hxxp://vscode-update[.]azurewebsites[.]net/

Analysis

max time kernel
68s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://vscode-update.azurewebsites.net/

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133244144169305389"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

3924 chrome.exe
3924 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

3924 chrome.exe
3924 chrome.exe
3924 chrome.exe
3924 chrome.exe
3924 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3924 wrote to memory of 1336	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1336	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1292	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3572	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 3572	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe
PID 3924 wrote to memory of 1420	3924	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://vscode-update.azurewebsites.net/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba84f9758,0x7ffba84f9768,0x7ffba84f9778
2⤵
PID:1336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1812,i,12769172430622592528,4789131598322766796,131072 /prefetch:2
2⤵
PID:1292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1812,i,12769172430622592528,4789131598322766796,131072 /prefetch:8
2⤵
PID:3572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1812,i,12769172430622592528,4789131598322766796,131072 /prefetch:8
2⤵
PID:1420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3112 --field-trial-handle=1812,i,12769172430622592528,4789131598322766796,131072 /prefetch:1
2⤵
PID:2088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3144 --field-trial-handle=1812,i,12769172430622592528,4789131598322766796,131072 /prefetch:1
2⤵
PID:2192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1812,i,12769172430622592528,4789131598322766796,131072 /prefetch:8
2⤵
PID:1580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5040 --field-trial-handle=1812,i,12769172430622592528,4789131598322766796,131072 /prefetch:8
2⤵
PID:740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 --field-trial-handle=1812,i,12769172430622592528,4789131598322766796,131072 /prefetch:8
2⤵
PID:3548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4992 --field-trial-handle=1812,i,12769172430622592528,4789131598322766796,131072 /prefetch:1
2⤵
PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3980 --field-trial-handle=1812,i,12769172430622592528,4789131598322766796,131072 /prefetch:1
2⤵
PID:1812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2928 --field-trial-handle=1812,i,12769172430622592528,4789131598322766796,131072 /prefetch:1
2⤵
PID:2300

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4600

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
96B

MD5
97460cb19d04e441c1ba43a2bd9a7ef0

SHA1
7f029cbffc4a0ef49a611c209517dc679ba5ea0a

SHA256
ef99dbbd1750d6e4b369d2f312d259430466438dd82dbc52dc8f778965e62ebd

SHA512
c5bb337b1f2c4a6156b84fd83ab549cae05bc27834a7b96cdc5551121430af27c520e5cdc8dec0d52c26138801e92238503373dc587598b0bfe8a4d3a0b5b878

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
21994edc36b3428c71413814c9e294b0

SHA1
788c44859d8e2a9d915547f054366f9fd5d0df38

SHA256
fce2fc389ca1c6d6a23e4cf6e0d82dd2d1bc3879aeb570ead6743e233a6aa55d

SHA512
b331ee213e3ad895fc326f558c271a6279da9d4de0d06a6c9a372db70831055dbe6e0da2420149bc710e06e24ff570a700a0d09d9fa0a84783aa5c9d1a3e94c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
2af501667c4c3b5e91eaccfdae678985

SHA1
6cff60d7178c63c58b9ad6a98fd2be2ff09cfcca

SHA256
ecd586f0f4b4aeb7a42b203b479d7613b956f9e885842a640e72905b5b7621c2

SHA512
12e8eb332fb99646dcc4884395cc3658a7f1a51fb884457deb044b47fad38795ad5147c153c036f1d08eeb35a96071a4eb9e09e815269a36e2b7e85e89f83007

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
5fbb553ef2e8a04f051e3e6d234855a6

SHA1
267a9f843c89c71751a9fde2a242c5540b949aa2

SHA256
ea82edd6856cc37ab72a02bdc747f357e629f628e541287e897361873f6cbc21

SHA512
b60c472c7e1dda4c85168444487207d28576982faa02fb55b16aa0005d5e9c918c5ecb141153fe0534c63a49e5f9493cf774df7bf4a21d52baaeda15ca2665de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
06df6aa4a015956710cae3daca5b4b7c

SHA1
9ddecaf8ae0bd938ef540c6eba1d4d5ff4ea4b16

SHA256
4a7ec962e4d38d5c094154e5deab5d4cbbf53cee378408949d3b391cf01c08e7

SHA512
45e5aff194420adbb31ebfe5d7d266dcfb64e5045dab6d4d2b5b5f65c8941eac722b41353dcd7415c7d2feebe7204de831254329c8c01a7fb45d073b738262ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
144KB

MD5
ca82da0eef88da0f996e1a999c717c32

SHA1
152431d8153ebcfcfa65d050dc0375c61d325c55

SHA256
e60480d5c02ef23a47e976428b15560c2cc7eb4bb941fc739669d1379aa6c20a

SHA512
08219a41ab573a95e8ceb183769b1dba98d908f02000c41ee9179e3802afa31b0babfe9f5c64c4d98588c681f1d3c8de68ca06b598570688c65715c995569c11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
144KB

MD5
42e1de4e2499ce793c50c7fe86661bb4

SHA1
8d4a2018701fefb2f20e483049cfdad8c5eced19

SHA256
eda85291c8b8a70d4b3825e14233becdc19b8e8f241767b7b535916987dd69f0

SHA512
9e335b2e91b281def157c8aba74e8fcaac99e2df0c59d2938ba27bf7991ccb74e3ecba0a1135e3f962e98c54a4b93c34958dce7bdf3c6365d064d2ff4bf3f536

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_3924_XHSJRBFGFJRTFPZN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit