Malware Analysis Report

2025-01-19 00:28

Sample ID 240530-ftp3qsgg54
Target XmloXpl6ivdM9LxJ.exe
SHA256 b7bfd195ec655a54c1e2dd12a728c2709056887e1657eaf876138e40f03f1fa3
Tags
themida evasion phishing trojan
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

b7bfd195ec655a54c1e2dd12a728c2709056887e1657eaf876138e40f03f1fa3

Threat Level: Likely malicious

The file XmloXpl6ivdM9LxJ.exe was found to be: Likely malicious.

Malicious Activity Summary

themida evasion phishing trojan

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Themida packer

Checks BIOS information in registry

Checks whether UAC is enabled

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

Detected phishing page

Unsigned PE

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-30 05:10

Signatures

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 05:10

Reported

2024-05-30 05:12

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A wtfismyip.com N/A N/A
N/A wtfismyip.com N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A

Detected phishing page

phishing

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133615194303677314" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1620 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe C:\Windows\system32\cmd.exe
PID 4836 wrote to memory of 2704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 4836 wrote to memory of 2704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 4836 wrote to memory of 4364 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 4836 wrote to memory of 4364 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 4836 wrote to memory of 4956 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 4836 wrote to memory of 4956 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2772 wrote to memory of 3512 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 3512 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 4416 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 5060 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 5060 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2772 wrote to memory of 2704 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe

"C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe" MD5 | find /i /v "md5" | find /i /v "certutil"

C:\Windows\system32\certutil.exe

certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\XmloXpl6ivdM9LxJ.exe" MD5

C:\Windows\system32\find.exe

find /i /v "md5"

C:\Windows\system32\find.exe

find /i /v "certutil"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3148,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0x94,0x128,0x7ffbf8d1ab58,0x7ffbf8d1ab68,0x7ffbf8d1ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4248 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4488 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4552 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4848 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4184 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x500 0x4e4

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1368 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1572 --field-trial-handle=2044,i,5515736261376288501,15521891287368213872,131072 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 keyauth.win udp
US 172.67.72.57:443 keyauth.win tcp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 23.55.97.11:80 x2.c.lencr.org tcp
US 8.8.8.8:53 57.72.67.172.in-addr.arpa udp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
N/A 127.0.0.1:49816 tcp
N/A 127.0.0.1:49818 tcp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.238:443 clients2.google.com udp
GB 142.250.187.238:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 fbi.bet udp
US 185.199.111.153:443 fbi.bet tcp
US 185.199.111.153:443 fbi.bet tcp
US 8.8.8.8:53 153.111.199.185.in-addr.arpa udp
US 8.8.8.8:53 fonts.cdnfonts.com udp
US 172.67.184.158:443 fonts.cdnfonts.com tcp
US 172.67.184.158:443 fonts.cdnfonts.com udp
US 8.8.8.8:53 158.184.67.172.in-addr.arpa udp
US 8.8.8.8:53 wtfismyip.com udp
CA 198.27.70.99:443 wtfismyip.com tcp
US 8.8.8.8:53 we-are-jammin.xyz udp
US 172.67.172.237:443 we-are-jammin.xyz tcp
US 8.8.8.8:53 99.70.27.198.in-addr.arpa udp
US 8.8.8.8:53 237.172.67.172.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 131.109.69.13.in-addr.arpa udp

Files

memory/1620-0-0x00007FF679800000-0x00007FF67A16F000-memory.dmp

memory/1620-1-0x00007FFC16BD0000-0x00007FFC16BD2000-memory.dmp

memory/1620-4-0x00007FF679800000-0x00007FF67A16F000-memory.dmp

memory/1620-2-0x00007FF679800000-0x00007FF67A16F000-memory.dmp

memory/1620-3-0x00007FF679800000-0x00007FF67A16F000-memory.dmp

memory/1620-6-0x00007FF679800000-0x00007FF67A16F000-memory.dmp

memory/1620-5-0x00007FF679800000-0x00007FF67A16F000-memory.dmp

memory/1620-7-0x00007FF679800000-0x00007FF67A16F000-memory.dmp

\??\pipe\crashpad_2772_XRZYTKAXDSWQSEJY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 d744e6d382540434503fad021d8eb4fe
SHA1 8c3a7ad986bc99c871e1317e950a895010ff8e00
SHA256 ff6294a47a0a57c538617e51cb60b2c30a3fbe34958ef2fc975e14f2685a494a
SHA512 fb5cfe83b9254c29a5c0bfd46c99fd0cad2b5c06e2ce64c913f2d71d4915ab0e417f27bf00fb91c459f78c34168f2e8c997ea5118ad673082248b07f5d424466

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3227d3d8721fb5e1af2027ae9176c306
SHA1 b8e3ccbd905ee3a299481f955546b666ffe933f5
SHA256 6564daf12523d58611960a688ae63a2f1119ca04813cd579c7a580664bf1a6df
SHA512 edeaf58063ba915eb8752a43d0e99ca8a054d652501a1299304ed3e4f60d115095c7321b051c8c87a74d41a686c916c0f27bffb2ef165f640761484987085b07

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 926a6e055ac2406353b45175c9e40e27
SHA1 a6f51b75f231ac380dc311930443fa4d99273702
SHA256 9de9c481fcc589ca72ef5a4bc384b616dc326f755c77c18ed99ee8460f069259
SHA512 57fa41861c42f4686a69e5e3c57981eea199c5fbddcf6b28b5266af7b578536cb8fe38307c8a15bf3d26689444bfdb69f3183ff55cce7eee6203d3da6c5e15b0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 925d040a5c9c2478469356d090dfff09
SHA1 c225272ee0815274438eccf0a8d324c181b25955
SHA256 a9b983d36223c7f768491a9ceae1ad1d0498b7d70e4fd492bf73bd8675a9dca1
SHA512 cb3dfe09b36d3b0f2dd59188e22653834fab9f69391f51966aeaad57e04dabf453e48715dfdba6b20ca889a1ea155eb834e12b4c330b8009df4b330ff2c0d730

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 bfaa89910e49e4bf8b5b2c3979a783e3
SHA1 d335a35f3dcf245335200adb79beaeaacf4c58e5
SHA256 eeabbd4fb50dd8f8281efb7c74209164d7a0524e35f5df2b099df608d1dd0b09
SHA512 90816ad1c632062d56efd58eb4d2fda850ef865a18f9f210534ee13d0e43da0f61c70d364e3a6625a777c691944c32fcda66dff587282c2d930296065c4fee72

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

MD5 5a0dc6fb54d481ed1adf84c8db9d3729
SHA1 c2bbdc49f5ea7d9dced6dbc730b06f30d5550a31
SHA256 a6aa3f709f894cae441d4d772e20ae3c6634179353cefb4e6087b54c29f91cbb
SHA512 c73b56ae9f6d0f6aa9f9c88428bf9cde89e6d8523d55579f5baf5df920b7ac1983b2629a9432aa00c033f36e8561cd5efc256cb88312a7040a788e7688aa3c04

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 f3f54212453314571ea4c3eec5d22bcd
SHA1 540ed701547af3d415abc92dac0c2910aca249a5
SHA256 e59b87a9af0bbacbac0f9e005f7a11bb55456c46ba923eccff9c4e03e38ba2d1
SHA512 935c48abf09e2d92afef764e6d058d60ff3d5791d07a03c3d7e821c3b8d3f551ec632a7613ac24ff511dd1eb10257bf89047e55ba7dccf09cbc3a54c0931d9e1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5876e1.TMP

MD5 260b7dd5f3aa7e19945215bf5e2a524a
SHA1 1891d42e89fa9a31800734a836fe3c91c416a184
SHA256 6c73b146a1a97067c34dc0c0202d1669d4ceffc285b17818a0bc1311801e2889
SHA512 6fe625173aa6ff7631c9ea99c4bcba8815c22e6cf7a1f13b8343deb33364fe19b142c3daff675e5bab0a515a8d70e02f1e58187d7ef50ababe9a68c2ce4720ff

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 0bae3c51bb296eddb74b72eab829ad5f
SHA1 4a752c33ce3c8504ac54cd548667889f034319b0
SHA256 ce60f9e2d2d02b24d6d70e12c4caf4c4e5360793aa265dae3fa91b446ec722ac
SHA512 2ee39ced2a3f30ace7dc4f313559227f0f2179763dbf3c6acc5b4983cef55116c530c4666b3b969b03fe3f0a65ef5660b1a0fde8dbe268e5d7aef2f28f22c36a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c6af495dcaaf3d30c56749a214a05a50
SHA1 c913e0d853b3a588509de0dd63c8bf1273d9cd6f
SHA256 566ff9b838420e6c70ae38f565321d5a47ecbc2db000b30649a0b3c380837f5a
SHA512 d7baf892d53c2681e05342cf0b6e4afe0010c10faccbc9f9ebacfdfc95e4cabcca1d282276cc80fa3436ae0110c29142a2524c14c94e86b93163e8786faea87f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1c21af0d3e86af379e6dd02a8d73d30e
SHA1 4677be06ce684a57bcae9d979665294558a5137c
SHA256 b4f96f0bd6e8aab93560a8bd6d65be3e3b1793b6a9a3040e8932bfa59426c479
SHA512 e98917ca2a25552ea43848992aea726679e7340e7476a75c99d4a5f2b02b0c72a9275dd631c19fbb82efa9da3c37d0879b07c245af507c61156ded5c1ce80cc3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 08482a02825c642a6421fe7e0eca0091
SHA1 67d28bff1133a50d4c388498f09f886016780162
SHA256 d97b3d25e0a13da99b30cd9ee8abbb130d87e6b79d6d959ad8f5f4f30409c596
SHA512 495fba66ffdfaa3589f272d8e84324e228ed69a5775228f69e91388fc80103d154d8b5325dcb96f068a92512f20c450ed102fabdebe4879e1b446a4bdbdc7000