553dc541ebc3192d2990406fe2ab86cda343fb3f9895ce0b24c318e689978c90bae6c6dc3dba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
103KB

MD5
f624a65c820e7e18908939f232eacf96

SHA1
5a444dc9ab2b5c1a14ba27391f2429b9ab031f43

SHA256
30191ac0e922f28ffe0eb7035f82a60ecdb5c7b070d1738b900f3955da7dbe2b

SHA512
ed3cefd92a45fabc7703ad340093cc0789b47f19b1ac6f55453b47ca18430ab8260879046139cc76ed71e676fdfc37d468218980cafae4085d9a6c8d6d85ec54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58c01f.TMP
Filesize
101KB

MD5
ca47b10b502cb3f3f6d8495c36be38ee

SHA1
1d932f0629359a075d50e9460bdc5a0e1872872d

SHA256
c33edfe7dd8bc669c95d758d3286b508da8bfb791cbc4204d1cb638bfaeb0f98

SHA512
421a725843382be2cc67a2522831c1af9dd9eef6a70188330da18c573dc1d2cbc6bec1cce1f9a0ebf53867a0139d24e59f56078989c4ac8e2773016ffeffb6c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\crashpad_1148_FKNQYJPSFMFVHBYL
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit