f1aaaf3ed950566562de5f1f901f903b338e7cd25f37c0396b747ee25cc1db0f

Analysis

max time kernel
179s
max time network
494s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tria.ge bootup.txt
Size

15B
MD5

a7ebfa7b44ef302bbda891b6916f6244
SHA1

60fb369b3a9b2aefb3c11834afb9e2757a059eb3
SHA256

f1aaaf3ed950566562de5f1f901f903b338e7cd25f37c0396b747ee25cc1db0f
SHA512

f8af483afcf0fbd573cd49248833ad2f54fc8bf8cd74b5961ca9642b0d06fad5e6bb65cfe0be80918071ea4f74a5a0a323b2a7fc3be7b85974e7b5a31a90f6b9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2248	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2536	2004	chrome.exe	29
PID 2004 wrote to memory of 2536	2004	chrome.exe	29
PID 2004 wrote to memory of 2536	2004	chrome.exe	29
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2380	2004	chrome.exe	31
PID 2004 wrote to memory of 2292	2004	chrome.exe	32
PID 2004 wrote to memory of 2292	2004	chrome.exe	32
PID 2004 wrote to memory of 2292	2004	chrome.exe	32
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33
PID 2004 wrote to memory of 2460	2004	chrome.exe	33

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\tria.ge bootup.txt"
1⤵
- Opens file in notepad (likely ransom note)
PID:2248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7679758,0x7fef7679768,0x7fef7679778
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1288,i,14371257867262029439,12717365034962332075,131072 /prefetch:2
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1288,i,14371257867262029439,12717365034962332075,131072 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1288,i,14371257867262029439,12717365034962332075,131072 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2304 --field-trial-handle=1288,i,14371257867262029439,12717365034962332075,131072 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2312 --field-trial-handle=1288,i,14371257867262029439,12717365034962332075,131072 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1384 --field-trial-handle=1288,i,14371257867262029439,12717365034962332075,131072 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3260 --field-trial-handle=1288,i,14371257867262029439,12717365034962332075,131072 /prefetch:1
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 --field-trial-handle=1288,i,14371257867262029439,12717365034962332075,131072 /prefetch:8
  2⤵
  PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1628 --field-trial-handle=1288,i,14371257867262029439,12717365034962332075,131072 /prefetch:1
  2⤵
  PID:1068

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
194KB

MD5
f5b4137b040ec6bd884feee514f7c176

SHA1
7897677377a9ced759be35a66fdee34b391ab0ff

SHA256
845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6

SHA512
813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\69e32e79d89cd4ea_0

Filesize
280B

MD5
6f967db7c1fb5c4b08a0aee04d5c33c3

SHA1
b18214242ea53d720f68a99e817fffac50863d68

SHA256
11348eebf367fa6b45fef0086994fcf3b43c2d1121f384866bf1cc3f2546ec29

SHA512
ec5c857ee21c2d23f3d393c8a5c0534c83d0c549df55208433bb18896a1401e8811a7c2355429067c74fb1847b09e0ac1c71b3b0063213a24cbd76e896377757

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\a7a39eb11ffe0d37_0

Filesize
18KB

MD5
e11823c3bd91e5bf7871829b0be4da47

SHA1
7ed58970d9462c7ff5df037acc65a0aa9b483176

SHA256
c0ad8f81ab5fe47110f26afdbef2766c5407bf4ba5d078c276bc618126c05245

SHA512
ae3f0fa36b96658c8a629a487d279e1f5a4a0416f12783aeaf49a6cfd6a18567732d7f79dfd2cc1f0a091cc68961f04f704aaefba4dc41b15f7db652b53d3e45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
8a5f93f6dc6ac961254441631bff0766

SHA1
45c2a8aa4baa81830d48eb6d477bd6fc695ce6ae

SHA256
af80c04a6f9f94bee524d8889155732a62497e0401d0193c8e6bceb23ed7939b

SHA512
7b11c3283b853b8a66f01865df9d5dd204b294360dd73ff6b630f86e70c8c2260087dd3334b88d867a5565a355fbeb851f60bc0456fefdf4f2fe51019fd27d47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
24c1ae29d862a1a63ccce14dc6b15eb2

