hxxps://bs[.]serving-sys[.]com/Serving/adServer[.]bs?cn=brd&PluID=0&Pos=20&EyeblasterID=1086486580&clk=1&ctick=550141855&rtu=https%3A%2F%2Fad2sign[.]web[.]app%2FjlgWO3Fe5bFe5lx0qpaalpdy9s3RWO3BM2&c=5501

Analysis

max time kernel
76s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2023 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bs.serving-sys.com/Serving/adServer.bs?cn=brd&PluID=0&Pos=20&EyeblasterID=1086486580&clk=1&ctick=550141855&rtu=https%3A%2F%2Fad2sign.web.app%2FjlgWO3Fe5bFe5lx0qpaalpdy9s3RWO3BM2&c=5501

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133263118538781773"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2624	chrome.exe
2624	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 4056	2624	chrome.exe	83
PID 2624 wrote to memory of 4056	2624	chrome.exe	83
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 4568	2624	chrome.exe	84
PID 2624 wrote to memory of 396	2624	chrome.exe	85
PID 2624 wrote to memory of 396	2624	chrome.exe	85
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86
PID 2624 wrote to memory of 232	2624	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://bs.serving-sys.com/Serving/adServer.bs?cn=brd&PluID=0&Pos=20&EyeblasterID=1086486580&clk=1&ctick=550141855&rtu=https%3A%2F%2Fad2sign.web.app%2FjlgWO3Fe5bFe5lx0qpaalpdy9s3RWO3BM2&c=5501
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff7219758,0x7ffff7219768,0x7ffff7219778
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1816,i,15616426702629127155,12389315317928977422,131072 /prefetch:2
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1816,i,15616426702629127155,12389315317928977422,131072 /prefetch:8
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1816,i,15616426702629127155,12389315317928977422,131072 /prefetch:8
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3196 --field-trial-handle=1816,i,15616426702629127155,12389315317928977422,131072 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3224 --field-trial-handle=1816,i,15616426702629127155,12389315317928977422,131072 /prefetch:1
  2⤵
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4640 --field-trial-handle=1816,i,15616426702629127155,12389315317928977422,131072 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4628 --field-trial-handle=1816,i,15616426702629127155,12389315317928977422,131072 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4884 --field-trial-handle=1816,i,15616426702629127155,12389315317928977422,131072 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5168 --field-trial-handle=1816,i,15616426702629127155,12389315317928977422,131072 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5384 --field-trial-handle=1816,i,15616426702629127155,12389315317928977422,131072 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 --field-trial-handle=1816,i,15616426702629127155,12389315317928977422,131072 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3292 --field-trial-handle=1816,i,15616426702629127155,12389315317928977422,131072 /prefetch:8
  2⤵
  PID:4704

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
a79487fa36def4c9bf31113dc134c8b2

SHA1
87063db0dfee4408550c390b25eb74336ba1bc1a

SHA256
cba95139dce3392bcc92161b7e2fca40f9344a976be3faea2f5c15322626ec74

SHA512
01091e90d6809c2be6cc22b68ad6a279803f825c6ea8f3db0ff23e83e5539515c6dfa95e04d1cf1812fb635ecafdb99f3342236c411725357b396ef7b697aa0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
1921f4943d1bea53a5a68ffafa9023a2

SHA1
cd1df8fa32d309e46a03073704274dda552f14bd

SHA256
e66a7841bb2125d739cbb2e696a998daab489348a42a88d45927da378404830e

SHA512
2ea961ecb6133d191ff5758801d00ee670f065a2c30ba797969ac10e718fbd5bfd65d0814aaff78b3f511db05e119bd0241dde403ba5d0d6e4605c3ae37ee046

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
c60154cc85dcc51a54303e0dff48a0f5

SHA1
106d4e9c032740bbd4e08dca5f1f12ffa82d0272

SHA256
97fb92c31df72613111e4450f3e8d1593decd70faab1ce7aa3b9835c610cdabc

SHA512
c631f2c1b2228c181dca591dbd0bd70d4299229d18f1f90205d21af59623d90ee68181c0e10d21610fc15830e49001ffbae64293bc2c1d67c23491634bd3f2a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
21994edc36b3428c71413814c9e294b0

SHA1
788c44859d8e2a9d915547f054366f9fd5d0df38

SHA256
fce2fc389ca1c6d6a23e4cf6e0d82dd2d1bc3879aeb570ead6743e233a6aa55d

SHA512
b331ee213e3ad895fc326f558c271a6279da9d4de0d06a6c9a372db70831055dbe6e0da2420149bc710e06e24ff570a700a0d09d9fa0a84783aa5c9d1a3e94c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
dafa1620eafc4da43391204906d80449

SHA1
28ea6181a9f48a43fb746f4ef99dccece844dd53

SHA256
9d16ea7f4555f39b274a498f6b8852a32bf6120d9689e1ee31aabe8820c9cdb3

SHA512
00eb15a0bf56d08afdfcfdf858ac1056435058e07033002f3c4c59a5aaa740ea18c9ff7f6c5ad70ce4058d1f7fb658bfe5f57ba49624200e0e5cffb490c3eb01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c22a9b12109f37f9cb1871e55cf922f6

SHA1
80ad91a0e98707d6f6ab1e054a9203f18a654c3e

SHA256
c19e7a242781d88e4ac1574c945d83d71ba2a8d6ad27b91c17fc70c084cafdc5

SHA512
5dfbd481e3c60dc59b90dd3cd8e18fcc55601585628c56458d45efc8426ed7126560167da4770ef6364437a84e81892f4a77a8129dadc05043a6a007cb256484

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
de217fd1686bce5458f3e226455b448c

SHA1
8019476abaa054c4a47212939869726b3c106e01

SHA256
a19d9223fc224bfc55d3d0c07fa8bea530d185906d23abb7e63d8bbf13aebdd2

SHA512
49d7d5674df7b58779ca63eeccee480a86eb9d7b0b1fb1d5f2bcf0a30d4235f15823ed1d8bc117eaf99888e7e5fc550ad04c0939c0b55ad5afb4252da9235b93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9bcd66edfe43060e68d84356b43678aa

SHA1
123041bb4961799759fe43e41e5659e541b57f16

SHA256
ce20cb44df84b22a3ccdcda2c2ead80a7f68cde8040b7b09ee59505465bd1e66

SHA512
99e6934496acc0e42358d8732436617eea30381aec444699f7ae4e8aa327cb24ba8eb9afc98275e18b3918f10f9c448aba69f215360198baa9679a3d4adc4e3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
f8ae7131049a49c99fc12d8837470a5c

SHA1
a99482eab8ee9a6ece9eb1cfc9953742d7b8a482

SHA256
7a48e35c0622b2d1160b6e3e663da91979025180c2699f0e2d31451887d426a7

SHA512
a5254a34b6edac956ec4aafdff00a5f99c2002b0e4dca96c9cf06fe355a6578b5332b62d4b5adbcecff76591eb5d4eec1a065124833679a64fdee83142b405f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
07961430bf23f3762b38ac187e2bc207

SHA1
896eb74425e30559963946b97912c3e80bea4a28

SHA256
b7dc8e690ca18d5a49ecd72265d545c2c2968f24bcddbdef3c151564582ec23a

SHA512
90c466e92d8afa462e4eeb7408b5f918f0eabcc568341c2f388651ea5564c1f2589d0d178a6b1b0f4a270092be870ab18fabf9daceee766c3ddbccc3b870dd19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
199KB

MD5
0a849479ba5b14475b34d2c47bfe9375

SHA1
b888251c9bb5fab7d699a2e893c6015c611cf585

SHA256
7b19bc9387e09ed0d664559bcc8a9e32621170b6dc03305b6d8b3c5103cdae06

SHA512
123d975d2c5c91b6c19f7b72da6f78188a7ef3686ee17d53e9334d81aca9115d768ed7e7e6e57576de6281307e12d5b6fe448944e95eba528f36e9b3f8fb1138

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit