hxxps://google[.]com

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/08/2024, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://google.com
Sample240804-s2kt7sshkc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133672594483255673"	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3768	vlc.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4952	chrome.exe
4952	chrome.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3768	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4952	chrome.exe
4952	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeDebugPrivilege	3312	taskmgr.exe
Token: SeSystemProfilePrivilege	3312	taskmgr.exe
Token: SeCreateGlobalPrivilege	3312	taskmgr.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe
Token: SeCreatePagefilePrivilege	4952	chrome.exe
Token: SeShutdownPrivilege	4952	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
4952	chrome.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe
3312	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3768	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 1972	4952	chrome.exe	90
PID 4952 wrote to memory of 1972	4952	chrome.exe	90
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2892	4952	chrome.exe	91
PID 4952 wrote to memory of 2304	4952	chrome.exe	92
PID 4952 wrote to memory of 2304	4952	chrome.exe	92
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93
PID 4952 wrote to memory of 4736	4952	chrome.exe	93

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe7a28cc40,0x7ffe7a28cc4c,0x7ffe7a28cc58
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1716,i,10730716387403580116,15942838987879514731,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1720 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2136,i,10730716387403580116,15942838987879514731,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,10730716387403580116,15942838987879514731,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,10730716387403580116,15942838987879514731,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,10730716387403580116,15942838987879514731,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4416,i,10730716387403580116,15942838987879514731,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3796 /prefetch:8
  2⤵
  PID:4528

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4148,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
1⤵
PID:3260

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3312

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushConfirm.mp4v"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 209KB
SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
MD5 3e552d017d45f8fd93b94cfc86f842f2
SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 a517dc1b58b365ec586898de81babecd3ec1b3b369081b47b394d2d684af6932
MD5 16662d003aebd764b9f30353170dc88f
SHA1 8f3a97d8954d679e0041b2177eaed80457ddd9e3
SHA512 ea4cdfb7305efe1f7a62815da23d973a904b1c1113b9b56ae540e29fb069b6de1e8e24e999d8c9c0d435f4de6d9fdde99665eb25d8c89a18555530bd70087ac5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 671d108c37e94d9d44177d1183b82bf803b7d819542b50a28bd1c933796d9c86
MD5 f5c325b74d8f3f7f0eda9d62fb1d353a
SHA1 1c97bc7bd2fdd173fe6afe754409b5583b5f1bac
SHA512 f4fa7daec6343c37b5f1cec8b73a3c861bc14505ef40552b2294c4cbf14efa957466f3e522d33d1dcab1ee29ecb3128860b2c30dc65992936d1c9d082e21a98a
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 69689780133f64892ead1121586efa1e1f3a827d3ff81f8fcd15dcb23fdc92eb
MD5 4d6d25011c026708227f2e2fb517f847
SHA1 71c12ed15f36e16ad0a45bb8e5da9a3be4a36190
SHA512 3a07b91daf07b43c87e85f14d3571f64413eaa57296b2fbb077f18fe37c8a73f10fab5b4d2181349df388927bd80bda5a0248a434c0383900fb84b7b989ec385
SSDEEP 192:WkLygUidBvYkLgebueHV+FodsQeJQPo6yIsnVdg4:WkLyxcvaqGysXU4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 a128b4830b9be253d8c63e99d75dfd85ae5ba1ce67bc745be14bb7c8032bbcd1
MD5 8c3c3bda903e1fe714b665d7e0adb9f4
SHA1 21b6ecb8ae5b3f720bb7e405af23f8a9519b7b7e
SHA512 62c14205af73e398166ba3e486b66b37d43976d40787a2f2975faad204642734c3033a6b4c9036885cef3d76379e2d431828a2fae41ce6279cbf99fd02d3ab01
SSDEEP 192:WkLygUidBvYkLtebueHV+FOfkmeJQPo6yIsnVdg4:WkLyxcv3qGqkVU4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 ff8ae242a875854298f8d47a840f7be58b59c3a0b91939097a0590591ccd3ec4
MD5 f71453f745381fbdcb5af9e9d9793994
SHA1 b7fdebd10c10016a5ff9b39a0d12e9ce4e51da8f
SHA512 cac9cd9014cbb33d055033c5a06fbbe5535c4137148720cd7f3eba1def089029816ce9683374ae2454c9df84afef83cba74c2ba10fb193525f76912d865cc89a
SSDEEP 192:WkLygUidBvYkL5ebueHV+Fbds9eBIdo6yIsnVdg4:WkLyxcvTqGps0y4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 77232ab560b2d1427f0e284d70377ad46f27bf9377f4421668c065fb292b7dad
MD5 43cdc55e5928fae559c73c85e4a8ea6f
SHA1 8156e703e1d8d66d60df67cebd502ac9d435bfab
SHA512 54e5c0a9ea5205301c92edaf59f15a7edd5c71bee4814a7f7897de36246a6b4a8f3c14a4ce8b9d62273386c4042c2fb32fe452981ce897821986786eee79ddb9
SSDEEP 3072:MDiMausf0pMIAfelh5DHz/TOaEne1iTaFPOkfLWzGH03oe35YUG0TFrmf7lJaQoI:4hXnt7X0ewWFmkf5U3o310MBdodSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 9ca2caee6c54ff5862a95a79b68779220b0d2ec3bcd45b771b6a75ef3c8e1acd
MD5 468bd7bdfd7371aec524324b011f3ccc
SHA1 ab8a2efb68a209dc2c12d3fc893c9f74cf6cea5e
SHA512 77436e5b08a7096505b78487202d488eed94a46490a04b2359180408d270aacd66fb64ff8acae16a5efcecd25ae56129192734329c213d30778826c8fdf5337f
SSDEEP 3072:5QiMausf0pMIAfelh5DHz/TOaEne1iTaFPOkfLWzGH03oe35YUG0TFrmf7lJaQoI:2hXnt7X0ewWFmkf5U3o310MBdodSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 51c0e16e962697d91598514ca546abd2f5684f5701fcea90bd59eabfb4966f85
MD5 d289eb13ca3944822614876b9faba0af
SHA1 9107c3550952763f0858e5dd276bd3d8222dec74
SHA512 48debeba69906b3f1362b68be2eb607d55da44585a2c0c2e377d38eebc3b22c51b241d86f23a572760b49e6dc7f6230a0a3bfb7212516302c039a4537bb48865
SSDEEP 3:MsEllllkEthXllkl2zEklTc:/M/xT02zn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3312-53-0x0000021B3D650000-0x0000021B3D651000-memory.dmp

Download

memory/3312-58-0x0000021B3D650000-0x0000021B3D651000-memory.dmp

Download

memory/3312-60-0x0000021B3D650000-0x0000021B3D651000-memory.dmp

Download

memory/3312-59-0x0000021B3D650000-0x0000021B3D651000-memory.dmp

Download

memory/3312-62-0x0000021B3D650000-0x0000021B3D651000-memory.dmp

Download

memory/3312-63-0x0000021B3D650000-0x0000021B3D651000-memory.dmp

Download

memory/3312-64-0x0000021B3D650000-0x0000021B3D651000-memory.dmp

Download

memory/3312-61-0x0000021B3D650000-0x0000021B3D651000-memory.dmp

Download

memory/3312-52-0x0000021B3D650000-0x0000021B3D651000-memory.dmp

Download

memory/3312-54-0x0000021B3D650000-0x0000021B3D651000-memory.dmp

Download

memory/3768-202-0x00007FFE79FF0000-0x00007FFE7A024000-memory.dmp

Download

memory/3768-201-0x00007FF782EC0000-0x00007FF782FB8000-memory.dmp

Download

memory/3768-203-0x00007FFE6AA70000-0x00007FFE6AD26000-memory.dmp

Download

memory/3768-204-0x00007FFE69050000-0x00007FFE6A100000-memory.dmp

Download