2470895443a4678d66bc39158fca6775343b6d1aa6e332bd8229892d1a2bfffd

Analysis

max time kernel
1344s
max time network
1176s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
26/03/2024, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

OptiFine_1.20.4_HD_U_I7.jar
Size

6.9MB
MD5

35bb67f2fa6e6e0bcbff13c23724deee
SHA1

f2475e8d5746477d1d2972cd5aae62a5d9c04264
SHA256

2470895443a4678d66bc39158fca6775343b6d1aa6e332bd8229892d1a2bfffd
SHA512

acca2b7348925a378e1d0c85882fd276df834a96fe541d488dce831e2ffa9dbc868aa160b872abb8fe511b4ef6143da33776e5d8bf4599083d1d6b23de765d6c
SSDEEP

98304:ZSJGFWo77Qgj248F11/r1Acy9BuXrluT4PkLBIV7MfzPyAvl0APaoq05:rFWo7Mgj2lvrO19BufPjVcPV2APa9W

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
228	icacls.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133559395072975130"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2120	chrome.exe
2120	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1548	java.exe
1548	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 228	1548	java.exe	80
PID 1548 wrote to memory of 228	1548	java.exe	80
PID 2120 wrote to memory of 4512	2120	chrome.exe	87
PID 2120 wrote to memory of 4512	2120	chrome.exe	87
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 3804	2120	chrome.exe	89
PID 2120 wrote to memory of 4464	2120	chrome.exe	90
PID 2120 wrote to memory of 4464	2120	chrome.exe	90
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91
PID 2120 wrote to memory of 3092	2120	chrome.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\OptiFine_1.20.4_HD_U_I7.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffae8609758,0x7ffae8609768,0x7ffae8609778
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1840,i,17640877887085558551,3970314733279481644,131072 /prefetch:2
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1840,i,17640877887085558551,3970314733279481644,131072 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1840,i,17640877887085558551,3970314733279481644,131072 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3188 --field-trial-handle=1840,i,17640877887085558551,3970314733279481644,131072 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=1840,i,17640877887085558551,3970314733279481644,131072 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3680 --field-trial-handle=1840,i,17640877887085558551,3970314733279481644,131072 /prefetch:1
  2⤵
  PID:428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5032 --field-trial-handle=1840,i,17640877887085558551,3970314733279481644,131072 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1840,i,17640877887085558551,3970314733279481644,131072 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1840,i,17640877887085558551,3970314733279481644,131072 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2616 --field-trial-handle=1840,i,17640877887085558551,3970314733279481644,131072 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4596 --field-trial-handle=1840,i,17640877887085558551,3970314733279481644,131072 /prefetch:1
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3308 --field-trial-handle=1840,i,17640877887085558551,3970314733279481644,131072 /prefetch:1
  2⤵
  PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1556 --field-trial-handle=1840,i,17640877887085558551,3970314733279481644,131072 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1816 --field-trial-handle=1840,i,17640877887085558551,3970314733279481644,131072 /prefetch:1
  2⤵
  PID:4348

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
c962ea4ca021b27716d916e9acd16f5f

SHA1
2e4be9a6de24f128a2cf4713c698943238388ca2

SHA256
0eafe9981500daa35e15a7b2ffe462860f5a8ecbadb5a420ee8045a2fe20ab41

SHA512
f48f25680ff2dd1a654352d0353b248d4a7d2ae84ec39cfc7851eb7b030c0443f91c50d0e0a5916d500ff311902dc04a1dfaaaecbf206e2ef068b6052c05987b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
097e78f690798171008b7e7068c77bf3

SHA1
362468512e68b16e5a23b2fa7d36e62c2fd96d26

SHA256
f9cc7767cb3bef516f9bd67ab1a9a6f4449015819e141baf8f9f44f7ef9aa6ec

SHA512
892b996d74b0a03cfe2baf5727e891db2ab331708014f8c36663b599c0e0936f9b0e1aebf67ee326b9c993e780f45c8c53a929c357b0f33f054cd49b765ef081

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
4b7f77878795d38beec21bdb69ef8020

SHA1
2239480f65282dbac660a31b57b6b187f4148f4e

SHA256
bf40c8bfd161c3ea925c8445491bb0b192e03ef0db6433d080a5f44f2d915713

SHA512
7e412de540ef2c211eaa863257a18b42171ffc3557d07cb2e881be09c4eb952b5520c88261a6e95f2ca7546300f218efa6c917ce60fc8ca8bb627a1ece07e25a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0fcf3364e394bd660c01544f39140146

