c9f2e2abb046ff2535537182edf9a9b748aa10a22e98a1d8c948d874f4ffb304

Analysis

max time kernel
40s
max time network
24s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
14-11-2024 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SteamtoolsSetup.exe
Size

978KB
MD5

bbf15e65d4e3c3580fc54adf1be95201
SHA1

79091be8f7f7a6e66669b6a38e494cf7a62b5117
SHA256

c9f2e2abb046ff2535537182edf9a9b748aa10a22e98a1d8c948d874f4ffb304
SHA512

9bb261b4ed84af846e07ffb6352960687e59428fd497faa0a37d70b57a1a7430d48ac350fbb0c3f0f11e4231a98ebca4d6923deba0949fdd7a247a3c02737355
SSDEEP

24576:4Fa9OUi2VoN2gZ1M8UQag3BXrYZt+GgGTfG74T+TRcL:Z9OUiTN2gZ1MExEZkkf+4TARg

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Windows\SystemTemp chrome.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

description	ioc	process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133760870359777210"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

4924 chrome.exe
4924 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

4924 chrome.exe
4924 chrome.exe
4924 chrome.exe
4924 chrome.exe
4924 chrome.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4924 wrote to memory of 1552	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 1552	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3084	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3464	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 3464	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe
PID 4924 wrote to memory of 2908	4924	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\SteamtoolsSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SteamtoolsSetup.exe"
1⤵
PID:2736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7a4fcc40,0x7ffe7a4fcc4c,0x7ffe7a4fcc58
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,14509516918971273574,7124787706352836538,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1820,i,14509516918971273574,7124787706352836538,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1932 /prefetch:3
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,14509516918971273574,7124787706352836538,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1676 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3060,i,14509516918971273574,7124787706352836538,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,14509516918971273574,7124787706352836538,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4428,i,14509516918971273574,7124787706352836538,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4892,i,14509516918971273574,7124787706352836538,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4900,i,14509516918971273574,7124787706352836538,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4924,i,14509516918971273574,7124787706352836538,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5112,i,14509516918971273574,7124787706352836538,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4960,i,14509516918971273574,7124787706352836538,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3724,i,14509516918971273574,7124787706352836538,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4600,i,14509516918971273574,7124787706352836538,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5108,i,14509516918971273574,7124787706352836538,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4660 /prefetch:2
  2⤵
  PID:3968

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
904cfe6d9f20c9b70925a6e1fabea11f

SHA1
431508e98118ea2e6c4e34830f716eb4bf56abb2

SHA256
7bea1f747be4a69ee5a7327162edccb15e3ea98e99c03ab7ad9781b92be98cdc

SHA512
5aea9045b620639d1ba13ff88c289aa48c05bd3544f77ff9a4729dbe549f3920c8fc434f5ebbed91c061d1a8abb23dea87235bde83a71068f944b8f4135a6b73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d90d13ad42e1c065dfdc90efccdc9c00

SHA1
5003476ba28d3c7467663610122b00f40d977667

SHA256
743bffe74ebbaa8d3e332c463fef857d3ed63f0d44a38f3c0e79e0220acff8b4

SHA512
4fa5f5747990c47fd84efc20a5a1b7cc01a71b0301b8c5bc125aa919dea256c71b1bb96173f70be3c94766c1dca5937ac0fbf86932269bbf296df4f68215caac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cab056eb555939a83af58cedb569c1c1

SHA1
232845383f0a336d06cac6c806d55b8db4420578

SHA256
813f1907e168da8cdb105da108304066a985d57f2893c2bc6695886b2617eb81

SHA512
bdfe33aa930320707d50b85fca2de4efbd33b0cd14796b0270b17fb617db8e97b4c4a5be11f84b5526b44f71e9b0ff0407092d5b44e681cf27bc63765fac0c48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
298808f48ff739adc59c29d0e4da0bb1

SHA1
d2c5ff29ca0cf7271830263ad5769d4c0022d736

SHA256
bb35a35a83e9d419be54f10e38a2b9622846e9354937b40a54b725df94deda44

SHA512
3a210e42c272ad052f647bda9bd107ce75cd780d80aa5959c8d897bcd60a5aeebd8b57ec70b007d3236078d757485aa5f004dba182ace4afe6c02812d00c1e27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
6a02286a8c8c0c74741bacf63ed0114d

SHA1
cc9c76d974cb85acbbd12c1ceb1a2ab8584580ef

SHA256
16c549a8a2b67012e5963568a0deba065423a81eeae782eecd65c400cd46c940

SHA512
5ea2f7a65885d8ef9d293eafb492b030afeadd79d1b659f1d04ff9640d584c6178e0e379dd8ba79c1b15d34c2e60033efbaf26f00865fcf4f858127712ed3ed6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e5950b2d-346a-47e0-9329-6a802fb5b898.tmp

Filesize
649B

MD5
3be44de6ef90145674fd86c1fed68682

SHA1
174032198192556e100dcdad94a57e67df31ed69

SHA256
f2dbccf5ced90e079e48075b939e1eb12639c3889469806963d8801a39a122b7

SHA512
7f082068fc2386a3c234ce2f7f241cddffff71de20794ed9c436d52a22e014c8de8ecb866082674a90ccba5cb711587d3017c45d8859083ca41e1b9521a340ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
78fc85a7ccda9f6f3644b4954103a4f6

SHA1
997875a6ba4744d0344366f7d35b92525ed52d93

SHA256
8e90f24974a908e64fea0a40c6749de5ec361237d64a53cb4b0273b413354871

SHA512
1029a7055da3cfa451551d0af32fc07aabd51e152b61510bdc43700a4d4cef1ab283acb57027fc00b2530ca7e3b5ec163eaf8baecee8521b516da5dbc7c20c48

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4924_1988575610\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4924_1988575610\ac1b329b-6248-410a-8efe-6962c365e6e7.tmp

Filesize
132KB

MD5
da75bb05d10acc967eecaac040d3d733

SHA1
95c08e067df713af8992db113f7e9aec84f17181

SHA256
33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

SHA512
56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

Download Submit
\??\pipe\crashpad_4924_FANXXOUKUUNJEACL

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit