Malware Analysis Report

2024-12-01 02:46

Sample ID 241110-bmb53swejn
Target https://drive.google.com/file/d/1lI-IL0gg8WoRTc-3cazYsUkFjjstyCRX/view
Tags
discovery
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

Threat Level: Shows suspicious behavior

The file https://drive.google.com/file/d/1lI-IL0gg8WoRTc-3cazYsUkFjjstyCRX/view was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery

Network Share Discovery

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Browser Information Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-10 01:15

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-10 01:15

Reported

2024-11-10 01:23

Platform

win10ltsc2021-20241023-en

Max time kernel

476s

Max time network

475s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1lI-IL0gg8WoRTc-3cazYsUkFjjstyCRX/view

Signatures

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Network Share Discovery

discovery

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133756749404246940" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "98" C:\Windows\system32\LogonUI.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 628 wrote to memory of 2100 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 2100 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 3080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1012 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1012 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 628 wrote to memory of 1152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1lI-IL0gg8WoRTc-3cazYsUkFjjstyCRX/view

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff8ffd1cc40,0x7ff8ffd1cc4c,0x7ff8ffd1cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1664,i,17458539974066551373,12604590548642852763,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1692 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1948,i,17458539974066551373,12604590548642852763,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2068 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,17458539974066551373,12604590548642852763,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2280 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,17458539974066551373,12604590548642852763,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3172 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,17458539974066551373,12604590548642852763,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3200 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4572,i,17458539974066551373,12604590548642852763,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4612 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4744,i,17458539974066551373,12604590548642852763,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4812 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s FDResPub

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5352,i,17458539974066551373,12604590548642852763,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5444 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5536,i,17458539974066551373,12604590548642852763,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5532 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4492,i,17458539974066551373,12604590548642852763,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4880 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1212,i,17458539974066551373,12604590548642852763,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5628 /prefetch:1

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3a35055 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 drive.google.com udp
GB 142.250.187.206:443 drive.google.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 106.201.58.216.in-addr.arpa udp
GB 142.250.187.206:443 drive.google.com udp
US 8.8.8.8:53 youtube.googleapis.com udp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 172.217.16.238:443 play.google.com tcp
GB 172.217.16.227:443 ssl.gstatic.com tcp
GB 142.250.179.234:443 ogads-pa.googleapis.com tcp
GB 216.58.201.110:443 apis.google.com tcp
GB 216.58.201.110:443 apis.google.com tcp
GB 216.58.212.234:443 ogads-pa.googleapis.com udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
GB 172.217.16.227:443 ssl.gstatic.com tcp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
GB 142.250.179.234:443 ogads-pa.googleapis.com udp
GB 172.217.16.227:443 ssl.gstatic.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
NL 173.194.69.84:443 accounts.google.com udp
US 8.8.8.8:53 blobcomments-pa.clients6.google.com udp
US 8.8.8.8:53 content.googleapis.com udp
GB 172.217.16.238:443 play.google.com udp
GB 142.250.187.234:443 content.googleapis.com tcp
GB 216.58.204.74:443 content.googleapis.com tcp
GB 142.250.187.234:443 content.googleapis.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.4:443 www.google.com udp
GB 216.58.201.110:443 apis.google.com tcp
GB 216.58.201.110:443 apis.google.com udp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 84.69.194.173.in-addr.arpa udp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 246.197.219.23.in-addr.arpa udp
US 8.8.8.8:53 4.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 peoplestackwebexperiments-pa.clients6.google.com udp
GB 142.250.179.234:443 peoplestackwebexperiments-pa.clients6.google.com tcp
GB 142.250.179.234:443 peoplestackwebexperiments-pa.clients6.google.com tcp
GB 142.250.179.234:443 peoplestackwebexperiments-pa.clients6.google.com udp
GB 216.58.204.74:443 content.googleapis.com udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 cxcs.microsoft.net udp
GB 92.123.128.194:443 www.bing.com tcp
GB 23.213.251.133:443 cxcs.microsoft.net tcp
US 8.8.8.8:53 194.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 133.251.213.23.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
N/A 239.255.255.250:3702 udp
US 8.8.8.8:53 c.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa udp
N/A 239.255.255.250:3702 udp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 172.217.16.225:443 drive.usercontent.google.com tcp
GB 172.217.16.225:443 drive.usercontent.google.com tcp
GB 172.217.16.225:443 drive.usercontent.google.com udp
GB 172.217.16.227:443 ssl.gstatic.com tcp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
GB 172.217.16.238:443 play.google.com udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 lens.google.com udp
GB 142.250.200.14:443 lens.google.com tcp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
GB 172.217.16.227:443 ssl.gstatic.com udp
US 8.8.8.8:53 play.google.com udp
GB 172.217.16.238:443 play.google.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 216.58.213.3:443 beacons.gcp.gvt2.com tcp
GB 216.58.213.3:443 beacons.gcp.gvt2.com tcp
GB 216.58.213.3:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 3.213.58.216.in-addr.arpa udp
GB 172.217.16.227:443 ssl.gstatic.com udp
US 8.8.8.8:53 accounts.google.com udp
GB 216.58.213.3:443 beacons.gcp.gvt2.com tcp
NL 173.194.69.84:443 accounts.google.com udp
NL 173.194.69.84:443 accounts.google.com tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
GB 172.217.16.227:443 ssl.gstatic.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 216.58.213.3:443 beacons.gcp.gvt2.com udp
GB 172.217.16.227:443 ssl.gstatic.com udp
NL 173.194.69.84:443 accounts.google.com udp
GB 172.217.16.227:443 ssl.gstatic.com udp
GB 216.58.213.3:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 171.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.16.227:443 ssl.gstatic.com udp
GB 172.217.16.227:443 ssl.gstatic.com udp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 172.217.16.225:443 drive.usercontent.google.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
GB 142.250.180.4:443 www.google.com tcp
GB 172.217.16.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 play.google.com udp
GB 172.217.16.238:443 play.google.com udp

Files

\??\pipe\crashpad_628_VXKDXKATDBMHHAQO

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 635d12fcdd73216d5929b5be48c4aa1e
SHA1 25439bfa8a62566748488e69e079cd0ab8ecac85
SHA256 71ecbb2f8e5f1dbe25c33558c94365eccb891ba80bb1003958d3c2e2f17adc17
SHA512 267fc36f539952e1fa932ef93b19041e15a8d88b7f973d0198837b63527f07a35905fd0142a053d2c3541396c65fdac6bd5f79345563cb40924a56c21bc168ec

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 b6338e029c43fdb45ee24cab30e7bdcc
SHA1 e858fb8a291e95dfbef4df4670dad0bd21c48f2b
SHA256 1620d680173b6889d7050d8389b5a4f3a7d36dbb496dfa668e5363abfdf01c87
SHA512 f757a3047e14fbb757d56f0eb013c752df196e56cf3101c4852fa367309dddf86c5840b0f0b59b9c37a9832646e6bc9226b3ae2beadccb3dc24a9acdaa2f1226

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e67e8ba2cf861337be79c30d6750ba1b
SHA1 62abc1e1fd35a5aea86c7cafca09c1216e23ea18
SHA256 656f15027c6d3189f0f1d4d45d6bdb86519f870425b88f1dcc264dede86deacd
SHA512 9be1ec2d384013478b14f8d9c79e7495f0e35f3eaacf678ce32305ffeec195431950d697d17e79e8f118b531fb1b5dd0ca3cb43686430fe93ee2a019bcae2a34

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 f0032f36d27b6c9f4a822a3ed9574fe3
SHA1 f1fcf9337d80a68987a86acb32e73be778c00d29
SHA256 3eb8be45ed7514f44ba50f8bfc2fb95ea343c06729f2e22e923d9345eb422e4b
SHA512 c6863b5316d3992058ca21c96bf97a4bd29db65315293cfdc577f9344bed5ff1f91783ae2442f1e959d90fe1164ff9c0c63459a04a1ae159c90138dc2d0f3afd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 39bd7de287619b13a9b5f6cbe966f391
SHA1 ac1b5c40981978fcd08b878d746c7ca82c413ca8
SHA256 c243e10aa454c46abf21999e32816382051600f309d5010a27f23f542c40874f
SHA512 3926b4f3497d073de46ac9e6fbdb75c1773353ef81f5a2afe02aa2ab47807b422d497db2e066e9315bfd7219c43d9b994fd278d22638003ddc0c884bda079ccc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 195292050aaf893e28720f3da86b4399
SHA1 307f2def0b1ec143184a797cb58eba1beea22c6b
SHA256 97babc36f25392d181cb252c14ac40ab601cf682c427a582eafe84682b9b2931
SHA512 50d0593fa7edc4684546eaeadc8b75e0a7b1e77fcae38321a3826085fcb6bb0288d1b7b81bf7ea9cafc4df2c14df7b70b86f29e93829390e91e4c2182ab00724

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 761d19bef84af80cfa7fdb0146d9ed85
SHA1 182f6b71a801ef72e9a452151aa1fa8d9ab4bb24
SHA256 4837c3e5e97a682d6a18c47d1f1f5abe01facec6b1e798e11b1f0e1a9afa8f47
SHA512 8df68da8c4342205ce643304f5fa82b7e8010781090d03d1ce7a042419eea4039f6204f162fcb47af33185e3381a577c3bed0cc9343daf0ca4110cb161dc94b2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 67fb07ff4fc1ec8cf727b69bfddc1c4e
SHA1 5702eb02b214f2d3238c21880065c5c65c5e243b
SHA256 94195a4f49a7926fa8bd0c73e401fcefa16b225053de0824c1c7989ea121d473
SHA512 5140ae26dad07b9c1415cb70301b0315f1f79a51598262b0250ba74c8ab5f49c4adb01bd9a68ddaf5a21e267a67f4cce1fd235e5bb2316f504278c7c02153504

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a311c7e078611a3b174ff6d5231cee3d
SHA1 98cf42caa186af0d979634dbf180e907aa3d5ef7
SHA256 cbb1792d9f8a68e52829d966a05b80e649a8066b6343615619545f1ff0ca4513
SHA512 2f32f43e8216591a4ee826a3b1fdfa112f221fd4e7f861c045692e708ccba14de3fd8cfadee7a9fb0e7431fde47361b3097e79a4b4598f8f2bafa440530dae3c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 93bb597eea8ef38fb2b03fa2abde9f4d
SHA1 a682c07f59e0f93e238333a6ddc0a19af78b9968
SHA256 c413ee3a3c63170a205ae86e89b1b361147dd24b490a341eeb2c7826ba1ba535
SHA512 f0fe1276dba9f64cf6646c4303edd36460920f2d1898b926af58c42080aeb49f65c602c8f7ffcc9d7859403e0ff73814ca464e3355ad69ea75653daa69632dc5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 8b7adb010406ee3defa40772b6d11d96
SHA1 3b497678e8977badaafbdc0a332ba8a9db702744
SHA256 b710b191e1f87c542c182e326f800265c1a16bc1c0895958376b46b378d2d4d0
SHA512 298765530639b113c87cb1838de17fe04cb20831b8be63aae88fd620a664fd19acecec674064e38216311f49af0eb023ee2348e1a99263a07e642ba321ef5e90

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 9a766063bc3edfcc36542b4391bfd138
SHA1 a61f2e87df27b0044cd02b0d93589614ddb10be2
SHA256 212dd3fab2216d57ee280a203f75c6bc22c5cc013dee2f98379088a0d82a14d1
SHA512 17567a9b6398dcbdb890bca2bd45edf5ae73b5cb57cac669e9382fcfb48cc9acd57abbe77f071d717011ca7ec4b0a52fb5416ad55a82e05c0eb797762185c33e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 72afb75523d2cc57580afba2c9cc12ad
SHA1 7e83df87f4fbd786e6954d9f7a702064445a2d25
SHA256 f76262c5a9df57a2dd93616a4eaa4e49638532062f76c992945f41f869d11f87
SHA512 6c131896993049b1f7e7389f2ef431b8545cf63f6970d2af81cc21b7bfc8ba4ea5d020fce495c3178440fcd73b64a88acb36ecfe3a829b04ff04bac02584927a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 48159187b82d73f3e8eec08058545d74
SHA1 47fa0dc61d7201ccc2458f05580781b4bf463e41
SHA256 ee34110bb56c780dbe62a0a1dbc361f0e1023f400a326707a554e1c9fe9f1156
SHA512 9195d3e7bfc6c9ead8026e159cd18c6857d6cdf0a2cb533e6a52a7fab31f907713f0bfbe0b8ccac2a975d74d8a5cd04848236ac170b2677df39e1a816afd1d5a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 6dd750023ff59172e04437d74e479401
SHA1 67e519d1944356b490f5faa578883c29e15a08f1
SHA256 ab424b31cda0026a783d815de7bea3027c4205b9245c15d0670cc9e8f1ad0819
SHA512 2b426fa9310112819407b2647c73cde780de3384d17061e26f71a519a3dae0c304780f576746f7ce826f39e55212adf86f8bed027fe9e309c502d36e61a11ccb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 daea1cb42eb559578dc63a81705cf129
SHA1 8dfcbc6b324d1e19c9c2c561eb79ba3453c93ea6
SHA256 8f3811fdd42a8da39e04712fe13cfdd1e76c766603bb63aa8e4b8967e112a532
SHA512 d8904aa787e87b6639b79c2e85168768e0e1ba235a93543624755f1c357551470fea469f26b2e92b840f93d04e7a2ff9e0948c913cf992856effb4851527a3f9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 25df7dce0cf6d688ed289933511e7578
SHA1 716650a67920c190e4a0555b0132a099be79a1e2
SHA256 565363c66c44a3242070b2c4dba7559cdc4be3bf9970835d0535a54da11fadaa
SHA512 d916a9303588977d293e6b740950d93b0c9bba6c85b08f901b5dc469d96e56021289e4dc0e50f9538041be9ca7a306db8eae5c41138e78f8f06ad39c72a1623c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ecf14d288d2b47783d7c216be1370fe1
SHA1 5fa9d06d092d4d84b09056bf89c5399d07d3b753
SHA256 b2f0577167bf61e35f694ade90f207b70bac1b1681071c56410ae255ff5e52c4
SHA512 b1d38cf553e9c608e03d1a02736a103d412aa21c637ade43ea2d7690ef3bcb0a6f1871c5a349ffc58a1748fdb281d784c7b5b93a70be81f3fc0a50ae2b59934f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 48fc9b132d7c4d5c0d371561e55dc96e
SHA1 8022102236f038bbc1e822afcd83e94183a272ed
SHA256 43897228c36146d16c6e3c75e016ab11dd70874eb083a402fddcdf19d60c5f03
SHA512 4e99dd12f9d8f27805fb04bcff8fb07499f819b134f03166c2681c49361ea81edba3a71b456c4b56413b872f5dbdca0098de793fe8ef09bf18d83167cc7179ab

