2a45e44be359fba4c85591e7b13d1ec772ed181adc41254d8b00d31b2d15878e

max time kernel
114s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NoEscape.exe
Size

666KB
MD5

989ae3d195203b323aa2b3adf04e9833
SHA1

31a45521bc672abcf64e50284ca5d4e6b3687dc8
SHA256

d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
SHA512

e9d4e6295869f3a456c7ea2850c246d0c22afa65c2dd5161744ee5b3e29e44d9a2d758335f98001cdb348eaa51a71cd441b4ddc12c8d72509388657126e69305
SSDEEP

12288:85J5X487qJUtcWfkVJ6g5s/cD01oKHQyis2AePsr8nP712TB:s487pcZEgwcDpg1L2tbPR2t

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid	Process
2912	chrome.exe
2912	chrome.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

chrome.exe

description	pid	Process
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

Processes:

chrome.exe

pid	Process
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

chrome.exe

pid	Process
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	Process	procid_target
PID 2912 wrote to memory of 1336	2912	chrome.exe	31
PID 2912 wrote to memory of 1336	2912	chrome.exe	31
PID 2912 wrote to memory of 1336	2912	chrome.exe	31
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2352	2912	chrome.exe	33
PID 2912 wrote to memory of 2216	2912	chrome.exe	34
PID 2912 wrote to memory of 2216	2912	chrome.exe	34
PID 2912 wrote to memory of 2216	2912	chrome.exe	34
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35
PID 2912 wrote to memory of 1600	2912	chrome.exe	35

C:\Users\Admin\AppData\Local\Temp\NoEscape.exe
"C:\Users\Admin\AppData\Local\Temp\NoEscape.exe"
1⤵
PID:1632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6c49758,0x7fef6c49768,0x7fef6c49778
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:2
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1532 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2316 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2340 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1452 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:2
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1432 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3492 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3612 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4004 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3832 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3956 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3880 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3584 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:1
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3636 --field-trial-handle=1284,i,13692216150834299700,9429475576667777639,131072 /prefetch:1
  2⤵
  PID:1936

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
1dd6b635ca740de6ac94b06f26028ef0

SHA1
d8e2978b4a020d004a12a7e6db6e98f5bbbdf43a

SHA256
e4259840f7fc9d7e6e97e3facd331ea7ea6c650ca18abe83b1a7977a89d94a91

SHA512
c519b6aae514f260123da7e86bac04421b333575ae70ea6e1b2cecf6eb191152739399c72fc632e65dbbc27afeca86e809db6a7dd63f50415ceb5e432f451a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
754c4a786346e8f3b4dfee583c93e9a9

SHA1
7241a82f352837de01588f4fbb29ac3a1131d8d5

SHA256
11af8cf4fda0203876d5ba9207771015bc00c95d79a33d81f78b0f101c2c7ec9

SHA512
8e8c801b60308b7af5c108a940cfab9d81b416cf4dde0c5c72fb6a8edc714e3b572e78b2772c6232a13dcfe467bae30043e6512dca4ffa02c0ba6812d56ed7b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
b8e92d24f114c98f369711f2d407016b

SHA1
8c290879735ff187c10b12300f15b8a75770ff03

SHA256
09587932f397bdf266f7e2853b0d16ce43934d2dee46ed994504189669db5bc0

SHA512
63328f86676640ec90e58057c03d5eecd44d22f454c3a49218a48529ff592947298e5a2be634415b5bb7c74953dd440de5e3c778cf910e50a25647565ac7e110

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
cadfc09c005ebedee0a5451f82d2ea51

SHA1
dbdceec8e2c32cb36d3db9d15a451b0631884bc9

SHA256
bcd4e1bb0aa982de0bf9227329968a26af611e2bb0595af7e2fd2de2f2c4796a

SHA512
508abf433c7ef39a2b75d497ec040e2af64a445aa33710dec20cf2cfa20bef30cd313927637f2ad8123404c93e6be40ecd73118e4895b07f1b69c6886392d160

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
7fb2db8997a04129922eb18ef6d447db

SHA1
8142e2656fb878f0abb6655348b95e56f6159624

SHA256
1f37597fc3fa0a92171b4c9afd18d6265b00c31a3b7e5f500975079bb5931b40

SHA512
75348db8ef68debe5a19847e7c55ba6c06a4b30e563d4f704a7fc1e3a5f0ee86fa83f19f6c43554928814fc0a706920ce79e29ccfdf0bf4bef4c7e461ec67423

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
266KB

MD5
f7f99c28a816c535dcd2520df2ba4dfc

SHA1
8f4d24ed492f17c9241ef455d74314d8ebbca207

SHA256
364600651ec4f3983abbf72b100ef0046ed4d47cca65a05464dbf14f42f8a7f6

SHA512
4eca22f9bdb98033b1e6b82c0ffd94c13965271d8b09e628f1d2f99d594011788f1fcb93aad0133ad9840bbac0a86bd226e0b77c775d6794ab13c3be5eff750d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DBC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\??\pipe\crashpad_2912_UOWEQOUOSCQCDCQX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1632-0-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download
memory/1632-1-0x0000000000400000-0x00000000005CC000-memory.dmp

Filesize
1.8MB

Download