hxxps://github[.]com/kh4sh3i/Ransomware-Samples

Resubmissions

27-06-2024 22:14

240627-15qhvswgll 6

25-06-2024 12:16

240625-pfngesscmm 10

Analysis

max time kernel
54s
max time network
67s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/kh4sh3i/Ransomware-Samples

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
291	raw.githubusercontent.com
292	raw.githubusercontent.com
24	raw.githubusercontent.com
25	raw.githubusercontent.com
287	raw.githubusercontent.com
290	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1868	chrome.exe
1868	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2092	1868	chrome.exe	28
PID 1868 wrote to memory of 2092	1868	chrome.exe	28
PID 1868 wrote to memory of 2092	1868	chrome.exe	28
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2604	1868	chrome.exe	30
PID 1868 wrote to memory of 2520	1868	chrome.exe	31
PID 1868 wrote to memory of 2520	1868	chrome.exe	31
PID 1868 wrote to memory of 2520	1868	chrome.exe	31
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32
PID 1868 wrote to memory of 2784	1868	chrome.exe	32

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/kh4sh3i/Ransomware-Samples
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7c69758,0x7fef7c69768,0x7fef7c69778
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1232,i,9634439720814881281,3109468683599790476,131072 /prefetch:2
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1232,i,9634439720814881281,3109468683599790476,131072 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1232,i,9634439720814881281,3109468683599790476,131072 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1232,i,9634439720814881281,3109468683599790476,131072 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2296 --field-trial-handle=1232,i,9634439720814881281,3109468683599790476,131072 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1476 --field-trial-handle=1232,i,9634439720814881281,3109468683599790476,131072 /prefetch:2
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 --field-trial-handle=1232,i,9634439720814881281,3109468683599790476,131072 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3536 --field-trial-handle=1232,i,9634439720814881281,3109468683599790476,131072 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=816 --field-trial-handle=1232,i,9634439720814881281,3109468683599790476,131072 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1944 --field-trial-handle=1232,i,9634439720814881281,3109468683599790476,131072 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=548 --field-trial-handle=1232,i,9634439720814881281,3109468683599790476,131072 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1940 --field-trial-handle=1232,i,9634439720814881281,3109468683599790476,131072 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3924 --field-trial-handle=1232,i,9634439720814881281,3109468683599790476,131072 /prefetch:8
  2⤵
  PID:1872

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96d72f23168fa75992d4799be233f84a

SHA1
573a6e8534d79aa5eefe8bb717618b39ad8bf9ca

SHA256
32db0190994d2ecde6c73b3cb7d8936d351faf3c15f67af7e053f13b412746cb

SHA512
264494277ad32f4eb0b370925c762822366e13e2edace730d5422c1c04461b0a74f0c6fd4a7fd361479ebbf478bdb3ec7aae1cb8455e7c4115bba9b8c3a0b02d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
571bcc49ecf6c13fd06cbddabc75adb3

SHA1
5f43aef63ca33903ae3e2083b241e7efe4614665

SHA256
208d8b6da26d291ee4ad30fe5f9f23c117e027ff1ad3f46c296e9f04a5633d9b

SHA512
be0780b1645212bc2ed02486fe5b12410363c581cb61cb807f74be6ac27009c4ca102e2ca6db4a212ef8817fefbabc94fca0ea81b5dd6ce3e9aa149077aa03e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31e336a615acc00f45f3817501541cbf

SHA1
ab73cffcf6f3966bd62fd886c22bd47113868b01

SHA256
7f3ecfc7d28dd19c4c21dd055949bb1455473e3208b32ab8e8506d09961fc8a0

SHA512
c72a4b934f35e5b3e7df3d47a1dc59ade7fd886027a3037cc5b65c708a59b8ccaf28df00fe41eedb246d199b5a4bdce53ff78b911fc19e8b3d47fd3c04300066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cebbc9e10da587ed1ed335ba69ca445

SHA1
3584efdd637a2a1f0e2bd001005aaf36e11bfb08

SHA256
30fb649d4c9e4c1a477d1a3b172281716166fd7139f0e6672002d1cff43aace3

SHA512
b483036f88b8508dd4ccbccb4d172749706ffd80308e44775b4eaebd76fbfdd2d2ab58d34b6f5b26095dc27c88357f3a65890bca05c98f15a9c353301df147a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
82cdeb11904a4329717ebafcdf9dec48

SHA1
995b822138dc4f18334c79d2baed57451dd1c557

SHA256
f6b838c330394e26fc9d230cd8931296b82776662191a50a029b2fcc1ff12c2c

SHA512
950dd3cf0ca2f2b7c42e648751f97b8c52cf3ce89083a0be35e93aabc5b0e9032fc08b4180a477f17596d3474414fbb677108883261f17f7f486129d68f2593f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
0f10080216d6c8e2e912354dc357b071

SHA1
6898cd2d61377285eef3e05ce04a73f6099ecf73

SHA256
7d87fcce9d17364f9e2588288a9b294a695cd142d1702b856a72de0d79a2c821

SHA512
34dba7664c1cc48497cd281e082f7e5849d12dfeed840cfa29828c9ab096993276dbe352f4b3efde1db15d88aa26ad4d637a77f405a681f37f26de3a63876cd2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
701007e0ce0e9b84412d5c10178b18e6

SHA1
e4516515b7e6f2b565e2c5ca83acad0e28f74134

SHA256
ae5feaf12d5401135282879a5df9d4c00f3bb6cc4436508a821c86cef8922df6

SHA512
7cda5cd3a098e786d206f1cfe988992691c368bd38c84c6f4fded4997af11a5b30c03443f3d5f545580c4542a5678a5b792089e0f4a2eb59657b72d212fa37a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
aec32ddaad7a512ad9066f64421dd655

SHA1
4561d627d6e265191635ac72824c7ea4bb87cacd

SHA256
547927f02068e4dff7d68cb48fdd6dbdb75e98a55e9ce0ef7049d7310222b208

SHA512
cc637a0ca5167ef340b2e59c65398675c57a33654f2ca1d19b1d15fea32636f1a2c1c9c85b8dc9f93c9d90c1ffc80e5ef44b77c786c351beadb1c93dc3a8ac7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
11d2edfa5a4bc5241857ca09c98e6721

SHA1
47167d9b4f34e13a2e90526d0f3a761f1a547ec1

SHA256
137e403ddf335b84d760a73441c41f74748bf786134a6be9ef02e753f3af49c2

SHA512
1a73615e8c2098a18be11934594b4aeb295c7939cd94c13dfcf4fa60996c7ec0f3c1df682d6eec2d0903bed1adc5b8e7c4d08667e24589440310174358712d68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a8c947880dadd1c09bc796d6ff473b86

SHA1
62f27facb67da4e150e88f176e9aa39b1a7f8320

SHA256
a2b31483e6f89d3399f2a2a227adaeef701725372a24029182e5bb25644edcea

SHA512
66011629c2c303e48baaf0bc56685f0cb8f8f3cc65cacee445e23d9a261c7886641d58b5937cfc47970aeef412ec4086b4a512a4684be98fc6b7398368672316

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4142dfea610f088d4becf308f00589a2

SHA1
ae5706531a0196e8c01404970d14398e4bb985ae

SHA256
5cf800e24e6c3790f792db40729f5189c7166cf9a98edd41ab737aa95c4286d4

SHA512
5c696801d831a3abba7ae5e280452e8ec63ec4c3fcd4d7a6afe9415f5e56750ce6d907a289053a93c6755b2734fbc5602c5e0b6489246a86018dc1deb41c3461

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
140KB

MD5
54612244d68c5153826cec7146a61bed

SHA1
3e1e82ee44f7b9767ad913bdabecaa529fdfc942

SHA256
dad7d0e9d37cc7ecaf0c23832e05a361061f1c2153115924b9761955822d3f33

SHA512
dff72a0f6e66c2693bfd8484f2253920d42c52ebe0f51adf494acccede3b333cd03491fbb50bfcb9432f547500411c381a12d08edd3f4c7a4a3ee6ba34bcc3fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1EDD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit