2a46bd91e3e51a918ed220c56ae1192db45f9944074280cd5d022f8b5ac852cd

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-24_895d2548cce7163a577383cc2f27d5e7_ryuk.exe
Size

4.0MB
MD5

895d2548cce7163a577383cc2f27d5e7
SHA1

71c8a1e820120112a870ede8d4e04f533078af65
SHA256

2a46bd91e3e51a918ed220c56ae1192db45f9944074280cd5d022f8b5ac852cd
SHA512

32d4734efb00cacc9a462e4fb926113483cef14bcdc821a0b58f9702b23b557682746e92d7135409a04890ebb2ecc7455ff7440f7542d2de1f3ba6a84090da89
SSDEEP

49152:bRUe99+g7C1zqHd+RlxvzPEWvBzj3TvIIoQDk4qi4A2uVoj0I1v5ghsw7Ozx+olv:Cp/z8yBzjzxUzk6xkhZW

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133636693463596847"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1904	chrome.exe
1904	chrome.exe
5212	chrome.exe
5212	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
4700	chrmstp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 1492	3728	2024-06-24_895d2548cce7163a577383cc2f27d5e7_ryuk.exe	90
PID 3728 wrote to memory of 1492	3728	2024-06-24_895d2548cce7163a577383cc2f27d5e7_ryuk.exe	90
PID 3728 wrote to memory of 1904	3728	2024-06-24_895d2548cce7163a577383cc2f27d5e7_ryuk.exe	91
PID 3728 wrote to memory of 1904	3728	2024-06-24_895d2548cce7163a577383cc2f27d5e7_ryuk.exe	91
PID 1904 wrote to memory of 3296	1904	chrome.exe	92
PID 1904 wrote to memory of 3296	1904	chrome.exe	92
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 3956	1904	chrome.exe	93
PID 1904 wrote to memory of 4284	1904	chrome.exe	94
PID 1904 wrote to memory of 4284	1904	chrome.exe	94
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95
PID 1904 wrote to memory of 1196	1904	chrome.exe	95

C:\Users\Admin\AppData\Local\Temp\2024-06-24_895d2548cce7163a577383cc2f27d5e7_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-24_895d2548cce7163a577383cc2f27d5e7_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Users\Admin\AppData\Local\Temp\2024-06-24_895d2548cce7163a577383cc2f27d5e7_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-06-24_895d2548cce7163a577383cc2f27d5e7_ryuk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=124.0.6367.78 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6e6de96b8,0x7ff6e6de96c4,0x7ff6e6de96d0
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bee1ab58,0x7ff8bee1ab68,0x7ff8bee1ab78
    3⤵
    PID:3296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1892,i,11800489377943575944,3832314783066338074,131072 /prefetch:2
    3⤵
    PID:3956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1892,i,11800489377943575944,3832314783066338074,131072 /prefetch:8
    3⤵
    PID:4284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2260 --field-trial-handle=1892,i,11800489377943575944,3832314783066338074,131072 /prefetch:8
    3⤵
    PID:1196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1892,i,11800489377943575944,3832314783066338074,131072 /prefetch:1
    3⤵
    PID:4924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1892,i,11800489377943575944,3832314783066338074,131072 /prefetch:1
    3⤵
    PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3608 --field-trial-handle=1892,i,11800489377943575944,3832314783066338074,131072 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4468 --field-trial-handle=1892,i,11800489377943575944,3832314783066338074,131072 /prefetch:8
    3⤵
    PID:1704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4612 --field-trial-handle=1892,i,11800489377943575944,3832314783066338074,131072 /prefetch:8
    3⤵
    PID:1708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 --field-trial-handle=1892,i,11800489377943575944,3832314783066338074,131072 /prefetch:8
    3⤵
    PID:4976
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    PID:4016
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7acdbae48,0x7ff7acdbae58,0x7ff7acdbae68
      4⤵
      PID:4648
  - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:4700
    - - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x224,0x244,0x7ff7acdbae48,0x7ff7acdbae58,0x7ff7acdbae68
        5⤵
        
        PID:1356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4680 --field-trial-handle=1892,i,11800489377943575944,3832314783066338074,131072 /prefetch:8
    3⤵
    PID:3764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1892,i,11800489377943575944,3832314783066338074,131072 /prefetch:8
    3⤵
    PID:5228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=992 --field-trial-handle=1892,i,11800489377943575944,3832314783066338074,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5212

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4380,i,18320353784098040629,17273168055569331828,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\SetupMetrics\46f325a7-92d8-4d90-b62c-9f98da9ab140.tmp

Filesize
488B

MD5
6d971ce11af4a6a93a4311841da1a178

SHA1
cbfdbc9b184f340cbad764abc4d8a31b9c250176

SHA256
338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

SHA512
c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
64d7569e7e9cd59b61724e5ca8024d2b

