hxxps://www[.]mediafire[.]com/file/pgx4jdll5zq761r/Spearton_support_deck_and[.][.][.][.][.][.]mp4

Resubmissions

31/03/2023, 20:16

230331-y1372sed8v 1

29/03/2023, 18:55

230329-xkqrcahe46 1

Analysis

max time kernel
142s
max time network
142s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
29/03/2023, 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/pgx4jdll5zq761r/Spearton_support_deck_and......mp4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133245969658865386"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4112	chrome.exe
4112	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 3528	4112	chrome.exe	66
PID 4112 wrote to memory of 3528	4112	chrome.exe	66
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 3500	4112	chrome.exe	69
PID 4112 wrote to memory of 4136	4112	chrome.exe	68
PID 4112 wrote to memory of 4136	4112	chrome.exe	68
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70
PID 4112 wrote to memory of 4268	4112	chrome.exe	70

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.mediafire.com/file/pgx4jdll5zq761r/Spearton_support_deck_and......mp4
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd6f989758,0x7ffd6f989768,0x7ffd6f989778
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 --field-trial-handle=1788,i,6579220961687838999,14633376406241676141,131072 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1788,i,6579220961687838999,14633376406241676141,131072 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1788,i,6579220961687838999,14633376406241676141,131072 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1788,i,6579220961687838999,14633376406241676141,131072 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1788,i,6579220961687838999,14633376406241676141,131072 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 --field-trial-handle=1788,i,6579220961687838999,14633376406241676141,131072 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4944 --field-trial-handle=1788,i,6579220961687838999,14633376406241676141,131072 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 --field-trial-handle=1788,i,6579220961687838999,14633376406241676141,131072 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1696 --field-trial-handle=1788,i,6579220961687838999,14633376406241676141,131072 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1596 --field-trial-handle=1788,i,6579220961687838999,14633376406241676141,131072 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5324 --field-trial-handle=1788,i,6579220961687838999,14633376406241676141,131072 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5164 --field-trial-handle=1788,i,6579220961687838999,14633376406241676141,131072 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=688 --field-trial-handle=1788,i,6579220961687838999,14633376406241676141,131072 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3376 --field-trial-handle=1788,i,6579220961687838999,14633376406241676141,131072 /prefetch:2
  2⤵
  PID:3160

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
881B

MD5
9e170f410caf3aba2e33f23f563d9ae4

SHA1
9b63a1930f187d765347f2f51fd0f721a40ce04c

SHA256
80b8df79eafc2605079da80ca54657bf3a9b6c8a6bdf926cc2a52286b4644810

SHA512
116390ab9415cc916ae38ec9c1f8806a5e4bd60b2f655c13fc625f4328a3415658172f9a0a7c0f026472d6f3867ec5ce4eb6ad7969b534bf7755b9719e051de0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
3828e92c6a62e5cc6d18d3cb5a6d5769

SHA1
32672b4051f977b9708a0134dc490f064016fe19

SHA256
172684f6e4d778a671cac7ad33c5e551a86f0d319eded8e95db8bb8877f30540

SHA512
0d3244a9bd38841a354f23585c8059b9b64a7da413bdd0f83e1b734b0e62dc7e43e28ff42bd4bd098abab14dba093d30f41696c95d3f096cbaca26d666553959

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
c5f21ce91a8cfca10c2d05eeb32cd08b

SHA1
fb46161d0ad459ec21e309435cebf2d932b70079

SHA256
8596ed7e5062c727331d6d5b0809a83fc76588474d66970a78542d91135a4a48

SHA512
bf00a02f04b6fe758c8d00839f747b5ce9c190a5610aaf45bd957fcd25797555b1825c150258e9abfe04f3a054d59c3d9dd18393ffd5f0589a5412b1bb42d409

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
007657232027adc5ba702159c7350c42

SHA1
d37e2c7404ca2290e29b95cb2a41a33697227ce2

SHA256
a0bfbcb4394848f5f82faedb7f8260076de5cfbc2bf2d52fd2d7429fa8dfccd8

SHA512
a9935b74c2ba01b3c61667b511e2925622dfb25e65e34aed495ed0960f172612baa1a77925fdbe65ac37b05efc23a2b3c082d08cdc6e70e2b1cbb89ec584e1e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
c8523a333a675959ba8d45a9ca3de347

SHA1
0c900fa08709f5ae0a1bc361be985e565e4d6814

SHA256
3aa4beebd11b664f8ecac96cff22124e2b85b6b362c9c73f5620ea3db8df80d0

SHA512
0f1f89f8dec3bbd7d944e1ff4876e6a625ee5691f35d67bc94cb2724abdf70b7e16ce98ec6554858776ae192980967b83f1ea2b3b608af3476aed441fe10e43b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
9bf90b61d755f34f276d04696317429c

SHA1
df2cdaa5e84f2aff7c5cbb157618576f5e6de8a1

SHA256
ba3d9f72a7049520cc77150c334f111f41688ddf7d1bc92fe0de5e62814b8f33

SHA512
8e0d38bb84c6f4695638b3d65eb6baa7de27f3d19c41e50b06e3198c269c1a73d1b00a355e0fe023252225c1d1804126ceba0a18eaa5fb4500c6279ae0b6c1ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
145KB

MD5
bb8f522e52562be285a0d18f89bb8115

SHA1
bbd316bcc6dccad85c32761a2813dc7297e5c1c5

SHA256
2d26993f866c766dbf33a2468f32570eed499cb700ffafa26cf3ca5811712a55

SHA512
95f250b63d5ed3e99cdac6082b7077e5eaa54c4fe639b2450070b1f918c26e936ab52fb8ae5589594c76ca64c6c5b9dafc9ed648f637566f2140d3f1b7e464dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
145KB

MD5
0984f48bd7ca200a6028f0e2a2937d89

SHA1
6185a197278055ae4d1476d14c4d31c35ff081ac

SHA256
3303c8b9f20886392c0b7d5c47dde4172d4a12ff238f18592f9202e4e8a9ebb7

SHA512
3c47cff8dc8d1dadaeac1e2b1808c37b1670e3a3408dea114bc9da26b1caf7f58d0f863d6896201f7d17fc51382c97ca49168350abc3931b1139399c46e7234f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit