hxxps://cloudflare-ipfs[.]com/ipfs/bafybeihqpv2xjao5yqspwjjmbexcmroixps3fdmpkvfs3ejavo3jczpmqm#reda2@redar[.]com

Analysis

max time kernel
42s
max time network
47s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
05-04-2024 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cloudflare-ipfs.com/ipfs/bafybeihqpv2xjao5yqspwjjmbexcmroixps3fdmpkvfs3ejavo3jczpmqm#[email protected]

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

4 cloudflare-ipfs.com
2 cloudflare-ipfs.com
3 cloudflare-ipfs.com

flow	ioc
4	cloudflare-ipfs.com
2	cloudflare-ipfs.com
3	cloudflare-ipfs.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

3268 chrome.exe
3268 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

chrome.exe

pid process

3268 chrome.exe
3268 chrome.exe
3268 chrome.exe
3268 chrome.exe
3268 chrome.exe
3268 chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

chrome.exe

pid	process
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3268 wrote to memory of 2772	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 2772	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4392	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4044	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 4044	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe
PID 3268 wrote to memory of 3876	3268	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cloudflare-ipfs.com/ipfs/bafybeihqpv2xjao5yqspwjjmbexcmroixps3fdmpkvfs3ejavo3jczpmqm#[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb419c9758,0x7ffb419c9768,0x7ffb419c9778
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=232 --field-trial-handle=1840,i,17904705290377227248,1672037965128085332,131072 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 --field-trial-handle=1840,i,17904705290377227248,1672037965128085332,131072 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1840,i,17904705290377227248,1672037965128085332,131072 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1840,i,17904705290377227248,1672037965128085332,131072 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1840,i,17904705290377227248,1672037965128085332,131072 /prefetch:1
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4296 --field-trial-handle=1840,i,17904705290377227248,1672037965128085332,131072 /prefetch:1
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1840,i,17904705290377227248,1672037965128085332,131072 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 --field-trial-handle=1840,i,17904705290377227248,1672037965128085332,131072 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4588 --field-trial-handle=1840,i,17904705290377227248,1672037965128085332,131072 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3388 --field-trial-handle=1840,i,17904705290377227248,1672037965128085332,131072 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4632 --field-trial-handle=1840,i,17904705290377227248,1672037965128085332,131072 /prefetch:1
  2⤵
  PID:168

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\90c634ae-0a97-46ed-a6f4-6c77106fba4e.tmp

Filesize
5KB

MD5
08316fb969abee27b04789dcbaa94335

SHA1
c623754efd0ba4280877d04d37bc1b80cd887336

SHA256
968dc3a5922721b7dc58a16ff28fe15c90816f4c3627dde63c6ba1b3156914de

SHA512
3835023a58f552d8665d75b5fa12b8ce6b2149f8008a05f988c9c226dc6e42011a74894f20d7b77171f1a20f2b8d5d882ca91ee1d91df7d9ce2bb1c1203ec8f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
f9a988ce5d73cdd9576d94ba811f8ae7

SHA1
0f7b1d8ee1447fc002e81a4c359e39ea797ccd64

SHA256
bcd5eb9fa9be7388a024b5333bd5213e26f86087247c8aa6b95b2f8e0a64b288

SHA512
b8dd481a6f7e6f2418924a95be282eb8b9b13e7e195e9266f6b8ff34ebbbc2fab8bfa05d173c3f6a1aae3c2d927be58fe3564ba210be33ee3d44680610f6db6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
2557dbb7488fe25f75b50962daa839b9

SHA1
d4f396515fb967b70faa87e0dfc1a79c0b623c5a

SHA256
3786cae18f9793ed3d4b0e80fc194108042ca890868f3184d11195d8303ec554

SHA512
fc39c54e1656dfdcf424dcbd335bdd01ba2ef2da8dfe475aac61ef4870e625787f943083064f9226cf66d8004084294b862e109ba1dcaf3161087bc823d6768c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
f0842be1fd400b8df9fe88d927b8895c