SHA1
7e567c8f3a278f528fd7d85d462cce4e56bb8e79

SHA256
8adde9c0e5b89d0b9041d73f1c9ef531e668cdc1d020e7625e45f7063569ab1c

SHA512
b4425d6dea07aaa95039db3491ace66ff0e4e64232309b2c7dfe29200823454c3f91391db09b01b83edeb298dd3a9ff1dd0198c13230763553160e5a2607efb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
193KB

MD5
ef36a84ad2bc23f79d171c604b56de29

SHA1
38d6569cd30d096140e752db5d98d53cf304a8fc

SHA256
e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831

SHA512
dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
d805e8522cbc5e56dac7473694430bb1

SHA1
630a092d54724e3577d197c6950e4cf4b76a3940

SHA256
3160009053a99e04b32f30e5839ea0cd94fa29e76638f1c290887e36121ff25a

SHA512
0a696cc3a95d2f29fba37359dd68f3e4c36ea7972a798cbc152381010a8de5b3d7c555cac0e77e683702c5d167c53768a0719bf7c1b1c2a190c1be21b4eb3d10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
79e49942d3af977b131ba0af326bf988

SHA1
f5e9d9448185b04b5c895230ebfe1a19ed02c65f

SHA256
4b650cc79a32002df1ecf00b2e2a60babedfbf2ce4ea9bea2c614b632ef6d6e1

SHA512
aba42558f0a7a0045377cd06b833e54ffae95ba691892084b8d22e73b171695bb6ed7e528a25392773106cc288fd39a5a579c6f51b6a16d5cd34fa8cad8e67a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a38ac60fba41b2061531cf27ebbb7413

SHA1
c0493188196b218cb11c3425108c7fd24345abf6

SHA256
ff8aaebc6b9d5cbdbac24fa7f7ee5133b7b4f31489cce4c199dc624d8a61276c

SHA512
63f498957f3da985fbf9253295c5815927217834cfd4b108853c7636a48e049829b409067ffd6a9625e78bbd1be7ba0e5004147f2e618cb1022d91bd75b6a76d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57fe46.TMP

Filesize
2KB

MD5
a361d3291546212f08156eae58b34e1a

SHA1
89d7162134759edc4109797677471c64824c4130

SHA256
c94bf51d6a92796deea251ef7bc1c0bad2f1fa49fd8a4f62d6800ba729d275b6

SHA512
1100cf4de624cb6e3030e83629e5574da48e5d498f1ee3508f4b342b3f020a40a58ed7e83db413dda0036f15b81c8945f9491ae351647c579362b09f2654c18f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
1af1707bdff83a21008f225d35403b38

SHA1
0d1f9494d48c75f1145ea275e29693ef62f9949a

SHA256
cfe8f106a420993d561cbdaaf60566eb1883601e8ce5874564855c115f237d47

SHA512
48c8e349e25b2b331628c7fe1e23c96f2853f448aa22695ded53fd47bbdb1f30803408e1c401d318a03d349c8a8992564ab51320787908f0b96d2abb480529b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
279KB

MD5
7fa0a58584f5ece8539c59fada76c394

SHA1
34308e2336decb03f4e0625343c91aae5abddcc1

SHA256
8c48c1ab6a7483259a05ab2eb717cc8525482c800f4429dc020cce179b496244

SHA512
8d0394c4965fad37792f2400c585c9b5738e3f1454da64da2938517bbe81a71c25572256acce19ac67d9b0db7d41c7a4f4cb88dba4d8c7638a5a71f86ea1efb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
7KB

MD5
0dfc1f3d5acbc973f33d08663a70d491

SHA1
a6adb0ee0cbf483fcae1e9c784272a742093118b

SHA256
5a7fa9618cc0581583053dba9b7c022b30d5fd7a8a7917ffbfb2c6e2a6d5313c

SHA512
9378827f7d51c379672151776019b44cac01ef6cd85574213e11ad1c5b2b8372938729d22a499106c97b7d8bb693660fcb16bac17ab6c809911ebe55c12a18d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
8KB

MD5
cca9e0b91130ddfa8258baa95f8fbb1b

SHA1
72201f60a96b0e341e6100481d11d356890e6194

SHA256
04f8657189fae1f8127bac142ada1bf1f1c3b24e4337df2de8cca40f62edae88

SHA512
61140e2ba868f5e122516eb30a9e8be8266c435357aa7a22492cd20d6fa648820d1dbe09b9a1e29204339fa5b57d6bf278c8f2cf0b36fbe23bf12d3dc89b3726

Download Submit
C:\Windows\TEMP\Crashpad\settings.dat

Filesize
40B

MD5
c75904f52c5a3d06d039d7e29d12330e

SHA1
01609a94c02faad94d2500a526a955eabce1584a

SHA256
7ead57eb6e58b3ef599ff51ceb37d2b3e4355de28713b5cbcd0cf56a442f65db

SHA512
b55a3ff4fb2a25ca29e8a4a562166e5c13a6b63291df4e626bb19d33ee03cb9056dc9348ba28cb35ddefc13c3b162399cb260b91c85b2ccd1ab1a491ea1dc162

Download Submit