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ef62e9aaccd816c1880658d31f24fe7c
SHA1 a35919786feb74e1fc163de5b9d4f39e385c807d
SHA256 44a0c8a9cf65ab20fcdbfcec671d5d12d1acba354e4a0c44cb5dd5cdce2b334b
SHA512 ec78a966723f83f76b910e3dfc19f6e6338c857fa5f4df426ddacee1e50e684d23540acf50c27e69dae04510897229121934a8fe55e62b83a0caf4fe3ae4cd01

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d96a417702abb12b7f4e25468e980767
SHA1 a2fbe4b81eef62fa34694ece270093e6e8da8aef
SHA256 9403953a6525fe71dae910de062cfd06cfd39af9ee81edda32e7b7031b92f65a
SHA512 10c78877a2a3efa958b0f2b6663f6f770647b3087eda24583dd36813cbe93bd646778f6f8c5631d99668155c461034fe55dd63c027b166aa866ccf80cab541a6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 88209205c4b7827ac365297de52d0486
SHA1 6d05bc3125a5562eaaf2a1e25c4f67d05043f2c5
SHA256 5b5d19f8be96fbaaefcbeed48c640a42d690f7cac4287caa47cf8b561432d27f
SHA512 84228e7ff714de481e58cc56ccad788dd3ee37d0bea2b682cad3aa7cc12945d678e545458c63981dc352bf743a8cd82b60182b5be286881778afba944aefd3ef

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 dd5118edc44867898b024c5709407ba9
SHA1 0e96dfcb68e17b3d073dc68a10f5183de95930ed
SHA256 10a61526f9121b87545100d8d5d7a8ebe98df9d8a70fc7fa4f1c1157234b8f2d
SHA512 3e57c6eb76e25dbe994c04cfff005f9f810d2c6e612794646cd6009cb7b3efc53906f74f03a8ef891a1fc9c8a0aab205c23a0dc27f1812025168aa60bae7c7a3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a47a0451068a5a02699d5675c406c8bb
SHA1 8bc08ce5cee7cad8f14ba7b5d0817f9ea6a01d49
SHA256 1bc1894991c399b5c7fd3ea0bf746fe78be8fd7e3f76fe06d9064afe84428866
SHA512 8a8a4d0b30b0e54bf46c9e0ff64ec86e331333062d7f8fbbf4e3fbacb48c277ea9f315174f2de3021b468f4bf545c00ba40f24035eee44d181f2b29583bbbd6f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 d97d3d4d99598af57a3ac30847470365
SHA1 db806065929198306012ed6ec1fcf04302bd985f
SHA256 38a2fb36be37f8bf3dcec779f6ba647abf4a4388430d86683014c246f8eff1c4
SHA512 caaccc455aac8b3725f23e0f27f1f45a7e1f8c0a6dbed773c93b8cfeb5b0728dabd3ca5e2531f4be084731a7aa003e6854d69d6fa0404224bfd260475949a4a9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cc96b77cf5d51b48bd72fbc6bcfef116
SHA1 c3e15d8ab89fdadf3e8c73a4ead29ae3a15a3a51
SHA256 066f96dddc13e72287cf0dea45dc92c3748a9af4933ceea81518b2d973e8d04e
SHA512 501aec3323ac47ed5fdc630ea75286752ba6f3571fce99637e5668fa86228caf25cb0f11dd9b59270b70852288509b3bce9e1383c873836c121e2b87a7e1e797

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 5db635b7ae7c47eafdf1b1a4cc2ae50b
SHA1 ea484d0ade56dbcd808e33f7e0663aa35385551d
SHA256 7bc8e0c8a616b16d2df394a64eedf7ccc5990f9dd7486cfeeb335680af0a9ba1
SHA512 bdf218b96a50880a3a0a6ed009427104bba1d4ca7a9f14ad6b1e299ef2737d3d5fbd6bae22ce7dd95113bee1f3aee9b9a6d1afa3f78150f1b8e8cfd39c351cc1