hxxps://xekudi[.]wordifysites[.]com/ndrive/Payment[.]pdf

Analysis

max time kernel
83s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://xekudi.wordifysites.com/ndrive/Payment.pdf

Score

6^/10

motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 2 IoCs
phishing motw

Processes:

flow ioc

32 https://ring.com/users/sign_in
32 https://ring.com/users/sign_in

flow	ioc
32	https://ring.com/users/sign_in
32	https://ring.com/users/sign_in

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133565450578709481"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

4240 chrome.exe
4240 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

chrome.exe

pid process

4240 chrome.exe
4240 chrome.exe
4240 chrome.exe
4240 chrome.exe
4240 chrome.exe
4240 chrome.exe
4240 chrome.exe
4240 chrome.exe
4240 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4240 wrote to memory of 1916	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 1916	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2340	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2544	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 2544	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe
PID 4240 wrote to memory of 448	4240	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xekudi.wordifysites.com/ndrive/Payment.pdf
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff928b39758,0x7ff928b39768,0x7ff928b39778
2⤵
PID:1916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:2
2⤵
PID:2340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:8
2⤵
PID:2544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1804 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:8
2⤵
PID:448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:1
2⤵
PID:4776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:1
2⤵
PID:4008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4656 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:1
2⤵
PID:2456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4804 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:1
2⤵
PID:1708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:8
2⤵
PID:3728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:8
2⤵
PID:3032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4664 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:1
2⤵
PID:1668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4764 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:1
2⤵
PID:1144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5104 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:1
2⤵
PID:3996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=6084 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:1
2⤵
PID:3636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3268 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:8
2⤵
PID:3004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2468 --field-trial-handle=1864,i,16060730519791956921,5629536655914374513,131072 /prefetch:1
2⤵
PID:1928

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3360

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
6f2d728c190ea4daa7d139d1726fe5bf

SHA1
441eb7890279fef9e61bebe51b6f51abba632a83

SHA256
3397e0495892e42d07c53f129dbeece3b32f243d80ddca3fea3cee1cb789c5fd

SHA512
9e43639d5830fbbbeb4cfaccbe52cb8fa3fec961f2ca00b2d1fe1719a074445a58e70f93bccacaef29f1c2dc630fc8167e57f363fc9e0915f1264c4d94a9bd79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
dcc15f9d35abc1d3f5c028283a8d715d

SHA1
2bcb80d73b6ab2b7a8f9381939ff5d7c52207464

SHA256
15a4c4fc899537fa6915efbe2a20162489b0bb009e160b71813296d7f6cd31d1

SHA512
56abd9df0d09ca89250a35690b6302dd66c170735aac336f0b9829942df216c1ea66ac2fd1020c68cdb8e6b5a723ce9d4c2311f8f6576ff24c6879285a6dc00a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
17d2d81a944ab256c2ca7ff98b573f09

SHA1
c0358971e63a7256f40560b843c954607daf3814

SHA256
060e8b0c46da3e0bd64fd0f4cabc48ace45070311bd68947f4a84d929d6e9295

SHA512
2a5087d15f6a9cb0085b8ec080120308df1a70835cc044a2944e8ca2e1bc7c2a6de9fbb3e397eb64dfdc6b69969ea7c0152e356842723c40053b837394f75e41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
bda4f0b91e1bce52aced9d6939b166aa

SHA1
9de205138594edb2ce55c2b81202d477bac26f97

SHA256
eee60bd1c3a26828def44ff263b7e39aa066bb40095db2d959c61766e911b285

SHA512
38ab30f95a6c4e164c3a661371e34a51925248db01113808bd3adae441155cac3ee17f2766b9a8830bb0ada3448807ad43af4d8cc1c46699e468657d4eb465fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
706B

MD5
43104526f2221c7a79e2aa5d99930ea0

SHA1
e172ce75033f52f17d34586e6e054f02c68d784c

SHA256
7a0cb96882002d673db80a8f7b051333c34c710f84d4077b1141c1d90367ef29

SHA512
c69765efcecffe266ab12860924cfe73644e9fd3113c7129e169a23c3b1a1236a72aaf609c2012fd8245050e7e5eee697b509c4e25a9962f6e103dde3951fc82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
fa7785f83e2487e9aeba3ead8e8ca012

SHA1
77cf503c6bd817a95efcdc6837d155837e9d0cc5

SHA256
d81a4842340e67477b62fedbd6e765763da8ed4aed9c1398af3e1fe00bd18302

SHA512
72b1ed0eaf52296ad34d330be7b53263e10bbace43076cd01e89c68b055bee3aaf3f728ed5e60d8aaa3c7e69e2248113272693217fdb6aa94fdd6cbc95fcb89b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
faca1f0e858afb2aa899dab85b217e91

SHA1
fb4e2711904baa27b83da1a2ec30cbc4be435922

SHA256
328da6a34608abb13bde5cfdcc93483fefe180d8e8d361efd1a508cb3c2387c1

SHA512
bfd2c1d91db9b4bd94be0c0d4268ff8db81e9ab9db4e785d0ed3d5ef18a32fe6f05a6826b4705a03459b7bf72a925d1bcad3b5dc53ebe8e313c0d802584ac62a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
b986c75fd6a21a6ebfcd8631226e14d0

SHA1
a44361e3ccb940d6675fdb003b97c5f300b4dfc8

SHA256
57666bc63ca560b411a2c0f0aa9f9ad9a391791b298a1fd4c38fbecf734b3713

SHA512
48e377a6c9d47770116cd4116687c78dec39e0fc6c0591262d2a01db3e32722077667ebf91118a06245af206d0acbeba12da2ef98e450ebe82bd64245444261c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
f825f3f9c45ed5179c4ad02e5e141e41

SHA1
05ace05dfb583d3c65e90c63ff2883a4e4a73868

SHA256
dcf200a64c1c12855427d6a2fea1a6e5db21f6ac5d903f9f186e2a84fd7eb43a

SHA512
bd61216e6db7223ed75918bb50fa4f75b0f10272a6f83c24fe66e3cb2a3c74246a82fce6cee82f32a2f026786110af3417c43781084ee77c776928b47a454f3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
c110484fef9c82458865161099cabe15

SHA1
dd231f1f68d225ec36f2b58c23769749eeca71b0

SHA256
0af9359e8acbf04e9976c1582d60c4a8fbf827a1b6664ca719daf65df5ab6714

SHA512
8390e8121aa41e9db881dbb75805fcbe2de0a822f0c6e8e19fff77dd0922ae950d72e3122ff066f955f4bdc4f447999ba1db0b62abfab97a06815d3d48562bbe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
128KB

MD5
947e88e45f277b828e856c412ff5d9a6

SHA1
b284f958bb18221c354ba453d3553b5eb648c33e

SHA256
7363eb198fe36bfe084f58b5b3dead8e005fb13fd042b7211654ded84b1a6762

SHA512
e3eb4155c614013d97d8a4fbb66d9ec0f2990432d88afa025f28078a288276abb597cffe6f6114450ae68086d5bf6706b607d0e39fb270a8a7d593fd2e06e792

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
103KB

MD5
156446d25bf02408d62811d2b3e6ec20

SHA1
ccd3b3e9081c7b1e1ecdff6823d13a16b900986f

SHA256
680d42848142a1f4c41ab132f6448119bbe1ad5a5ac9e6ad946ad595a9a7d627

SHA512
ab50524284567e3cfbb868c451571ceac57e5c054b5ba5d76b1d9a8f1bcef340b1efa654bc2b44a21b6481db32884f8c5f9886d7dfebc936e9c4a6fb6f28f813

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe581e03.TMP
Filesize
102KB

MD5
5d8973fb0b08c661bd94ef70035273c0

SHA1
7cdc4b7b8c567fdd9d14d4413a3cfc2219d687b9

SHA256
db3fa2a2296cff3d0b01be3139871d00ffae968121c05e48f925abbf426d0067

SHA512
fee7ea8471570b73f74d327b834c80f82cb8f996efa77bfb08f5c8f04ae6158e160641c84af54606d659fe6ec733c8b7928341f178d7a590b578dc52d79ce436

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_4240_HGFLKVDHJGXMBOBG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit