67e68d1933e87f680f063203e7e243c33deba2dfdbcd2bb08e9205d3fff26fb8

Analysis

max time kernel
161s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2222-main/test.exe
Size

50KB
MD5

934b148407a5f93bbeed3d5b2c91edde
SHA1

208fa687dea4cae2bd7a15907834ce107aea2683
SHA256

00a6aee5810a2f37be3722b8c05c363e9954e782f49e558f451c4097bbd6f217
SHA512

4cd3d836a122a19888f4be5541c158aa8add24b6276d8d9ee3a120ea2d3cc9ceb72c284ae41d3fa8d30b6c4bbfd18fe97ef451293222b9b9c23d125d3a882c2c
SSDEEP

768:nCru/f9Iw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRiTWUOh:D1Tzy48untU8fOMEI3jyYfPifOh

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133546567517482718"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2448	chrome.exe
2448	chrome.exe
1928	chrome.exe
1928	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 1928	4180	test.exe	96
PID 4180 wrote to memory of 1928	4180	test.exe	96
PID 4180 wrote to memory of 1928	4180	test.exe	96
PID 1928 wrote to memory of 2448	1928	cmd.exe	97
PID 1928 wrote to memory of 2448	1928	cmd.exe	97
PID 2448 wrote to memory of 4612	2448	chrome.exe	99
PID 2448 wrote to memory of 4612	2448	chrome.exe	99
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 740	2448	chrome.exe	101
PID 2448 wrote to memory of 3636	2448	chrome.exe	102
PID 2448 wrote to memory of 3636	2448	chrome.exe	102
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103
PID 2448 wrote to memory of 1640	2448	chrome.exe	103

C:\Users\Admin\AppData\Local\Temp\2222-main\test.exe
"C:\Users\Admin\AppData\Local\Temp\2222-main\test.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5C44.tmp\test.bat" "C:\Users\Admin\AppData\Local\Temp\2222-main\test.exe""
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0x40,0x128,0x7ffae3219758,0x7ffae3219768,0x7ffae3219778
      4⤵
      PID:4612
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1988,i,17225223996083479104,1114750251258166163,131072 /prefetch:2
      4⤵
      PID:740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1988,i,17225223996083479104,1114750251258166163,131072 /prefetch:8
      4⤵
      PID:3636
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2276 --field-trial-handle=1988,i,17225223996083479104,1114750251258166163,131072 /prefetch:8
      4⤵
      PID:1640
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3136 --field-trial-handle=1988,i,17225223996083479104,1114750251258166163,131072 /prefetch:1
      4⤵
      PID:3956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3168 --field-trial-handle=1988,i,17225223996083479104,1114750251258166163,131072 /prefetch:1
      4⤵
      PID:1528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4628 --field-trial-handle=1988,i,17225223996083479104,1114750251258166163,131072 /prefetch:1
      4⤵
      PID:4180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 --field-trial-handle=1988,i,17225223996083479104,1114750251258166163,131072 /prefetch:8
      4⤵
      PID:3488
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1988,i,17225223996083479104,1114750251258166163,131072 /prefetch:8
      4⤵
      PID:3944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1988,i,17225223996083479104,1114750251258166163,131072 /prefetch:8
      4⤵
      PID:2248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1988,i,17225223996083479104,1114750251258166163,131072 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1928

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:4824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
986B

MD5
510a93d6415592d90a01f54189145258

SHA1
242ec80e6fec39b6f50cf0af9fc922bec4abd1a9

SHA256
f48c6f7dc11cb37fe84bb5f99cf63d1cb447e5e8aff8fc1d0f028fd217a362f3

SHA512
458ce65088d50a176cd1b244295a8826e3b1631ce2420abd81ff82542a0761fcc5b49f9781dae93ea818819e787006d8fff49fe1370ef62b3e2f987d503d9050

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
986B

MD5
3d47a127d50d052353dd22a192f13631

SHA1
612a331fc3453defb3fe3843bc9ac7435494515b

SHA256
2742902cd61945e421c76ed8d0e72b878706c95a573e4c14b3b10377907846b6

SHA512
1e58c08abe1191592ebd2874d9112a312ee5fc06986335fed691dda63e3c78bbb5902591771f3cc76260fc54f484db72fcb872a4f290ecc35f7ef43ebe9b2bc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
369B

MD5
2eb613d1a77c1398fe7f09233cbd63ea

SHA1
1e2d686fed0718c9d705dc9f45a9ec6184f468b8

SHA256
63753c9b127ac9bb3fc41e5122396a089e150f8646cba147374e81a98862eebd

SHA512
d6fa5a4103ebccd96c14e10b8470b1e7e7b2ee4c19c3bd4ad1d5163421d23f74e4a1a98341e2ead04f9e201c282a419a72a1ed683f981a490c3c8da8917a8c3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
6ef866a1d301eecb0eb7b9e54153bbcc

SHA1
b947c2207556193367185614fc2036972a41916e

SHA256
3cce1675bb7972a4d333006ce51aa28082deb7fdd73619566da0bfa96b268c18

SHA512
012c2d5dff5e01f36135030c5d6dae763863dd6913d94b664bc9fbfebe661ac1cb36314dbe8fc53ea244b731966ebee46f826eba23bf3acd9a62cc6c33dc0a42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
597745d81a3a8483a5d2eb600d0cdfd7

SHA1
e1536bf4678bf5470de59dd7953f82b4458d8cc7

SHA256
d558254e210b379886b30d5895d104eb141d384a5f725d0827bb40ed32b204ef

SHA512
4b921ca8eecf5309c6eae0f4599488ab6304b2c046a9b394ea5c5931f65d9fc1beab6e567f6bd7a9f5f13cc85b2e4d40ed44377082893ad6c726bfdb2f29051e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
571f289274d6fb16696bf317c8af1dbc

SHA1
c6f90a6b5a6814c3e660e74f61df4599243f2f3e

SHA256
0885c825f0fc2a65bc1e4df416dc137439774840e2ca711f6cb32d9ec393b601

SHA512
d4286f029891a1fb0c107d8911bb2225c047cd51500e7518ab28d6334e1b930ee4e4179d988ebebfe30e54f2e2626a00259322a7321046c205e2388330c7b446

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
bc98715bf56df5372c7b57c89c674634

SHA1
9fd8ad161736a38e36a326d942f6db75f4f01117

SHA256
e7bb2298d7f7dc48e14ee9c9855d7a128fdae62f80b3c32de1bab006010cd639

SHA512
a1b774ff3ac26b0a72e6051230273d9ce35de04217a8eb7952bbcac0efa1549db0f9d3630993b8384f636b1c2191f943c1e22d484bb3fdbd0798ec47db731cfc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\5C44.tmp\test.bat

Filesize
25B

MD5
42ac200380fe0e83e8530221a5338973

SHA1
ce274c74a88d33f002831a3858180ea0e0dd97c8

SHA256
20a0c6fec7dd212aad286fde1bfaf9a26805adac4d694cf1c90ce1920b75f49f

SHA512
f846ad20777266854b69c6bf5f3f8c3b7db7a1ab5306bb4f6b7ba46446cf9b99e654bf1f6c244ba813d2a369432a7564ec2e87e819ed4ca8710ab986ef8bb439

Download Submit