0879f54db2256a95bc2200c2f9012e5613df7779f627de1d7b96158533b34ad6

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xd.txt
Size

28B
MD5

79294d1cabb713b0b826ac7e4090218a
SHA1

6059fbd89f43f5f002b8b245a5367b0d3a84527b
SHA256

0879f54db2256a95bc2200c2f9012e5613df7779f627de1d7b96158533b34ad6
SHA512

78b88782b5e1f4f96d55e7db03abd561d198b046e2905ba397021e46e144aa3785f35883574f5b0b6b144383dee2ca060413e39455759b978cf23f0bf4f9e08f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133607982346417095"	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4444 NOTEPAD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

2248 chrome.exe
2248 chrome.exe
4352 chrome.exe
4352 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

2248 chrome.exe
2248 chrome.exe
2248 chrome.exe
2248 chrome.exe
2248 chrome.exe

pid	process
4444	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2248 wrote to memory of 4532	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 4532	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1432	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1692	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1692	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe
PID 2248 wrote to memory of 1064	2248	chrome.exe	chrome.exe

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\xd.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f453ab58,0x7ff9f453ab68,0x7ff9f453ab78
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1892,i,1309367934874892622,6306071797130300088,131072 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1892,i,1309367934874892622,6306071797130300088,131072 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2236 --field-trial-handle=1892,i,1309367934874892622,6306071797130300088,131072 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1892,i,1309367934874892622,6306071797130300088,131072 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1892,i,1309367934874892622,6306071797130300088,131072 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4268 --field-trial-handle=1892,i,1309367934874892622,6306071797130300088,131072 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4412 --field-trial-handle=1892,i,1309367934874892622,6306071797130300088,131072 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4564 --field-trial-handle=1892,i,1309367934874892622,6306071797130300088,131072 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4580 --field-trial-handle=1892,i,1309367934874892622,6306071797130300088,131072 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1892,i,1309367934874892622,6306071797130300088,131072 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4896 --field-trial-handle=1892,i,1309367934874892622,6306071797130300088,131072 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1892,i,1309367934874892622,6306071797130300088,131072 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4796 --field-trial-handle=1892,i,1309367934874892622,6306071797130300088,131072 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1892,i,1309367934874892622,6306071797130300088,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
978562fba79082fc28a67ab93121e940

SHA1
bc2ca358d04d2e6f52afd1c1e3be281615d26c21

SHA256
cf2874da510062dec184bfbffb3544a0d1101e4f59a1f3735dd4b85a74b04e00

SHA512
7ccc0cc40f2e496055b10f159bb8934006e7db13695df549fbc6de4e30ad559951a6269c893bd43e1dc52e17dfab444115b769eff7add5050d038865d5bbae7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
4e19eb74b76f49336c9819c00bb08e9c

SHA1
1b6ff8b2b3a610fd102aceab80783dec39965e2b

SHA256
9169cd707ec79ab8bf27f56529e7e1542372b8f6b990c8794c0da2d20de37c6a

SHA512
478fcb5e7a12bac3602ea06cae4f8e3f6726b6a44f0510b1976c6d97a2033a39718413f7f53e896ea922edabc5b6411bce1670572baff66ba2b5ada34b432621

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
ee8168bc3586478fcf95cc3f18376ede

SHA1
2cef5e620a90e5300a5b8831561633d149d3c896

SHA256
557f7fd5eac264d91af66b8d6050ea7dc062c70c8285af098c8d85087fa3a56c

SHA512
821bb4b14c863975bdace0d182d64980d784e14cd538c6648cebe11ecb278525cf454ea31a14e96ab994601e33d902b6cafb1702452b32675cb85e68f27f446e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b11352bd434f776d63d9aaa3cb6b1155

SHA1
9dbe85980acccea23f69b219d24000b90113b54e

SHA256
e5d9393c594595be0955e389e564d7ae972ad7683cf8166e2cc9fbc84161edbb

SHA512
c5c31343c801d37cc9f6b90adf4182a6a6ffd2d03fdd049add5125783a67e1bbced6488812f5b096075de8a58562020146aef7212dd3cf2ec0a79794efd4e0e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3f99cacee9dc042f0281c4a58204d364

SHA1
e85fd5f85b19a9ae93324b95438ef734a18f9a59

SHA256
25d662b5cd6e8e1554311c5b23cb80f8de3ed8172d747ef47d6c8def5aaa9453

SHA512
529b03106b37abf2db64bd3b61fb93a3db91819ed827c621e6b837c29a984fa472628f40525a0f399088e00d929c4cd92e12fc9a143a498c9c68f3336f686538

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
2cad50de8579761b67f54313af7f5459

SHA1
00a871ae0edf3b417c02c670c5af441490f77c6c

SHA256
13bc65f0d315074536f90d4254d51b4fd14463e0ae30529a6d9392186f68dae7

SHA512
b3a35a44289ee6e0cfd7884798672879cb8727351f2bc36164dc672065a3bfeaa03f3788373ec2dcdf400815aa5ac19a8c82b775fc4e9e21ee2bde58e4ac1a35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
259KB

MD5
a9a95ad58940753fc02eb980bc2944fd

SHA1
3f3f05b660a1bd0cb3d15dc942eed5bdd3ff4ea9

SHA256
aae4a10bf374fc589d8c26ee63708f980a11b58548eb813ee140806a532f5e28

SHA512
83827376299c939334d27c28dd6535c4118d2ff336838780832141cf95e85876e6ab3edfe94730b3c67b3acf05b542ceb6c73ec746ad7e54f3042c8a074db8b2

Download Submit
\??\pipe\crashpad_2248_CGNKGWWDKZWSGSAV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit