hxxp://update[.]iobit[.]com/infofiles/iu11/Freeware-iu11[.]upt

Resubmissions

04/04/2024, 16:09

240404-tl6bmsca9z 1

04/04/2024, 16:05

240404-tjytsaca5z 1

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://update.iobit.com/infofiles/iu11/Freeware-iu11.upt

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133567203733136761"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
208	chrome.exe
208	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4804	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
3196	7zG.exe
1800	7zG.exe
2312	7zFM.exe
3400	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4804	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 3128	4088	chrome.exe	92
PID 4088 wrote to memory of 3128	4088	chrome.exe	92
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 4676	4088	chrome.exe	95
PID 4088 wrote to memory of 1436	4088	chrome.exe	96
PID 4088 wrote to memory of 1436	4088	chrome.exe	96
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97
PID 4088 wrote to memory of 4352	4088	chrome.exe	97

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://update.iobit.com/infofiles/iu11/Freeware-iu11.upt
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaee4a9758,0x7ffaee4a9768,0x7ffaee4a9778
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1892,i,1909310181890249783,13880035582537230879,131072 /prefetch:2
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1892,i,1909310181890249783,13880035582537230879,131072 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1892,i,1909310181890249783,13880035582537230879,131072 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1892,i,1909310181890249783,13880035582537230879,131072 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1892,i,1909310181890249783,13880035582537230879,131072 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=1892,i,1909310181890249783,13880035582537230879,131072 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1892,i,1909310181890249783,13880035582537230879,131072 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4296 --field-trial-handle=1892,i,1909310181890249783,13880035582537230879,131072 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4408 --field-trial-handle=1892,i,1909310181890249783,13880035582537230879,131072 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=1892,i,1909310181890249783,13880035582537230879,131072 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4108 --field-trial-handle=1892,i,1909310181890249783,13880035582537230879,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:208

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1428 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:1588

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4804

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Freeware-iu11\" -spe -an -ai#7zMap24930:88:7zEvent12716
1⤵
- Suspicious use of FindShellTrayWindow
PID:3196

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap22563:88:7zEvent16929
1⤵
- Suspicious use of FindShellTrayWindow
PID:1800

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Freeware-iu11.upt" -tzip
1⤵
- Suspicious use of FindShellTrayWindow
PID:2312

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Freeware-iu11.upt"
1⤵
- Suspicious use of FindShellTrayWindow
PID:3400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\840fec08-51e6-4838-9fab-027b32cb0fed.tmp

Filesize
104KB

MD5
1650e2509a21aded5f8c6ad9b4664933

SHA1
b08bd01636546ed3d5f64ed5b3141bf377b0eee5

SHA256
d357245bb78a92a65b6819955ee373ff06831948913bd3ab49f0031004e77445

SHA512
09d5264c8417ded6313381ef33eebd94039e9fd0587c60e1ee9b3e1bed4bbbb9cc9a90c0375f81e80f3767ce15649ab4ca282eb7ae0d671651e75ea847b78d75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
56d69b14cf1d1f31829a9fdacde0ba60

SHA1
2c587b31708f15c443fac274300f13cfff3d0cb5

SHA256
19a3e2bb55e6ddfe75f6e1bd94c3533783111d37a0cb35b6643fddc43529437e

SHA512
d6eadc92dd2d686746b28597d16872935d9fa629ebc01d46c4494ac315567b89d4ad7c89a8d34ea0312568c4e82d61501d4c5e91179b3174998a5ff3628d5675

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
9c9b838062f8ba2e06839b5e0fd757a8

SHA1
1513cb23ad5c4c34288b35c36e8f447ae0afd4d9

SHA256
5e13f5dddbec5abc5c6e6434d927a22cc147d60a36792c919fb5917377f4316a

SHA512
104f8734b6d569854b70ddfe75bee32e8f6e506fb1162d44bf95b2a29b10476b6d09f1390cd5e81415ce58754d8dfdf7caa666b5049a375d67a635c729926621

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
e600bc610ed3880151529d5755b2fcad

SHA1
bb00db2d7ff116e2efbbd09a4c5139c6ec2f4fce

SHA256
1c75087771b8d84ca7068493eada62ebf49a7a4df6339b3819bccc75c2da1dfb

SHA512
9b257462409417ce117aa17f3a01b569857776a8be64cc5938bbd06050d58a2604172da4691f40369d23479ee5dc5b87f5b4cd1253c9b656f6025f956c29a3e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
1c957f4a6903af7e19b19cffea4170c5

SHA1
9d53ea576723da2ce14163c500718b280afdcaae

SHA256
7ad6ffaeb30c94974e10fbf1412b08e70e5d4044a01c51d63b28e9913b32fd1c

SHA512
124293089523bbea78eecb0660d5587b1b2b5c5658ba345d22be260f9bd392bf1e750e498c54f25136b76f004673bbe725828ffd5bb0c52019a62e02844569a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58de07.TMP

Filesize
100KB

MD5
b026c6128424f580d58df8dfc20f7d45

SHA1
bc6b1ab9ec7ef112b36eb8d72369db536bc098bb

SHA256
4356bf470c0972c0ec1ef9cd6f6a43847ac13de76eb1dd6ccdba2d8cbffab2c1

SHA512
0ad8806d6085a68db7f55274a1f3fe9da082f39df7281929329df8f9fe98800467c1422b0d17e0152bd5cec8efa486c13e5d8b59dcc3ecae6006fa0db2be9d64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\Freeware-iu11.upt

Filesize
10KB

MD5
7c865048c9680fb1fa4d72b40f0e764f

SHA1
7c0cd5266dbb930c8a608bebef64f722c0867a81

SHA256
4167fc87da311e48bb26c11b64634455ebfeb291d17304eeb8546214c284f54b

SHA512
509375277436a397d26578e3b87ba68aaf2150bdd719492ec2ef33b16c67ebad76b5511cd33ff2acfcb79d275b6ffc0a2f74264ddb9d49631c3dc90bfc15c515

Download Submit