SHA1
ae84369b434b7ac47969529236461b770bbcdfcc

SHA256
c1366d2a4af19b98b2b76d627dd89255812329d2a49c0814b00f0c7abf1bba46

SHA512
0e570e193e7d875323919441ac3ba8c67f50be897519a4bc2776ab890fa87aed30ae87569ae125b94c4713cf8c1c55a613805c0af814b34f84d08a4f47b53085

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
14c081178e0561bd107964d8fc11853b

SHA1
28fcd3ff5209b55af956821a06ba162a4737bd7b

SHA256
8c0ab1d0234df326a8555ee65b2a80eceb398e95420c9872f48c956f200b971e

SHA512
3ce2fac8737c69e118eaf3849bf5b71e9bc503c970da89e41663997d23330a3c556aa67b38e37b836a3d7a4e68f707a47013012374b2fec4d0b642a8dea6aa40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
9b23d25c44df2409276f3a2bb5e2f179

SHA1
aada83d50c3b7a21ab7f3ef27ec7b69b55e83f2d

SHA256
1a5cf7abf06b9f4c8b9b561c439bcd8454f97cc8ed52990591383b40f5a730d9

SHA512
092ff5e71e9d51d86ad60ca0810c1211254b884eae6646367e72d32be74fd4a81d69c5d0b40814e0c095f88f58c6bcf2e606c1d5b134eb5dbce6686cdfaa6565

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
c96c02e3e7770bc84fd6c85a97993ec3

SHA1
89982dbfa3f12219cba316d3e5d5c0bdd919c674

SHA256
e8de747919ef09c121e0361df4dc54ec99f79255a98653f6978fb33d8a40f4b0

SHA512
2d20b6783cb62ce829b5b514deb143dfb4413f53334bd281bc6893752ee2604244df8bda568a4a3350dc51e64ad53efdd4454d9218b92ca420223e47214bb3d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
1fd8c61bcd819703c970745e0a0145ba

SHA1
130c81d7f120109fd148d3069b167d71617e95f2

SHA256
49c56e429f227895828a9960b8967f8a7267c929aabc1b6ea885b391dc272b13

SHA512
f2ecdb05ba90f782d032d291a5189e00085ed1c525fcf3c408f0285e2d84951e80ecb161b689ce2eb45135a28087224761bde9ba67e2ef2b66c7a0d9d12f06d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
7d49da571edad07fe5e3303ccc3fc148

SHA1
3f7d0c2a006019aa53784da23e7658e75e7468a3

SHA256
67ead731d9fd9386033fd2550af2ee017cbcd433939f2bb94577f17c3afce595

SHA512
002d369d6f4236c6eb5d4a4425232e7332deaa421d09ca1f94debde7d7a2ad4245fceac4651fd48987c179fd69caec8e384def195933df8308b917840b542e96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
a5fccfe4a67be6c4656093b018921be9

SHA1
01d5f16f4b808af174962ec45ddfd828d0ec5b5a

SHA256
82c7564676f48b29d971830ffce06725f8dd4969ce345e62ceed2134274affeb

SHA512
60335edff6ad48cf473fc4cf198bc271c31fb18f6449d732fae56adff6dd09ae65ebe6aee5f7806db05df5b4d71921a2e891cc763f6d0fa1afc53e8845c097b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
b4bde03d92b0b7b397f3f72583601b01

SHA1
5f8dff2b9337d291f911d7fdfe2b54cf7c7bd02c

SHA256
7085b550013cb24b152e6278243607177b8c1240c49825d7a05b88767647b855

SHA512
3775310ea81b7e94e279e9e766765ebddf6402be27f07a42c903004d82cd529499cce12c1f88c3efe897991ee87b0dced0b956cec469dff99621429913e85678

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
1197a23289d783a2b850b6f1aae17ff7

SHA1
0d61af30875c2ce66d2337951d9d28d0f2ef0423

SHA256
8e0e37d816eebf3168509cb10baf509bf95f75d91d8cb47cc61f1da3c7acfb06

SHA512
3cf0792b9dbf710343f1454b1583cb694af21d4ce8365d45c0a3a4c61e3751d0734022e516baec7b75d28cc478bd4a40601af8e9064ba607a3cb2f010e42fc68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit