hxxps://youtube[.]com

Resubmissions

25-05-2024 12:09

240525-pbs64saa42 6

23-05-2024 14:41

23-05-2024 13:11

23-05-2024 13:11

23-05-2024 13:03

Analysis

max time kernel
1799s
max time network
1686s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://youtube.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609449902469506"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3558294865-3673844354-2255444939-1000\{0483B10C-574C-4328-9459-847D8A5D14AE}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
1748	chrome.exe
1748	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: 33	3280	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3280	AUDIODG.EXE
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1156	4924	chrome.exe	83
PID 4924 wrote to memory of 1156	4924	chrome.exe	83
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 4536	4924	chrome.exe	85
PID 4924 wrote to memory of 2536	4924	chrome.exe	86
PID 4924 wrote to memory of 2536	4924	chrome.exe	86
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87
PID 4924 wrote to memory of 2816	4924	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://youtube.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6dc7ab58,0x7fff6dc7ab68,0x7fff6dc7ab78
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1916,i,15879068469120363983,16007066367562717913,131072 /prefetch:2
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1916,i,15879068469120363983,16007066367562717913,131072 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2216 --field-trial-handle=1916,i,15879068469120363983,16007066367562717913,131072 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1916,i,15879068469120363983,16007066367562717913,131072 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1916,i,15879068469120363983,16007066367562717913,131072 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4248 --field-trial-handle=1916,i,15879068469120363983,16007066367562717913,131072 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4436 --field-trial-handle=1916,i,15879068469120363983,16007066367562717913,131072 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4692 --field-trial-handle=1916,i,15879068469120363983,16007066367562717913,131072 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1916,i,15879068469120363983,16007066367562717913,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3256 --field-trial-handle=1916,i,15879068469120363983,16007066367562717913,131072 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1916,i,15879068469120363983,16007066367562717913,131072 /prefetch:8
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1916,i,15879068469120363983,16007066367562717913,131072 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 --field-trial-handle=1916,i,15879068469120363983,16007066367562717913,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4460

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524 0x528
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
756bedb425fe266da9f54086ce5a63b4

SHA1
20951682a6114d4a53976a9883e96669af07985c

SHA256
d9c8a1c830180e42194479b1a5cca5edb8e9ecd4ddb7ac7fef283daeb978bf3a

SHA512
d2fd201538e4416b14461771a006b816c6b7350b5d9bf18621e239058495e041f35bb955b82278db5ae01e42152fc05b11b996606adc2e1d59d52d811ef15b91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
6b69ae16803ff73649121e29fbac438d

SHA1
28d9a7a4ce323993531bcc4bab1e459fcdb395cb

SHA256
2c0003602497568e76c8f37f77be4cfe467516d7ebb15c4746ff1c76a795b270

SHA512
159ac99cd9937df98004129edcec258b350fc328c7b124b87c8a24ebb40f5625f8f399dc4230598ffe4dd83d93ebe0c623aabafb82d9a9ad6f3a3a6cc843748e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
57c14bb2f23c629938e4ad97b058185c

SHA1
fa3debf8198bf28b81316cc25332feb5f4c61c28

SHA256
03cf2b0b36c725bdc1a91f3fd56d69c429f933b07ea16fef3e47b7e626a2fdee

SHA512
85f817846598e464141194bbe19d639d8f17f4af99f7b4a38606e765060a1c258165e8375d0366d321cb99a22e7ba6edbcf5da7260fbe030a7c530bb0f1bc7fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
7b47108a1634afc7e86c9dee7a4e7361

SHA1
5e3fec8a55c0acc8650af8eedce623c1b79a1b57

SHA256
b978455a392e1697037edac78cb8f7b4f212e526e74240717a34de9ee270c9b4

SHA512
329154ecd3634fdadc9a8361945f04a47b98683b9a2e04df9d296417b6db053491ae5f4a9c043c6860d79453ba0dabec52adc911ab98adda8ab6f35cdf269111

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
78d0fcd07aa108247c4081c4c5f87622

SHA1
7d8afe877a637d7aa06d4a8a4c28ba1dbae3216e

SHA256
a5449da798bb86449892caf9764dcf8f4459c03f1b9639f16c20c6e8f110d31d

SHA512
52714da3365179a77d395322b319a0cc200a058bc849ca69c45295f2a6402a97f078f4bf55017df4d36ff77f155be60e9e6ecb64f84dd07b513f71aea84a51b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
a2d6570100fc161232b2d74feec47ade

SHA1
891155410b541e45b497dd9bf131bcc88bdbaa38

SHA256
d99ec45b97749ffabf0f57aef132d1d511e3b72062bb9fcc007ce97b3c1d255b

SHA512
976ef00de1994eb64abc0b418e1c1abadfd4f1f94271ae55b9aad445d601de9d8e385e6dd61aa74d387a94cbf5add203354850ebf749e87b3340dfc7e4a9d462

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
d8a63656185a3b4dd7374bb0fea92672

SHA1
23d213e8d2409f9a066fc3e931579937ab305d91

SHA256
0fd013f1ebacb4902909ab4ac11bc01ef1c419e7efb8ca8a558239850314ade6

SHA512
55071ec4400ee9e0796fccb2874d743fe0def7dc39bfc8d87c1d148ba1fc93f4c0461ed77fe15d325a7aa44a3ad9928053a0d97323543c20bdccc1cc08d66315

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
0b02590686f0c43ac919cc1f944a16c5

SHA1
38615ff2d4f8bf157d23f9ff012f01593f23e91d

SHA256
1fe957c155b329f4c8b6fa51317ac1a8ce58f0e21df797a3a5583d619ded9542

SHA512
1a3b46e33653f149c26c906dc0866205d5de9a8492e7dc368ce19c7f4460726e4ad422cd0d2fabf5145b81c55960ba937efedc452059a5f307cd86a4c937efb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
85f96ec66d8674d5ee5c557612e9271b

SHA1
5097269ae74a4c475782dc4ab283625b7b030c62

SHA256
adbf9d0fe4a612011682b0239d90942f16a81e5539f8bef076f899a00599f330

SHA512
43fff543a33e0bf3d8b19b81b9808dcdd5caeb1b60dc4e61406e36f17def69f41c50523e7c4177aea9ecc6ec7b786c0ef8e9cf982b81678839bf8f03b6ed4721

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c59f9915-345f-4c4b-a558-297be5e2281e\index-dir\the-real-index

Filesize
2KB

MD5
7028ce81c405cff872959b2a1b25338b

SHA1
70e846eea1dca70a42f4dc3359562516857aef22

SHA256
86edcce0b39ab857a4dba7ccea766bbf122c76add088580d74259c41945b4c57

SHA512
39353573ac2633e93b9511cf965f81c469f05fe7d5d23cfff372c6e6735c5a842ddaf4ea39eda054ace0700623efd3ef270a9b769a19e7aea7df24d598a50aed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c59f9915-345f-4c4b-a558-297be5e2281e\index-dir\the-real-index~RFe57ae51.TMP

Filesize
48B

MD5
918523f92b1a669e6655ab00bc6d2f66

SHA1
fa579afb6eda884afc75a87474cf68d51140e295

SHA256
e73ca487ec9c7e53f08967db355b5f418c8d0afbf3c974bcb65f84753b3c15ff

SHA512
a5b00fe22d36e42d900e508d996e0749edbe9820104e3071410214b0ecf751d4c574fa91c6060b10468ba676d5ecfeddac823f298c4f1f5518cd76caaaf4b172

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
176B

MD5
2a9f65646e28563ce80568a0b4c53fa6

SHA1
683d8732567bfd2b1e2f6e07c631e5bde29b4ed8

SHA256
7dbb3134355c30ef8312d23e94706fe28b2069e365dd367b45aee458094aabe6

SHA512
e24ee08a30e5db71aaf6c3fccb57a4eb431b6980828ecaf0bd8cdb04290fdb888410c1972eeda4a48b8ab6cace939ead192f83fb3364895de2931cbd11937999

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
112B

MD5
3a42560462c928e28052e9bcc3d4e5f6

SHA1
7dc10d4a7df27330343e936b6110d5f82a51a306

SHA256
8bd89ab2b8ccb009548e367caa05874d30dd9b8d5fcb1a2c12dece676f76c8f0

SHA512
e432527cac9f58ec833a89d8fc1a229c71bd743bb29983ab725c9c43d69c8d1155ad9fe02443859e2a8d06af7aad89b1b8ca0e93e8156c61216a75e55f88d586

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp

Filesize
114B

MD5
eca8b6618b7c68676002fc69d67b9da7

SHA1
a4d5985cd9da4e88662564ae715c7193cabfbc73

SHA256
552467d0f8319fdffdf2f4f97f347903875656fb4f54917d1b89081fe18f82a0

SHA512
c0309ee0c494d54eb994fc16d67a9a0bb346e191b83e6466bed80a4cd90bba9730d3bc6a7805e851b781d7380a78961536622c79492b420526fd9e21f15b4366

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5758bf.TMP

Filesize
119B

MD5
9ac6d601d8138ff071a3612fc4190622

SHA1
b2160e9336e5c4a6dd35967bcc3835f74bde8b65

SHA256
a59b12216b93f4dfac806f8f82f73359c776b9c615e7246a3698de52ca0c9ae3

SHA512
4b534ab945788b6677f11a2b35af17b33849429fae9005b984beb7344a9fdaf1051587527c49baef8ec5f4ac5f7f476a6f047fb5a47d9c691262eba784b53359

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b0a695b401c4239027cea9e880b67002

SHA1
7c2eb914403cb878fa7986239b30d906008f0bd5

SHA256
b1d18e2ce657647ce82d73fec98c9a38ebeb352854508d2a73cb30d220d2566b

SHA512
6195888b55beac6998a1bc2ae894f1dcb3d9b031e9aed01e1c535c7b3b8b5ea1c9695385af3287832c17e4652764c4b0a68e49cb719b07ee8dcd5a3886ed2b50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a7aa.TMP

Filesize
48B

MD5
581f52cbf8990a88328e4f076b8b3998

SHA1
7ef36cd8720748771492eeb674074b235c06931d

SHA256
c7e80063970985c95839f2c6f21cb422fc02228a06c79cf00ad357b0a099254b

SHA512
f7eec9dd231c7e5c77a7556b5a7cd07647d8ebc20daf458738bdb57e5086798c12b0077e817d3f58192e2c858e0061acab4ab1763a46e727a06371621d56104e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Shortcuts Menu Icons\Monochrome\1\512.png

Filesize
10KB

MD5
7f57c509f12aaae2c269646db7fde6e8

SHA1
969d8c0e3d9140f843f36ccf2974b112ad7afc07

SHA256
1d5c9f67fe93f9fcc1a1b61ebc35bda8f98f1261e5005ae37af71f42aab1d90f

SHA512
3503a0f4939bed9e1fd5e086b17d6de1063220dffdab2d2373aa9582a2454a9d8f18c1be74442f4e597bdba796d2d69220bd9e6be632a15367225b804187ea18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4924_1608428427\Shortcuts Menu Icons\Monochrome\0\512.png

Filesize
2KB

MD5
12a429f9782bcff446dc1089b68d44ee

SHA1
e41e5a1a4f2950a7f2da8be77ca26a66da7093b9

SHA256
e1d7407b07c40b5436d78db1077a16fbf75d49e32f3cbd01187b5eaaa10f1e37

SHA512
1da99c5278a589972a1d711d694890f4fd4ec4e56f83781ab9dee91ba99530a7f90d969588fa24dce24b094a28bdecbea80328cee862031a8b289f3e4f38ce7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
6ef30cf8a7a183c54400d7b976fe3385

SHA1
a80eeeef0d0f93a8ca782cbe7e7b613d4ce39247

SHA256
8f35d3dafc2337cbfdc1dfdbda38222c7e39af5bc6478d6e0449398dc4d064bf

SHA512
4ff6037c610218a42ba7185062e45e0b2d42286d876d854ac43e55e62a34cbe1e3c1ce07d074cfa738b8cd86d748b38ba6056e3259fc811fe76bea32f0374bc9

Download Submit