SHA1
45d601c9579ab9783b99de432f94fd2f3d6796d6

SHA256
d1aa1556be5682cd83583b803f43cd7f3bc86bffc396303822750b4ee271ce35

SHA512
b80f142ceb3ffc4499f10aee65e8c52936e3b451335eb85ee8f14e5e2f92caa0734afaef339441f3c2a3c6d7a33ba14488f411f224fc1a9e3435027fadaea3de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
959031323496d69664da5309e450fb7d

SHA1
040e5f01a34466c13d54ebe18050bdebfd8ad0e9

SHA256
ac1fca704800c58fe4d272778ca296179a79da6832d243c9a5dce746ed81fa84

SHA512
2f7008fd688b6e3181e1906c1c89b1f422cc7a9c0a938d6752be706d2cec17d6359ff8c5a0deb870a53becad320bf5e9e503ee62dc09811636fc6fd57c64282d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
e2176201d23e50e0c556e28eed8f7551

SHA1
bd68e003ffb154c14c9d19c4987e4f8b6f5503fa

SHA256
745d650d4eb0e2844df34f5f6180e8b2898479195a3a61c1c6490f166e0ded62

SHA512
67b485591bdc6dc97ce067ae44cdf0f741e03811a372ef75b2c5cd5ec584ac4ffe0cf55c8f95eb959ab6536615e17dc7c04331c93e4c40bea0f6deab969467bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
df39b806e68f6e9bd5d68bea54e854eb

SHA1
06ee8a6638e4b84de7895bf3e27092c34c30434e

SHA256
ebdc1d765532f8fbd839cca448eba8fec69b893e05306d494bf7827d74c1cede

SHA512
6a437c0153fea11234260ca4f1b3dee241a0b714b5d651a8bde8adfd6aa3eb8145376767976711b11fa979c6b0d5f0146e37e4390edc5b630c559bfcdb86d236

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
260KB

MD5
528dafe69fba9bd60b4a65bbca9adc67

SHA1
4c519a864f524c9853bc3774a8c31163f33b27ab

SHA256
82eaa8e158b7090750636fe67d3c6e67e9158b814abc48eca244df66a14f5506

SHA512
53aa5f1785e049f5b5755dd038f8f74dc65c6a3d99d4a5b22a6bb682f29530eaceeb994ff506022ba9a3d75bb4d71d5b6e76b63537aee0d02178bf38f91c0b86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
260KB

MD5
29eb8b002b54d50d64495c64289a91af

SHA1
054f63f071d4e7d3abee576221cafd35eb34a72f

SHA256
d0e724650ac7bad235d490450f5c197cc45b3885146ab7da76b328ba2b6b0e3b

SHA512
f627ba83fc3442e931717adf8b3ce5a86e99b50b8f3ce8e5254a803a4b2eff91adebf91146645661a4f7fab00c7839047ef06f3433027413f0f2913364c98fda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
ab62e427a07a5445d265fbe75a2f6d99

SHA1
63d02592edf17bec682a90b1cf51a4be1a932ae6

SHA256
d8080bc00bc65fd5c46f41cd90ccca34e4c9e5f19fcfd26df0916407e4408ae6

SHA512
fe18137ad0200ed67d218185c9eb621ffecca3f20418f3f9c757d5ee6ef3e0e93126145ab38511b593a1ff04c33deb4ad204e4ed194158fea4471467467488a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
memory/1548-46-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-31-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-3-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-77-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-36-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-86-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-88-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-92-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-93-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-94-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-95-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-60-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-115-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-29-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-21-0x0000023DD59A0000-0x0000023DD59A1000-memory.dmp

Filesize
4KB

Download
memory/1548-16-0x0000023DD59A0000-0x0000023DD59A1000-memory.dmp

Filesize
4KB

Download
memory/1548-11-0x0000023DD59A0000-0x0000023DD59A1000-memory.dmp

Filesize
4KB

Download
memory/1548-216-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-219-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-226-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-232-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-234-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-236-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download
memory/1548-237-0x0000023DD7240000-0x0000023DD8240000-memory.dmp

Filesize
16.0MB

Download