SHA1
2671f8228b583b7c83f6b3e3c6e520957f32a162

SHA256
7544fb552801fb7f3c66485fc2eec13ad63400377e8b46c27fa7c36201b6ffbe

SHA512
f7bdda4b955ccf96c6bb4fc7a2e2010818ffcb87afee122d11a5a8c9506a6086ede399467280bc8d475dd6fed13c62e739811ccb876fd9681a62cf50c5d94392

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
872B

MD5
a8f1ba4111fb0fa23ac6d1c1c587ea7a

SHA1
b75242e43b7e1a87ece2b0068425faa04efc1b6c

SHA256
4430fc557468509d49a2a2671e6fce5682199be46c1d4871d64f216034aec66d

SHA512
428a076afc6115d129d96f4c24a684b8d5033477c80e39375cb197fb7deb3aa2f42ca31b058e6a423e7c6a228fb8ff7ff2be2bbdd7c386e90fd8bdfb493f9149

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
065b6691f0139a5238f808a482d48ffa

SHA1
3d875018d2366044bbb0c1ae7b26d397f515ac43

SHA256
7f32e8a6e33c30200550fed5d72d20226486d903c2990f996878339fa0bb51e9

SHA512
e4f9592fa4e3715e6e70da372c1260535d66063d8156656e281a5eb7df01a37285deaf035a98234dd398b4f65ddbe846bdf94bd6839938082f669f4ef0f41bf9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1da1dd369aaaaad73486d7d4697e1bc7

SHA1
e0149b7063759cdfe09776f1568d2b795ccb6a3f

SHA256
da431fdb6a1950966c828dc2335f3d77adc239c1ce5477524d6bd1f259d11db4

SHA512
48b1472fd18f2c8e72557e14ad8571530bf75cf4a12637dbabc40a863779df1d83706f9838a0b3b4b538eb9de9652bd3d5aee043ac30019daf7a25be6e8b6584

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1c41ecf5f9930e7f004bea27bbd3cc20

SHA1
eaa9154f9ad2aae2bce2680f7f9d9af13fe66717

SHA256
916f8f58a5008853fd6ec02713f0256b99cf8493be7e644e924ba8c41bc66f35

SHA512
15ddc2c891572a20c1f655ce76662c3c1c02f919523923b4b2f616a119c0a55279c4e36581e1bdc47641a887232c65b385a46a7b07a9c65956bf2ae14d9d902a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
24d1cc688b94b733b64fa70a3ea28c66

SHA1
e9b4060ff702ebd7ea609239e9769352b689aa46

SHA256
7cb1393763139aee55b1fd830912a5da5aaad8630087eae5279db728cb751ac7

SHA512
fb6504ecf183cdec05a4688e8cff0eb5235f3353ca208a8263b45ff80e236df23110867ac43908597d351d08e0f129dbef4ec8251e5ea049eb24dc6a352574cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
415d4c76481cd1558d3a7e375230ac03

SHA1
ac73ffec205c94404a7c66d3a850f72290048e00

SHA256
c3906a3070e6af85a7921383b5eae2b546b8f4583940779624b60049ca9dabe0

SHA512
7516acb7fce48bff5b8bab37cd68cd9788eff1bc675f14158f2b043a4757db1baa3440cb85ed0cc783b22d33b5f89a8599ab12c93d52fd0bad936d9b71e7e019

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
3a29a82981296ac0e467c4a333ffc537

SHA1
d692ba645b999411602448f53be8cef6039b5aa6

SHA256
de88a7c3abf33715afb4125ccdbdd2ac61f397af10f464eaa34ce15e7a305d36

SHA512
e9489c3dbbb312881501cfb7440aea9e362ced0724de83bcabb815470b4334d69e95fedfa1fed084c1c2729a020d9dd5b652a7bf2cbc9ceda5c55f989681a0e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_3268_CKHVSBYUBTKWHEJA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit