Resubmissions

27-04-2024 00:51

240427-a7s4nagd6x 10

27-04-2024 00:50

240427-a65q3afd73 1

Analysis

  • max time kernel
    50s
  • max time network
    49s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-04-2024 00:50

General

  • Target

    https://is.gd/147852z

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://is.gd/147852z
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4084
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbf4246f8,0x7ffdbf424708,0x7ffdbf424718
      2⤵
        PID:3984
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
        2⤵
          PID:1904
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3696
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
          2⤵
            PID:1404
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
            2⤵
              PID:4644
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
              2⤵
                PID:3664
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
                2⤵
                  PID:3732
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:32
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
                  2⤵
                    PID:4568
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
                    2⤵
                      PID:4424
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
                      2⤵
                        PID:2480
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
                        2⤵
                          PID:3700
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
                          2⤵
                            PID:3996
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13574895955101746669,17955738664646597814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
                            2⤵
                              PID:4644
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4820
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4356
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                1⤵
                                • Enumerates system info in registry
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:1892
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdadd5cc40,0x7ffdadd5cc4c,0x7ffdadd5cc58
                                  2⤵
                                    PID:4424
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2060,i,10157416145900051416,2310313655197302560,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2056 /prefetch:2
                                    2⤵
                                      PID:548
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1796,i,10157416145900051416,2310313655197302560,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2348 /prefetch:3
                                      2⤵
                                        PID:5132
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,10157416145900051416,2310313655197302560,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2620 /prefetch:8
                                        2⤵
                                          PID:5140
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,10157416145900051416,2310313655197302560,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3156 /prefetch:1
                                          2⤵
                                            PID:5364
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,10157416145900051416,2310313655197302560,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3344 /prefetch:1
                                            2⤵
                                              PID:5376
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3204,i,10157416145900051416,2310313655197302560,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4020 /prefetch:1
                                              2⤵
                                                PID:5440
                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                                              1⤵
                                                PID:5548
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                1⤵
                                                  PID:5512
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                    2⤵
                                                    • Checks processor information in registry
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:5528
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 25457 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fab64ea-96cf-4af0-8271-930a365f0a80} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" gpu
                                                      3⤵
                                                        PID:5644
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2380 -prefsLen 25493 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8a177d0-f8cf-4435-b306-17c6562cadd0} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" socket
                                                        3⤵
                                                        • Checks processor information in registry
                                                        PID:5148
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3228 -childID 1 -isForBrowser -prefsHandle 3240 -prefMapHandle 3100 -prefsLen 25634 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47910aca-f8f3-4a15-a032-8f070bb41ec8} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
                                                        3⤵
                                                          PID:5216
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4236 -childID 2 -isForBrowser -prefsHandle 4196 -prefMapHandle 1324 -prefsLen 30867 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8ad8063-791e-4bd2-8214-77ff015b3c54} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
                                                          3⤵
                                                            PID:5888
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4724 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4644 -prefMapHandle 4708 -prefsLen 30867 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {110b6591-92fb-4ff6-a50f-0287c34db504} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" utility
                                                            3⤵
                                                            • Checks processor information in registry
                                                            PID:4320
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3944 -childID 3 -isForBrowser -prefsHandle 5072 -prefMapHandle 5012 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3da684e-bad6-4f4b-9ac2-6d05cf25237e} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
                                                            3⤵
                                                              PID:5444
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5212 -childID 4 -isForBrowser -prefsHandle 5220 -prefMapHandle 5224 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfeb311f-3830-44ef-b683-a07a164f70d9} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
                                                              3⤵
                                                                PID:5684
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 5 -isForBrowser -prefsHandle 5496 -prefMapHandle 5492 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4db36b5c-cd46-4c2f-861f-61e4e54d6015} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
                                                                3⤵
                                                                  PID:5736
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4428 -childID 6 -isForBrowser -prefsHandle 2732 -prefMapHandle 2728 -prefsLen 27069 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90393764-02fd-4e89-82ca-a0d1770d042b} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
                                                                  3⤵
                                                                    PID:1076

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                                                                Filesize

                                                                264KB

                                                                MD5

                                                                f50f89a0a91564d0b8a211f8921aa7de

                                                                SHA1

                                                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                SHA256

                                                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                SHA512

                                                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                Filesize

                                                                61B

                                                                MD5

                                                                4df4574bfbb7e0b0bc56c2c9b12b6c47

                                                                SHA1

                                                                81efcbd3e3da8221444a21f45305af6fa4b71907

                                                                SHA256

                                                                e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377

                                                                SHA512

                                                                78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                Filesize

                                                                2B

                                                                MD5

                                                                d751713988987e9331980363e24189ce

                                                                SHA1

                                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                                SHA256

                                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                SHA512

                                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                Filesize

                                                                8KB

                                                                MD5

                                                                e20aad9f402f3686d974327a69828b4b

                                                                SHA1

                                                                505217bd3c7607bf8de34f3103b9f93f2e02aeaa

                                                                SHA256

                                                                baa1728f1b8b07e61328b7cc890d7709a3054e2d484380d352bca209682060ef

                                                                SHA512

                                                                90dac7c2b68d6cce021e19290015025686fd2d0a1bd2bf8bc1bdb70aa0f93f2e61219c16f871a920ea027a220afd2ad04adb11b5290c51b6b90695fa034beb4c

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                Filesize

                                                                77KB

                                                                MD5

                                                                4a6db8e7a3493dd57ed035b76b7f3971

                                                                SHA1

                                                                64a5b39608c76542c3fe7ae885bbb2b95f98b690

                                                                SHA256

                                                                848d2d3e3172549aecd034ffb570e69c3eb1984fb5e4234380c4ad446e5bf3ad

                                                                SHA512

                                                                af363ce5d6c37fbfb2c75c25162a8d78f192125e16d19ff30082039c4e2f4787ba93583deb9017f18a342ca27daccce9c698e7651ebd05ce2f711ffe3575fe83

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                2a70f1bd4da893a67660d6432970788d

                                                                SHA1

                                                                ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

                                                                SHA256

                                                                c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

                                                                SHA512

                                                                26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                Filesize

                                                                152B

                                                                MD5

                                                                fbe1ce4d182aaffb80de94263be1dd35

                                                                SHA1

                                                                bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

                                                                SHA256

                                                                0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

                                                                SHA512

                                                                3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                7e774c77aa8248cf22e61dcbc4360bba

                                                                SHA1

                                                                88b0340e8d88b9f6174e46a5253c9da4aaf8ca2c

                                                                SHA256

                                                                5f9562721e8017218c6d4f2b9e4aef0063977993f8d02ed151ad4f090c1c5739

                                                                SHA512

                                                                0e4bcb00e57c0041f2ab586a93bc05464aba1caae371e514b2a12124080b0f98e685ac96119d80ccbfb1a59caf39cc496efe9524f2e7bef622abf2283c96a3fe

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                f6db00d2e9ea7c3aa14d075dedbba536

                                                                SHA1

                                                                1c7199256fbcd63e29cb4cd166f3ad623c9eabe9

                                                                SHA256

                                                                4c28206736df8efda4ee4f311def5a2103c420fad8f032b40505e93565adb740

                                                                SHA512

                                                                e21eff00695f68e3373ddf29ffd123fdf9b47e326f99b310bee78678f2df4683545ac07e3f14fedf470070991060ea966dcb65c9c4449bf46548ae241b784da1

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                Filesize

                                                                16B

                                                                MD5

                                                                6752a1d65b201c13b62ea44016eb221f

                                                                SHA1

                                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                SHA256

                                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                SHA512

                                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                8KB

                                                                MD5

                                                                ea075d5a97894673aa35696f264290cc

                                                                SHA1

                                                                887795daa2fc0ec0e0585f1b60ed881cca868c92

                                                                SHA256

                                                                089933194635c76e56739e6d48d4cc4b0a5471a6f450fab8e1531bd5d1903cf2

                                                                SHA512

                                                                f0fafa419e8e478c15b35a837b0ad64665c68f31188e596b67c54da5c3fa9df4a159414cb071a5e67ae86996c5561f8905d41ec908e162e6a4c32c57ce09890c

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                8KB

                                                                MD5

                                                                6a45f1b0ff3222a9397360f42729e387

                                                                SHA1

                                                                48d05e3a5ffd93d19018e457035049e687977be3

                                                                SHA256

                                                                34e1225a5d3c4076235234f0db59621c167a1e041387caf9f1e1742acfd7aef5

                                                                SHA512

                                                                a32067c5f3a24b623de1313cd86c374ccd783b954b0daf984709f5b382f9e1cea38d7fbc8d89c27c6d0611c7169c85d5b833313a043f30f1d9d61fccdf271899

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\l594d31n.default-release\activity-stream.discovery_stream.json.tmp

                                                                Filesize

                                                                18KB

                                                                MD5

                                                                847d35e6869a3a97c49069a791934cdb

                                                                SHA1

                                                                9bc198079f77d0fd64d6fc5af2607f3a52ae3724

                                                                SHA256

                                                                e3aa516b6cf5a07be98c9554e3f93f2c17af18e4a5acaeb42a0d080975046ec6

                                                                SHA512

                                                                51e4b790c6ba7bc0a3ea2c6672b04fcfa19dd871792a55d9ed6c490bcb9088fb41d51aa9f15a51142e3860ce17a47fe183ad0aaf03cff5022e21e694da071bbf

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\db\data.safe.tmp

                                                                Filesize

                                                                22KB

                                                                MD5

                                                                30b0a06d1c810e730107bff293dcdcaa

                                                                SHA1

                                                                a5971530be282012cd1c625ca8f3b76bd4fd77db

                                                                SHA256

                                                                7b0dd19d3d02dc2bf0454ce452f16f5640c0dfde170a17a27a2712c502f8792b

                                                                SHA512

                                                                7e603d0c4d469c6096efb79b6127003accb584012b9bef8cd4e1579c2f7bb73fabfe1c2f13a447b3fd29f94dfefaac5da1ee0b1cd9e872b24ba353248bef2aa6

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\db\data.safe.tmp

                                                                Filesize

                                                                22KB

                                                                MD5

                                                                c984b3e484b274336d84725c54843185

                                                                SHA1

                                                                e1b339e95079430e642208049fcda96d92a3f808

                                                                SHA256

                                                                23ef9c334dd7eb4eb874e48fe6777ab3766996e392ebe4ab6bd4d62f188611f5

                                                                SHA512

                                                                0cf4ffc6bef112a63fce06fd0be1e8b761fcaaead9f95bd843fcf59713568ce7f7ac4e5b2f3382156a428f54d3b11f12046792b8011307e27f17e339d3b231a5

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\db\data.safe.tmp

                                                                Filesize

                                                                23KB

                                                                MD5

                                                                d9eaf3a1b4d5a4ac8b5fcb63946bffeb

                                                                SHA1

                                                                35e52607a8fabe616a9163e210ff6131e8a02bf7

                                                                SHA256

                                                                c96c9423cebb3be397e746b428d8ebad71dab3b8a28377d459b4199dedc996c9

                                                                SHA512

                                                                73118f9bb79ca6c8bbe3318f09433a057686b92ad6732f03c460d76f7995d2b5f100b3e409ee3366f7a78c2e00a2d63b2d5e3b06385cc16e9fd5d5ea6c3e1bdd

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\pending_pings\25a36f23-f395-4e27-8a5a-deac2298952f

                                                                Filesize

                                                                659B

                                                                MD5

                                                                9bc977e4266fc9819ef2c37eedf7a675

                                                                SHA1

                                                                6564c4df1fcb9fd2a7c2523a96f2dd0741465022

                                                                SHA256

                                                                41ecfd9e35140ccf9542064493866897be7fbc3fce9b4ae8fcc5dd9110c7047c

                                                                SHA512

                                                                9b273f6e2e52445f8ac0cb2cab0f39d372d3dad2ec9375663177c2d56651a505d6cd4aa31a24bfb4669355ad30b5df059a9fc1f270877ea05445a824b9a9555b

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\pending_pings\35895763-3c5a-4f56-9740-a57985f5ff58

                                                                Filesize

                                                                756B

                                                                MD5

                                                                8fe55216df1da28ddce3f369599a3591

                                                                SHA1

                                                                7d5ef3d0a9d7038b447b3e06fc73d22e56d43c60

                                                                SHA256

                                                                3f14cc1bf6520c97abfea7c9ad158bdfc9a1f72771625e79e156681139bb703d

                                                                SHA512

                                                                863c356b269fd3b77f8be5b2db7ed2d6007a70b4040faae2568c1609a5cf9c5b3b3ad4c545291605cc1b87aeac47b9a630eb45c690a2cee6955bc550497b0260

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\datareporting\glean\pending_pings\b6b3ba2e-a805-4a9b-af83-134d2720004c

                                                                Filesize

                                                                982B

                                                                MD5

                                                                d896618fecd63fed7fda4a02a0ad5696

                                                                SHA1

                                                                5c0c793acf2886b67e28d17c36a3997fbb649639

                                                                SHA256

                                                                08e9257b8c59c6854ebb0d50eb5d8b6e1af35bce5d84d67961f365d07403958f

                                                                SHA512

                                                                167982439b9409ea05a9fcc347ea84469ba8397e3aa475e7c43f830ad4346ad080d6e8971d3458ce69a50724a73cbe390549876fb94ab5e968d7a856210516fa

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\prefs-1.js

                                                                Filesize

                                                                8KB

                                                                MD5

                                                                3c4a46e4a21a25d56cc754c23ea7b65e

                                                                SHA1

                                                                a8028f60afde07efb9ba56b9fbb4c847ff93474c

                                                                SHA256

                                                                c1f51a928be02f7ca9ca95907b01337f7c4bc8839d93d4acb56ad45dcbac740f

                                                                SHA512

                                                                30a463a68dceb4fb62c066e14c5e157a0261adf122a67ca54091bc67c88a0deb923a9932eaf504914b00066f2fb64630fc2e80903fc7ff844de9b0a1ff2dbc56

                                                              • \??\pipe\LOCAL\crashpad_4084_UNIQGOQDOZZQFDQF

                                                                MD5

                                                                d41d8cd98f00b204e9800998ecf8427e

                                                                SHA1

                                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                SHA256

                                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                SHA512

                                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e