c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

Resubmissions

24-11-2024 17:01

241124-vj2q4swkdl 10

26-10-2024 14:16

241026-rlatmawdjq 10

26-10-2024 14:13

241026-rjt5gsvele 10

Analysis

max time kernel
93s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26-10-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

builder.exe
Size

10KB
MD5

4f04f0e1ff050abf6f1696be1e8bb039
SHA1

bebf3088fff4595bfb53aea6af11741946bbd9ce
SHA256

ded51c306ee7e59fa15c42798c80f988f6310ea77ab77de3d12dc01233757cfa
SHA512

94713824b81de323e368fde18679ef8b8f2883378bffd2b7bd2b4e4bd5d48b35c6e71c9f8e9b058ba497db1bd0781807e5b7cecfd540dad611da0986c72b9f12
SSDEEP

96:IJXYAuB2glBLgyOk3LxdjP2rm549JSTuwUYXzP+B1izXTa/HFpff3LG+tzNt:IJXDk7LI4uwtDPC1ijCHffSs

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

Processes:

chrome.exe

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

builder.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133743807302964938"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid	Process
4904	chrome.exe
4904	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

chrome.exe

pid	Process
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	Process
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	Process
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	Process
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	Process	procid_target
PID 4904 wrote to memory of 2640	4904	chrome.exe	85
PID 4904 wrote to memory of 2640	4904	chrome.exe	85
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 3508	4904	chrome.exe	86
PID 4904 wrote to memory of 1972	4904	chrome.exe	87
PID 4904 wrote to memory of 1972	4904	chrome.exe	87
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88
PID 4904 wrote to memory of 3136	4904	chrome.exe	88

C:\Users\Admin\AppData\Local\Temp\builder.exe
"C:\Users\Admin\AppData\Local\Temp\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbaadacc40,0x7ffbaadacc4c,0x7ffbaadacc58
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1844,i,11224532458898981563,12047507166744818718,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2064,i,11224532458898981563,12047507166744818718,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2208,i,11224532458898981563,12047507166744818718,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2256 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,11224532458898981563,12047507166744818718,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,11224532458898981563,12047507166744818718,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4416,i,11224532458898981563,12047507166744818718,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4068,i,11224532458898981563,12047507166744818718,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3116 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4072,i,11224532458898981563,12047507166744818718,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4080 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4276,i,11224532458898981563,12047507166744818718,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3316,i,11224532458898981563,12047507166744818718,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4880,i,11224532458898981563,12047507166744818718,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4404,i,11224532458898981563,12047507166744818718,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4664,i,11224532458898981563,12047507166744818718,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=212,i,11224532458898981563,12047507166744818718,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3144

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
b58c9c4ebbc5d9783775031cfaf6da3e

SHA1
084c96c03ccaccc4235efc7e4da1714db1cd42b1

SHA256
6f59bcc17c166ca9847eca77c1706a17c616edbdd0db3aa6e8b0abea5608bb08

SHA512
9f2f066082d74f5478b377b3d94be35606ade71f12cb9b9918afc6580e6ad826478706164a10730c79c95829f7afb1f680a7a3180a7c2084973338c4e90acb3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
37318d9ad13dcdd8541ad7485d0e416d

SHA1
6d3aa39fc819dac3bc76dc107ef6483e7f1d8e06

SHA256
b875d29bf88a6304e299edf0a990d774b59d7c17223b9f1e93bf067494e682f7

SHA512
7f9ae0b0893b56082c6c4ce27233e596a08348ff9bd53a3266d974c7f32fb452ec75de36aa1109b46d7325544c4809f7e6386290d4a73f598f286b8acb01ce8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
691B

MD5
7daa267a09c7f4412922ed130c4668d4

SHA1
70e0aaed43c23408b751dadbd356654612bf802c

SHA256
117d6e7d6cdddc9d467adc014a3f7944ec78d538023a789ad5b052d86e088b6f

SHA512
9b4f47ce5920a55880490d9696b055fb8250839f037d19072b4adb17e6251fe3907d38d8ae2a4bfcc2380255e4e8d0d0c29054278371dd6b437e30b8579ffe18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
2acd234de6fc3b4f39ec21bc7c7ce2d3

SHA1
ead875560e043f71e6491a489427206916e68d2f

SHA256
440e141139f506f2c407421e37bc41406cc060bb9ca932dc90a684d8bd8e8846

SHA512
96443782fc27add45679b1331442d2be530a956590c484ecbb3a8b2e57b41c6df3b01020b90da2638ab8e61785350addaf0e7e60029affe5628caa5fe3793d11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
b58dade5f972bb960343dd67a3431218

SHA1
9a5072b71d64f44ea0662d2ee270214cf182ce19

SHA256
58fba0bc6c0757a535d87a1acaab86189018646e71cfc723ed8faa9b34e88218

SHA512
4283e9228e94466d09e2eb755d023e6a5d0df5e648fda95f3ff3c0fd5abb7d542f00c17870dc4dccb398a8dbd813c139fd96ac86eba8671e9334e2f8192f3fb3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c9a201d52aac1452bb50264f1c171314

SHA1
2d263c424ca8ac2f4869eb280e858443eb5c6ebc

SHA256
ea074fa18f2af8d711c3f65034eed1610ea1d239156ccae30e653a6a37a40878

SHA512
ac3eca43b38b05002c90ee8a616411eb7ad9c48499e3abc4004a7121471b1687e92aff064ae177fcfdb55b3d9cacea667b2412a3796dc3e7852b631e2c37cb58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2e28c6648f6d5f3cabfe3311d0d5f608

SHA1
c5a3992cb57f3392f918bd02731938cd23b61dc0

SHA256
52f822dca7185669e02708b88face61e85eae807624f7b7ba9ea3ebbe8da18bf

SHA512
ed5c4b98b60243199fee1648dd0385bba8a0db1d402dd86129e464715caf456d4bd84f0dc1c922c02b900ce976fd4f456c48f8969f21f8f099a7a1ebd99aebbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2975fd4f84469d6e899656e3773590d8

SHA1
bca214d9e1242d5acc1573fb67f390b401103b93

SHA256
01ef193a537e232ffac3967101fc8e2ae5363673712eadae6a22aa8ffb366036

SHA512
aa93f55956683447aa8f7f666ad73ee8364ce7540335cb3d355fa0684596b6c3d12dd5735c4d7f1861ca1ce60ed1338cf4e8a232331bb5dac561e85267ef0db7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c48114e16b047099ef6e482da74cda91

SHA1
d8d9a0b617d86605548a4a8a5497d8876a0ad26a

SHA256
be2053cc56744bd98ef583c2410d333ea6a8b6d6fc5c4119394ceb5876d2ecae

SHA512
7ee6d84dd09dc68338f55e46ed650956610a8f731e2df5e121035397e62daeb829281ff0639e40684cf281ecb4f30cdb443a9ed470e1937d4cca95350c0e0906

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
63a287907fe61ad48d2972eeecb7624f

SHA1
5bb2086eed9bd785e3727749aeb8b7a0dec4089c

SHA256
ffb6702d3ffd3f5a5497351ea7c1cb7ac07bd9349c70201ce0c0db0ba1bf199b

SHA512
33c693cf1c3bf013dc29352a0f20483a1fa304dc3b081b1051250bdfa71c3e1b9f210201d29b5d2da75b5bf8a86e30a706785d9d4ec19c9a9cd65c02e093daf1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
487536b292793b4c63c54e29cca19e67

SHA1
646e5e0b2de79910d3221aa77c5587b576f1cd5e

SHA256
4a3650aa2a46ef5ab5fad0b0c8f98e484a49a65a7c53e0f6ebe299b0aa13d74b

SHA512
570344ef272cae0906776d76a1081f7d76a991e0e62fb3c33232df49d7c9f2089ad500af27becd33971ea9e5b5267b37aec83c88b8a9a86f5af3e31dc6122c81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
505e1b677169b67bbf8a784576be2325

SHA1
93be8b6856afaf996294a461df65924054030409

SHA256
33bce1b0369e2b01c02f92b764c093ca9991b77722db79c1863fbb1de6591fec

SHA512
a8a4867703d22742d92fa2fa5a01212388383da178a33aa36f0f1641b5c54110e4a58078620d532cea847827ad4b93804633a999543bf80ae9a608ee97b6a8af

Download Submit
\??\pipe\crashpad_4904_IJUABRMUDUPODLMW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1992-0-0x000000007518E000-0x000000007518F000-memory.dmp

Filesize
4KB

Download
memory/1992-5-0x00000000055A0000-0x00000000055AA000-memory.dmp

Filesize
40KB

Download
memory/1992-4-0x0000000075180000-0x0000000075931000-memory.dmp

Filesize
7.7MB

Download
memory/1992-3-0x0000000005650000-0x00000000056E2000-memory.dmp

Filesize
584KB

Download
memory/1992-2-0x0000000005C00000-0x00000000061A6000-memory.dmp

Filesize
5.6MB

Download
memory/1992-6-0x000000007518E000-0x000000007518F000-memory.dmp

Filesize
4KB

Download
memory/1992-7-0x0000000075180000-0x0000000075931000-memory.dmp

Filesize
7.7MB

Download
memory/1992-1-0x0000000000AF0000-0x0000000000AF8000-memory.dmp

Filesize
32KB

Download