hxxps://cretaerg-secondary[.]z13[.]web[.]core[.]windows[.]net/index[.]html

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2023 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cretaerg-secondary.z13.web.core.windows.net/index.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133239798594136410"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

2120 chrome.exe
2120 chrome.exe
556 chrome.exe
556 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

2120 chrome.exe
2120 chrome.exe
2120 chrome.exe
2120 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2120 wrote to memory of 2772	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2772	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 2624	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1004	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1004	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe
PID 2120 wrote to memory of 1720	2120	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://cretaerg-secondary.z13.web.core.windows.net/index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6fcf9758,0x7ffe6fcf9768,0x7ffe6fcf9778
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1820,i,11540207435426336661,1224155812535427661,131072 /prefetch:2
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1820,i,11540207435426336661,1224155812535427661,131072 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1820,i,11540207435426336661,1224155812535427661,131072 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=1820,i,11540207435426336661,1224155812535427661,131072 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1820,i,11540207435426336661,1224155812535427661,131072 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5024 --field-trial-handle=1820,i,11540207435426336661,1224155812535427661,131072 /prefetch:8
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1820,i,11540207435426336661,1224155812535427661,131072 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1820,i,11540207435426336661,1224155812535427661,131072 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5192 --field-trial-handle=1820,i,11540207435426336661,1224155812535427661,131072 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5188 --field-trial-handle=1820,i,11540207435426336661,1224155812535427661,131072 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3212 --field-trial-handle=1820,i,11540207435426336661,1224155812535427661,131072 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4968 --field-trial-handle=1820,i,11540207435426336661,1224155812535427661,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:556

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
a7a0bcf10ba9a78e0d9b1355c649d375

SHA1
637db843d89774de219bf4efa1752fc322236060

SHA256
cf5406f032cbb1bc0651ee5ca98e91586409c2e087ad570da7b2757b8e125aa4

SHA512
ac50049671cf8f0bc04e59ca2537d16fd0f9795dd17010bad7e719b8fbf1f76c37e77a6e15832c90bc63d57051b09b3327a7f93823e14e1884092fe5b0bbb30a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
55af9f6a230d07561f58d63f6101f4c3

SHA1
d38818aec476455b0025b418700cd5a4129d51ae

SHA256
b85301dca3065b510981ac423177b13992fd958e30a547b7d9a217ffe4573ecf

SHA512
e712f8bbf28fe93f1d151139c7a191d92ad66f14a54d2323b1ccf8d4d5ed1cf8503e539fb3d6e24168bd0c0f535868881b042cc84c6022fb3da70e18d57fd7f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
83be01b700c64118852de3a3c3870891

SHA1
a48319549bae2163c4cb917f368e128aa8dd6e11

SHA256
f4cfe8968fc3857dd424552d97cdbf45e4b4bd0b1e1862544030e19386645fc5

SHA512
413c1a5fc77ab5dbc3a495b396d438b1a3a094cc3cb5b30e2e6249a9b2ef3a8015b5b0d1969fae9b6c2a472940a894b1db4aad870aa2062cfc7765ece4def6ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
843cc1d6f97af0a00224ef62e35bcbb0

SHA1
b750d011af163b1e0c4ad8320038050f4149435d

SHA256
d33b9f3b2df54e88ee9c2a9f30d176273a695a1d966403cd18ed30b688be3118

SHA512
13a80b0a464404e9cc84905e21031b2803a5e8625691fa1b9b7251493bf3d56fc2b42aec13e93dd8f7605f09c432fdcf1c75b3cef57308212df901dcc791b52c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9efe0b9cad1da07d6a1194fbc61beca8

SHA1
c88bec2a9c921c1e86c29f3e665d13f7ad0c53d3

SHA256
81413b04a5ca86928cc10c7a38c71a35332c056a00c650b5ffc60e51c3f0761d

SHA512
cb529bf957179784204da688be8016efe75e53ff3851573451e6d771e41018a87d9347b5f83fec9aba085fc20dbe4f84de3a86a62f9dc6849155b0de6d757489

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
eb9c52951f0b6d12c1f188b1b2367d41

SHA1
e3852473666010d766ae160f3938089e1495cf2a

SHA256
a4b35be53a4519ddfa038f8848b2e4e7262f3aa22566d09d6289e00d16310665

SHA512
cf6fa32ab93381790f2fd2c07a39dbcd7cca5cde01764b294cf5118284e7ffc7b4f694500db0a7487f09fea42c1889994a493c55d9cc64c1f1f12a533aa5faa2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a141b613b3757a37e1f61b4b888ebff3

SHA1
d9759efb9cf3f685171e3edbe3e66c5218993f65

SHA256
9bb6394c8b9663bdabede0e5865bcda72b671220532917750beb42ae402bbea5

SHA512
d6cc8fe24e236208954c070514f6feb0b03433e39e76a9fcda1b3c1ed91794e7ca4082c68b912b0606dbbdd83dd7deec9aeccbe4e41e0d7b257f85ee9fed3c15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
d2b5ae61be8b0573b1ef7903a66f82f1

SHA1
8b9aef8c17456fa6abbf30b13fd29eca85eeea0e

SHA256
e5a7d3166717efa82c48d3f33d74f831aefd9658140dc68182d462214808ebb1

SHA512
873243802962f4f32806097fdf7ceb9ea631ff20a8c4e9f994c63a82f5d37a1ef951aa268643b57dab5aab91dc56336d7a6579554bbedf36ecb5d92a5743c46e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
401b3c3d313c3d2f8cb76f7225f73c50

SHA1
4647260178b59d85df3f0c6b708a3126b6c935f8

SHA256
8af2f4ddc5fbcace13adc2646fc1e8b04923e702023a736ada2015860db41d9b

SHA512
6b796e715c3f8dc7ee1fc7e1892e47e3cb3e2d0c9e2593fd4f31c7d53bd7cd6ba96e9b983a297e6d378d0f856b0a12f2c91a172252a7dbcef5117344de792ff2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e54510b91a1d82a31e5d27e6cd561530

SHA1
0eec92ba75d64275dc958ddcd9d5665b60eb07e0

SHA256
4b0c235c7d05b5e893a359c0662ebba049cadda7f8a16e5e93e31a17e787abfb

SHA512
cb11a6c58d0324bdb45aca0ab484c8b3102a75babefd4a169757c2b3087d5ecc17f61c8e8e8e60aea7fd80c50530ecc34efb6e1d29032c3c6b9383d87bec9a31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
6215764621a6e02c77ff99ab6654f25d

SHA1
b8d544ffcc158f5ef87984b5bbefeebabf7341f2

SHA256
bbfaff7515620c8524a425b7f802860c9971951832cc6eeb78a4dd72c203158a

SHA512
70f8c482f29d2d238f47d6ba87e6c51666f22888304b7a65b4d6859a4378666bd6f24e1e744805a7f541f98adfba1a7128f75a2655fe6ceed6efd3932db78a35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
144KB

MD5
7c13eaaf2ef3dc2d52ea2cdd15ac20a9

SHA1
3a6604c060447c5ee2e48216ec1cf0e7978a9d92

SHA256
f571495b98d815239ab67fe567e160163a4e8783c7a3879e770abf3451da33f4

SHA512
d66a5a33125715d5f5cd8516ada538fede96f86c95fb182d1d09dd964289e1a3c79c2f6db1495f27780b1c2a4c8c74ab48b8225616ce1ca4b5983e37c600d996

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
102KB

MD5
61d4f07767bb202d5f8f054b753e27b2

SHA1
529823b33920b7da8296a7a91b0c2f3c3f28de73

SHA256
05f562eea6a13c254c27c535a81e109b267ea59bf4eb286a916f8873146e85ea

SHA512
aefbc6e0fbef82f6db790995287d9a46e4099de535e1d092397ac3b56d0bec63cd8749d1eb783ca665f6c459ad8aaa1b98183d3b44ad959e7968e80687310e95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5702a0.TMP

Filesize
101KB

MD5
5bf4622b28b5945990bedfd7504891cc

SHA1
dea16a5bb549064d4c60dcb77a34973e735012e0

SHA256
32eb79961c277bf8c24f060c92c700803e141b4dd7f171e056435c3247dbfed9

SHA512
66c87eaed884e0946bc9f2c76e24f9c98f7a8c4efedd90c5dc5999428d9adc75184a72700ec2ab8d3694505045563af07a09717d653c10b4818b149d01e29e9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\crashpad_2120_JFRCKFLTETGWOIJO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit