hxxps://mailstat[.]us/tr/t/ggthgo4cpsa3cpsa/0/hxxps://t[.]yesware[.]com/tt/0721187962349227c182958326958207c9251352/a91707460829491204943c809c492274/9912049f35e2513edb3304aa72118796/sixlt[.]com/andre[.]trujillo@pa[.]abb[.]com

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2023, 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mailstat.us/tr/t/ggthgo4cpsa3cpsa/0/https://t.yesware.com/tt/0721187962349227c182958326958207c9251352/a91707460829491204943c809c492274/9912049f35e2513edb3304aa72118796/sixlt.com/[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133241063519401416"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe
3564	chrome.exe
3564	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4772	4764	chrome.exe	85
PID 4764 wrote to memory of 4772	4764	chrome.exe	85
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 3180	4764	chrome.exe	86
PID 4764 wrote to memory of 4528	4764	chrome.exe	87
PID 4764 wrote to memory of 4528	4764	chrome.exe	87
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88
PID 4764 wrote to memory of 2468	4764	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://mailstat.us/tr/t/ggthgo4cpsa3cpsa/0/https://t.yesware.com/tt/0721187962349227c182958326958207c9251352/a91707460829491204943c809c492274/9912049f35e2513edb3304aa72118796/sixlt.com/[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9003e9758,0x7ff9003e9768,0x7ff9003e9778
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1784,i,2204893362467079368,9135348578096663905,131072 /prefetch:2
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1784,i,2204893362467079368,9135348578096663905,131072 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1784,i,2204893362467079368,9135348578096663905,131072 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3228 --field-trial-handle=1784,i,2204893362467079368,9135348578096663905,131072 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3216 --field-trial-handle=1784,i,2204893362467079368,9135348578096663905,131072 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3024 --field-trial-handle=1784,i,2204893362467079368,9135348578096663905,131072 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4924 --field-trial-handle=1784,i,2204893362467079368,9135348578096663905,131072 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3032 --field-trial-handle=1784,i,2204893362467079368,9135348578096663905,131072 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5588 --field-trial-handle=1784,i,2204893362467079368,9135348578096663905,131072 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 --field-trial-handle=1784,i,2204893362467079368,9135348578096663905,131072 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5312 --field-trial-handle=1784,i,2204893362467079368,9135348578096663905,131072 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1784,i,2204893362467079368,9135348578096663905,131072 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5108 --field-trial-handle=1784,i,2204893362467079368,9135348578096663905,131072 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 --field-trial-handle=1784,i,2204893362467079368,9135348578096663905,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3383cfa1-ee14-4d86-9f20-f3c8eccafedc.tmp

Filesize
145KB

MD5
d3ea4020d7c200340e8ef447f4f5eedd

SHA1
e827c18a546f545d90cafc630f8e35efb5ea36b7

SHA256
5c778356d373951b7d5d5e09a6ce53ccd92382fae4acd5f20f529829119c78a5

SHA512
fe0dbd1ae05dbd2ed647a1dd6f35bb82053f124747a8ff006e4d145e3d8531183692ad3560781e8629216623ae3703db948856e54778e171f007edf48371b5e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\33d0526c-5d1c-482e-9bdb-7459d7a04ae0.tmp

Filesize
6KB

MD5
b69a02f25ada1b06f5ca640841bacb6a

SHA1
b4db9d1c0a26e5486a4805149c08668384c3ead8

SHA256
893aa68020b74a9dc7efd9a174ef03ccc4e5bafef3cbdaee7dcf100494adfe26

SHA512
12e8699aa2916c92c4ec0f20747a73d430fffc34533ef7753348552fd9e4aa00c774e680051a050e27cf952d2e0a07612141cfd3d00de096a5ca17cc89590ab8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
67452b3a56fbfb7933306213c1478c19

SHA1
4e706ad0b2f282444ad83fa2afe32a2af007c429

SHA256
d82bf16ad8edc967083371b2d4803da1fe20d64de078eec2a050c23b10d89ccb

SHA512
9701a14c966b416c19a57fe1364d883369880ce6189adc7fa78ff2cd0d3f04b9193bd27fff83d74aaf2b9ecc0bdc7d9376c8464b9b1c6eb864ae98d92dcf7933

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
7630bfbabae0c601456ecbcd84cf9548

SHA1
bc1619a687d08e4a86bb45b5f8c7fc6b56f12fba

SHA256
96b7dc76d28cd5955731eac98ddd432bee847426f7a282dbaaa30af1c7e94644

SHA512
a450f73431e0e4f0fecd62aa60fdd70282be2e414805f50e4e4c89dc6c8763e2c36bd2e04dfcd0475b8aa767d5746d9af2a99d4caeab4626f5391ceccc42f200

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
b81b42f5eb5ebe9ed2227a1710303e3f

SHA1
64881bc8d7078366f7a62c09dd391677d9f57045

SHA256
d5020b437b5db7357dfd51d490228ea89aa5abdee5407cc1648993124935b108

SHA512
58311e34ba8c1ee5006eaa10066606d87b0c6caa24a24e2323df73f0b8ab05b7bd6026845eb71f3895a2a3206283e405489c1eb3a8c6f734bfb274847665dbc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
d6d7f303525009023d2aabaac2b238d2

SHA1
ea835b62c8463615ad96537270e670354176a06c

SHA256
249ab81cd424a4092f86437e4baa9f7862c4d90078af86fed0f7ccaff644832c

SHA512
ebcf35b8ab90e3b2765736c4ba2f9fbae5c755ba03e87590d122db2bd88074ae70fdd75debfdfae28ed49ba29d2e564d8c6924f096a601af58e6c2b555c158ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
bb35281c6156a103ae82c6264d8fcf38

SHA1
2338fe662f2ef6d9f56702fbb58477b0591c3b70

SHA256
102051976ccb1c4ae5d677b36dd2b61be85d1ed01c6f6e2455ac1cbab6b91f67

SHA512
a16dfab55869068aaa5cbfeb904e6870387ffa545b9e1703ffee864fa84ac03ef110fb539e7f3e11e35bf2edcc1e96fff057e406bfc79d26e2ec3c6d784c5f56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e1a5ed043590ebb39b3446d58af5e5ca

SHA1
a28c18a8454ae87a55d140c6b8e435520621a547

SHA256
01e184748499783001d0845d59c77afc671d6f198a7944aadf37f68ae16fa004

SHA512
dbc93959c417e41dab1d1a89b550e9ca8728d3b84aea28294b1feea8bfd33eeab1b1d476480c415d96678de459c431c2adf066345cedccd776398decd80ac9fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
b14a12a015c8f36f5f192c129636136d

SHA1
2bde3886daed5b6912250ee1c1dcac3de793c43b

SHA256
ab7f55a6e55318a3e9dce045a73d51fe67009fbec40396665660c46cba7a49a8

SHA512
04af9d59fe4affde5837720eddc56eed8fd70f64c3e148961be9a2f498739f5f256769b6c51e6a8f3761d09411584c5101f14fae05d2015a332e0f7a585bcac4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
c9ff61a41158000f2b0e038d74f75aa8

SHA1
3033ca6e3aa4641e8bdb91b448db0089c99a69ab

SHA256
84b8e908a0947be9ad0898531901f5e0dabcf1aba73ecb920956cc97278c2d9f

SHA512
1c0fd05d4e51949e5f848c46e3dab98bf756d639eebccae55a3eb4ee0cfe8b7bc6a44453ec167f750e3951147d68f0c2b97b0ce1c236412194bee31e6eb892e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit