hxxps://security[.]microsoft[.]com/mtp-investigation/urn[:]SubmissionInvestigation[:]7329ec31025e39f4a6311909a6ef9441

Analysis

max time kernel
1808s
max time network
1697s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2023 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://security.microsoft.com/mtp-investigation/urn:SubmissionInvestigation:7329ec31025e39f4a6311909a6ef9441

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133235832796629109"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

4516 chrome.exe
4516 chrome.exe
1392 chrome.exe
1392 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

4516 chrome.exe
4516 chrome.exe
4516 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe
Token: SeShutdownPrivilege	4516	chrome.exe
Token: SeCreatePagefilePrivilege	4516	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe
4516	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4516 wrote to memory of 2036	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 2036	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 4784	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 2440	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 2440	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe
PID 4516 wrote to memory of 3332	4516	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://security.microsoft.com/mtp-investigation/urn:SubmissionInvestigation:7329ec31025e39f4a6311909a6ef9441
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac9d09758,0x7ffac9d09768,0x7ffac9d09778
2⤵
PID:2036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1840,i,10741431305984583921,10713149701414225584,131072 /prefetch:2
2⤵
PID:4784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1840,i,10741431305984583921,10713149701414225584,131072 /prefetch:8
2⤵
PID:2440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1840,i,10741431305984583921,10713149701414225584,131072 /prefetch:8
2⤵
PID:3332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3180 --field-trial-handle=1840,i,10741431305984583921,10713149701414225584,131072 /prefetch:1
2⤵
PID:1840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1840,i,10741431305984583921,10713149701414225584,131072 /prefetch:1
2⤵
PID:3868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4476 --field-trial-handle=1840,i,10741431305984583921,10713149701414225584,131072 /prefetch:1
2⤵
PID:1640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1840,i,10741431305984583921,10713149701414225584,131072 /prefetch:8
2⤵
PID:4392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4704 --field-trial-handle=1840,i,10741431305984583921,10713149701414225584,131072 /prefetch:8
2⤵
PID:2780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3932 --field-trial-handle=1840,i,10741431305984583921,10713149701414225584,131072 /prefetch:8
2⤵
PID:2660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2836 --field-trial-handle=1840,i,10741431305984583921,10713149701414225584,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1392

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
9601fab6180076c8366f578df6e0e4b7

SHA1
3148568e0d4ee9a2f3df71c88ff7a58b3302d7f7

SHA256
9b88f3c3f3bc7757d633bf3b4575ec623333497e3805a6a661802edea5c2eab6

SHA512
76516054f397bf8351f8455d7c514163333252b3b9bd00d89c70072ed9680ece72239bd9717c524c75a402157663712445e42c6720684708d72eb18ed9be94c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
0b177a5a91676e48cd83071ab9f0d97d

SHA1
fdb2b0a6033afb74f05013e34aaf8ca4fbc0df95

SHA256
6b7848059f90a1c4303932c0f2427160f18a166a2551c34f9a8b31d6b1c0d834

SHA512
ca74c999a4879cdd78205196453081d84122f5e68bc226405027e5695581460ba994beab7663073e068aab5a1159745c8e585c7f9547bf4fd0b4ca3d5fc3a4c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
7d22b8871381b01e709f96b979b35387

SHA1
76bd8826ffa5fec0b7358f8437357bd6ebb8db07

SHA256
2f91cc2503a4d2473ec8b0b615eb628c62bba8f92a98f182090eafa110b2ca40

SHA512
ba90a6714a9d16df57d4a7fcae62e990614651008851350f336a5b0ec11187fbad8bc531021fc0dd35bb4f7910397e29d42821898f663aa1a286663c57e4d975

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
873B

MD5
d65374db012431130d6c569f6531f519

SHA1
7a2a9d46826f9b5d49e04915f82fc313b5ab3a0b

SHA256
6f4b091ce0e42bc93584138525d00bcc22c1e20e93d0805bdcb80d29d4c9ac46

SHA512
3daff00f8b7bcbf377b0ff66e85e2cb69c7d87aa5260429dd142d43f2999fc07ea1a2650e76b0d690b852f232e8f01bf3a1c24b0ed21f85874ae6c39394ca387

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
873B

MD5
279078569bab30f68b7d0bb069ca0be4

SHA1
bdbe08d92feebbef95867cbb01bbcdd0d091c435

SHA256
ba4c02252a9447b7939241619935467f4ff6e70ea1b247afa07014220485697a

SHA512
c0774abba927aff5c73c5f8f00c8ee9ea517c38aba1ec628473c8ae1bb8fcd772c5fd938230f31e1450171b315c095b2a16d4ce03cfaa791905e71ab69129468

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c67e8fd49932ebac5a6243dfc2b0798e

SHA1
d42128f027050eaa279aac3bdd6774a0a183ceb0

SHA256
d9d71ad2db055e20ffd53d336d27d5b2f493b8d750e17da821daa24a4a421f66

SHA512
dcbff05d16f453e82c1e7f27fe39c98aff673061e560e9d0599232dbbd32746b2de7304a8471f6f4a2b134d0e56bc89973a152957cf585b54ed105bb003197ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d49be32e2b9a2cda66707426a12e184a

SHA1
2b0d315292d83892ac68bcc26bb5624c3057d51f

SHA256
0f190054baa49b30df3365a320388a41269a82d087f395db15108ad148c9b361

SHA512
2e881bd824e7875e863fff561e45df29008ae6a4efb7d7a0b6a3a787b7d26a523e47c0f9a8ff4f10f638b4ac52f3063a46e9385cfa6046b743c1d30775e1ba89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
60534b36cb4903418186e3b85adb4749

SHA1
2135afd1e1ceb08de931e4d44c93fc1dda1b4a0f

SHA256
ed9491ce77124a1ff489b363a825eaa9af59402ec48f3eafa0eeed704f1d9718

SHA512
a6ce184e6559263a203116b4164fd898880f6769c81702effffe08592ddc8954871ef658e496221d518c49bccbbb42dbcbedc44914cb46e3c8bafb66d2fdf811

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
143KB

MD5
3160846f17797472b0c18cb1e869ba1d

SHA1
80c48ce7e6a999f3f6d784406e36dd52e8c3769e

SHA256
6a8331cbbbfc6e301a65e899216daf213833eab3f934456b5820722369844b64

SHA512
d7efc24abdb1d512a7e6d846b584caaa4e789f0fb2577a9062dbf84f1ad291efe89ff7f1f850d1279b6a8bd586fb2936c89e0110dc510c18bbc8e65e5f42c1b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_4516_WVQICPXOETFFBBXO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit