hxxps://h2[.]nexus

Resubmissions

25/05/2024, 11:23

240525-ng6tqaee9s 1

25/05/2024, 05:30

240525-f7keeafh55 1

Analysis

max time kernel
672s
max time network
673s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://h2.nexus

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133610887731215059"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3668	chrome.exe
3668	chrome.exe
4136	chrome.exe
4136	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 2228	3668	chrome.exe	84
PID 3668 wrote to memory of 2228	3668	chrome.exe	84
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 2416	3668	chrome.exe	85
PID 3668 wrote to memory of 1384	3668	chrome.exe	86
PID 3668 wrote to memory of 1384	3668	chrome.exe	86
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87
PID 3668 wrote to memory of 2408	3668	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://h2.nexus
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f40eab58,0x7ff8f40eab68,0x7ff8f40eab78
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:2
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:8
  2⤵
  PID:508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4764 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4172 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:8
  2⤵
  PID:3924

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
31a99e9927394f9933a25d88bade5f69

SHA1
4bef1d98edd36a624f4dbb22b97cceb5a4095629

SHA256
d4eb4812e413412afdf38ab1748065d628e070635058f7b23dfa36b6b520b3ae

SHA512
2ee67e92e32457232912a841f782c99dab0919497f6fffecab7d7f45d2e9ea028761275a60a8635994401ba4f47c98e291a808081f5f8b30a48cc6a8eed3603d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6bbf21159af0ab0c9b463d18ba8066f9

SHA1
5bac787a6c696a4ab282d3bd9d6e69901b37bfef

SHA256
88d50bc57cb903dff06cda6e9feccfc7063cdda3afca33ae44cc4d94f70a3578

SHA512
5cd994a5c26f1c374c8a1e840736c53692c1114a7464aff3a5824475d61f94e46b96dc00a3aa41c1aae5b5aa1e70b1ca494e3e93d4ffab1cec7eea67e0d92d01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1b938b8f-94ea-4b76-83d5-e3a020f654e3.tmp

Filesize
1KB

MD5
5b9bad0d67e296fc4fd8df979a7b4a5a

SHA1
ef11151116d51e2a65fae0936d50e4a2b676f8a0

SHA256
500ade2cfd6a9607f98f5f3f8140e5f72ec8fa84d8f56f8078661f1bcc21d689

SHA512
f1a334e1a10179418e06148e6965504c868fef5e54aef1dbe0a109f8e75483f9e0d7f8fe2462f26317d54dc66e53751d7e86cc31cab18c55ef6aba42cc1aca12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
a443481df5f0fac5f594d5f56276988f

SHA1
068ee60b6c134f253007e627758f3b30194fb2c6

SHA256
0acf5024d9791c31389d0bffa714156f8b727bbf4f4f5006abb1639dbf392968

SHA512
bf7427fafab2578d557a6ff86aeb3b0794d0fbcd7afd68fe4cf834ad879902a954caf2656856799c9c66a4328a0228147383170027afd4ee78bc7569b0860ab0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
e4681c203b2a376a9c1507ec22a21a57

SHA1
b73fb9dd70a06ca03f23ff35f3538ea113422631

SHA256
aa14bac827c757da0fea70c4112016ebd0675d6620a722c3a70512591e3a56e6

SHA512
6cd4506de0a1c0f6e1e6e1dbf879de5c1a4ea20cff2e749b03a19d5c0e8f5397f2d30df0994adf26ed9cb47f929dbd73765f00fcd5f66a6991ca8834f15de2c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7a9e9bd0cb06e4213ef850907a204b08

SHA1
69678b0cb002c9728a36c28afa6673f773ba5c1e

SHA256
5b28d6d34d076dbb42b9a759c9bef5ffed0556a8cb367f0e14dc0f247cadd858

SHA512
fbffa98d641b23f1fdc472ddaf3c41c3504767ef02d36f205636a4def0f38a613fe35903018efc3218e86599b5a5360ed4f053fc9264e210375d0ab4ba103550

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
5ae1444b9fa40ff5e2029b2ca18c1aaa

SHA1
bc3c120b43bb3e0b3d82e350a22ad7332c88aa00

SHA256
9660724cba7b46f8b2caf94749567ef9c67e52f58a7c4315c292e29ae013c9e8

SHA512
d3ec53bdf4f3e7604905869e308952098311ef7933f542b459f7a3ab1e1d54c927f3b43ebe89cdbeae83651a8082e464fb7b609d92eade63befdf0f96c8e1975

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
ed963d507a0a255f9e84f7a0d5b6aa48

SHA1
9a6b117bd36693655905ab2cc677312e19a8e9a3

SHA256
eabf5be60bd60ceb8678aef4a91c67ad3c6fe8401ca8c7db355c0a584cc90b76

SHA512
305818b8813a447056b08b7b23e341848b15d807833b6524b7a6ef9281cbed49e424c1b74c10f970c81a8047714f4529825c41a166956049947390ae65228add

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
57fc68b8a24395c5dae4f4b10f7d1dff

SHA1
8a31ee258f3d01ab85175e6b5b06d7ef3c0a1142

SHA256
eec1404da6e64de308d6fece3aa16b6074196e9fb78b006bc15fa703d15f3113

SHA512
b60b051166834824dd6d5b370fe02ca647183e84c49f64465e52a866b263a568e1e7dba70faf9103afb86ad459c97d9ac7e89d493035eef07cc4eae91fbaef8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
21d7d793dd59864e8a4ff97ac2b8ad45

SHA1
b3e68604ead46b8d4ed0806fc2e8aa0145b1a4ab

SHA256
53fcb52af59c4b85bcb9105c84e1a101900123a79413194a05f9fc46d1e44033

SHA512
a045a216b66c8e61524407bb63d5ba8d831c2881300c817d5214081b60b4e552341308ce31ba6943cbedcee6ebfbe6fb9aba0e7c877b5b1127347e9b137229b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
4c16928e07bbb58bebbb2acc87217782

SHA1
01f04bfb4edaeb7cf3fb1c896d8c9619ee571e96

SHA256
471da2110db674c1efc4e86c413c863c4f1313a3a340625689e2c5d2be67308d

SHA512
5e39c581092f7d0fe951b4423eccfaf113c203fc9760d11af0c77f7d975b59004e2e8a0620a583691401e1a62556606eb7e79ee92f4ad9f88b5abb63cb4cafa4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a216d76abe10a116458f3321723b32f8

SHA1
e63c4b75af68190e2d6cb49c9f5771bcc04223b5

SHA256
fa4d15f853344b82bf54fb6b80492f92c35c88ca7f79caaa00519d68d2e8ad27

SHA512
59ddc86596deba66dec808414c66f81cf833e53296255f1413d4954e62bb4f221193cdfaa6fa2ef95fa920dc77a912f92a24b5b5e337a21d894aedf1cb3c1c75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
bd2b6423eb67349358a7557e8669a822

SHA1
3bfa54cd3ed6e7deaa4a883c3b7250f66801b6ff

SHA256
abeb952f139e4adad0ca7c8670d5240eb068d67e0f07f4ee8432dd48396b0abc

SHA512
272a4647eaa25705792bbe40b8fe3c9f24ed29963050e1c1eb155611f3c8ec80065a4298673150e59d250623dbba08cfb944f9fe4c8dddf012989558e652c38f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
255KB

MD5
32c9d3a2633c7274f47b52c470cc3771

SHA1
5aa5c9f66c42da13ea4bd474aa5e7797d23495ee

SHA256
c78f731897715271bead8786282be938acddea64c969267c8f28318c58558c52

SHA512
dc555370351392ae6d65894755eee4b28f289f39ae3a6d288f6cd6a88a64fb0bd329855252a009748885b2d7cedca2ca9b92b750af6e992693149ef934d62b9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
91KB

MD5
07e44cc14de83c67490c15c5d59bf720

SHA1
bd39d4a4a0248b94766da8a5eb93a27a211e14dd

SHA256
59d129cf2b91182cfbef2c2570a7d9f5480c08e512bca1008aed007127b813bc

SHA512
c57f13ca7db671698213d4edd5feb64255f3d67af95678724d2359386836ddfafbad0e66c1c6617d0504fe933edf4331461f11b70900ca252d2d1bc48c442784

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5d1cc2.TMP

Filesize
91KB

MD5
3a5f5986456875edfc0b92d242b0ff32

SHA1
4652aa28d9c43a8e45c08f897c5bdcdf17320176

SHA256
cd02a0f5864541ba18c2bd26c34845a281deb31fe9c7b5786a45f4f543d0ecc8

SHA512
13e67f18da11bac55ec02c5225c54ff7158583b4f788fddd5c40b2d5148c8e7567290aba3cd9f8f1a382d8712ef89ba30f57d29cd055745feb70423d5daaa9e4

Download Submit