Analysis
-
max time kernel
300s -
max time network
279s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20-03-2023 21:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://go.redirectingat.com/?id=92X363&xcust=trdpro_us_1541938487208509200&xs=1&url=https%3A%2F%2Frafoiparraguirre.com%2FElle%2FElle2%2F/it0yjy%2F%2F%2F%[email protected]
Resource
win10v2004-20230220-en
General
-
Target
https://go.redirectingat.com/?id=92X363&xcust=trdpro_us_1541938487208509200&xs=1&url=https%3A%2F%2Frafoiparraguirre.com%2FElle%2FElle2%2F/it0yjy%2F%2F%2F%[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133238247326587462" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 2720 chrome.exe 2720 chrome.exe 1268 chrome.exe 1268 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeCreatePagefilePrivilege 2720 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2720 wrote to memory of 556 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 556 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 3236 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 264 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 264 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1056 2720 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://go.redirectingat.com/?id=92X363&xcust=trdpro_us_1541938487208509200&xs=1&url=https%3A%2F%2Frafoiparraguirre.com%2FElle%2FElle2%2F/it0yjy%2F%2F%2F%[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcae799758,0x7ffcae799768,0x7ffcae7997782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1764,i,1075126413885267765,12359702322876475603,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1764,i,1075126413885267765,12359702322876475603,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1764,i,1075126413885267765,12359702322876475603,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3172 --field-trial-handle=1764,i,1075126413885267765,12359702322876475603,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3212 --field-trial-handle=1764,i,1075126413885267765,12359702322876475603,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4552 --field-trial-handle=1764,i,1075126413885267765,12359702322876475603,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4712 --field-trial-handle=1764,i,1075126413885267765,12359702322876475603,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1764,i,1075126413885267765,12359702322876475603,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5032 --field-trial-handle=1764,i,1075126413885267765,12359702322876475603,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1764,i,1075126413885267765,12359702322876475603,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1044 --field-trial-handle=1764,i,1075126413885267765,12359702322876475603,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD5beaa77b1175903984a52122af4f4492b
SHA1c6d946be0609fc61b179906c7f96002589272fca
SHA2567527ef3c005c04d3f78281b721a7b2a263518cf9bb4a63dc94612e36519b5921
SHA512be5009083f14b4ab976fa6a8f3fe30876a463e68964954de935499c8cf1c5810dadf4363cc220757dd3c4ef96516e5e920c221fdfa1a7cc68020eb07e3640cb2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
3KB
MD5f110a4b33ba17c68c88ce3ca2d120cb9
SHA144114d4fe6db216efd41124db6b1332a92b31d2f
SHA2567a46317573652d55b6ad31c8e458ad631a7c351a71400ba371e4fce31963954c
SHA51235e0b1218aca7aad92f47e5cfd21920816346398b73cbbd86da400a9f59abdfff16460884aac4e0f62cab97df8e85fabca95920f08dccd946d1603f525bf29b2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD52745814f55b36eb424cf257e10161937
SHA116d8c151095cde4901ac879e71b0542439fb8f4f
SHA256de95b116f0a37d7be2bec0f5632df0a0d61a71621b212b8c2566a7d6086aaa18
SHA51215d256463b6c1671f0e947e7e1eb5f799b428088f4bb3bc56da5a9015700687439f8bcd26f14567ef1a1ee15bd24066eb84abf181a56fbe201004b419358fc18
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD52bdedc433b0926d7af3bb979dcb8dea9
SHA1613c13935ef51bc9dbd373d7130ae792f0f30ee3
SHA25604f050b2e44e1ae880b0e6bc4dd49b14279a84c29f4e8da32ec7c423c1e8cfef
SHA5125928bf4f641d7cf86f884d61b9a64131af0709165f2b5a3467eb3e0c17303f1dbcc4922d0cdc3864380d909d4ebb85b6fc189a774f1bc37c1527b41c7cf6d91e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD55f830c7d243c1b689590d3e44c8c9962
SHA1243ee6397956c86b99df8fae59233dba890bc07e
SHA2569d05fd458293fbdf2e8188c0ab8de3ff1c1d0e0b84dd7848cfc7f318c944608d
SHA512d2a53383b784f785c88711697fde63bab8ea704d3a1fa42ce00a0f90efd966710113852cc4519441dac9cac2e3f07239900e1bdcc9be110a38e8832d3cc6c47f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD55b0b1272edfb732bb95c3db51c5a2fbd
SHA126d33b0962a418e8d98f2fedd80a78b59ef3c120
SHA256f699f11535c3166b68dbe7279858e4d962d76520aaec0b108e606064b776f92a
SHA51297baa795ad618e977b091d0fd2fe8c399f38731766d6a90a7f331b6f1f1fd42b25188dd2ba4a9008996b7ffceb43f2cbec68ee8709d0c8ac1801effc7401a866
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
143KB
MD5bd0390567ad6d49191116ba36ed39938
SHA1782e5f2cb76961f1248bf0c69c00168caf5355fe
SHA256d44ecc62dce84ff8c5dace872d2f80e1fafb1afea1e6968d1e64a29f55a7825b
SHA512c700caf264764ae4f8419042f110e3d5eee3ccf5198294a4d1b1f22028b6098c273e87c1e9b8c5de6e3894bb10f8004882b6996cf156bd5126159c3c7c3814ce
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_2720_KDVWABXLTUIFLFZGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e