hxxp://url4470[.]bethe-factur[.]com/wf/open?upn=FZUR-2FYx-2BtEVfb-2Fn462eE17wLpjhNfbcTUZ-2F7YvMu-2BBLf2-2FFN7ovZkknaH-2BeLfbMwmcOJu-2BnLBMGxT1NFFZGlkrjSRTcfc2cJUmfT8Kf5CNnxslby0nHkUEB0L9aQZGgGRgPsI8Jw4qFqh8hTY9hS9kp77tSZ0iRjQF1lgAY-2BAlMWJvz4nbIZx6HxN-2BckHHiCT-2B4xuQx-2FuMKg3PH3jLsg98Zygs7dK4ORYSx1bm-2FW5ZIlreo9ylkSbmKuvWAjQz-2BXAYUuhOZLT3LcW0ECUC-2B7F4HDLKVXlkGA0Az1ym8UfW3JkmchXhJkhePCYG1l-2BbEpSVnXrRQ13a3GxHxT6aX5ImCJmiI2rtN8BJlCTk0WBuZW424Ru2-2Br13dkXOcPtFaCo3FHLzScs-2F79CiOfnyy0OP2RQuZ0n3tXKCj90oUOVm0-3D

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2023, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://url4470.bethe-factur.com/wf/open?upn=FZUR-2FYx-2BtEVfb-2Fn462eE17wLpjhNfbcTUZ-2F7YvMu-2BBLf2-2FFN7ovZkknaH-2BeLfbMwmcOJu-2BnLBMGxT1NFFZGlkrjSRTcfc2cJUmfT8Kf5CNnxslby0nHkUEB0L9aQZGgGRgPsI8Jw4qFqh8hTY9hS9kp77tSZ0iRjQF1lgAY-2BAlMWJvz4nbIZx6HxN-2BckHHiCT-2B4xuQx-2FuMKg3PH3jLsg98Zygs7dK4ORYSx1bm-2FW5ZIlreo9ylkSbmKuvWAjQz-2BXAYUuhOZLT3LcW0ECUC-2B7F4HDLKVXlkGA0Az1ym8UfW3JkmchXhJkhePCYG1l-2BbEpSVnXrRQ13a3GxHxT6aX5ImCJmiI2rtN8BJlCTk0WBuZW424Ru2-2Br13dkXOcPtFaCo3FHLzScs-2F79CiOfnyy0OP2RQuZ0n3tXKCj90oUOVm0-3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133295928157932717"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4996	chrome.exe
4996	chrome.exe
2848	chrome.exe
2848	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe
Token: SeShutdownPrivilege	4996	chrome.exe
Token: SeCreatePagefilePrivilege	4996	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe
4996	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 2460	4996	chrome.exe	86
PID 4996 wrote to memory of 2460	4996	chrome.exe	86
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 4056	4996	chrome.exe	87
PID 4996 wrote to memory of 1972	4996	chrome.exe	88
PID 4996 wrote to memory of 1972	4996	chrome.exe	88
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89
PID 4996 wrote to memory of 1764	4996	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://url4470.bethe-factur.com/wf/open?upn=FZUR-2FYx-2BtEVfb-2Fn462eE17wLpjhNfbcTUZ-2F7YvMu-2BBLf2-2FFN7ovZkknaH-2BeLfbMwmcOJu-2BnLBMGxT1NFFZGlkrjSRTcfc2cJUmfT8Kf5CNnxslby0nHkUEB0L9aQZGgGRgPsI8Jw4qFqh8hTY9hS9kp77tSZ0iRjQF1lgAY-2BAlMWJvz4nbIZx6HxN-2BckHHiCT-2B4xuQx-2FuMKg3PH3jLsg98Zygs7dK4ORYSx1bm-2FW5ZIlreo9ylkSbmKuvWAjQz-2BXAYUuhOZLT3LcW0ECUC-2B7F4HDLKVXlkGA0Az1ym8UfW3JkmchXhJkhePCYG1l-2BbEpSVnXrRQ13a3GxHxT6aX5ImCJmiI2rtN8BJlCTk0WBuZW424Ru2-2Br13dkXOcPtFaCo3FHLzScs-2F79CiOfnyy0OP2RQuZ0n3tXKCj90oUOVm0-3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbf2b49758,0x7ffbf2b49768,0x7ffbf2b49778
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1816,i,12567330251945043950,861283736054602401,131072 /prefetch:2
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1816,i,12567330251945043950,861283736054602401,131072 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1816,i,12567330251945043950,861283736054602401,131072 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1816,i,12567330251945043950,861283736054602401,131072 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3096 --field-trial-handle=1816,i,12567330251945043950,861283736054602401,131072 /prefetch:1
  2⤵
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4372 --field-trial-handle=1816,i,12567330251945043950,861283736054602401,131072 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3340 --field-trial-handle=1816,i,12567330251945043950,861283736054602401,131072 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1816,i,12567330251945043950,861283736054602401,131072 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 --field-trial-handle=1816,i,12567330251945043950,861283736054602401,131072 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4876 --field-trial-handle=1816,i,12567330251945043950,861283736054602401,131072 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2844 --field-trial-handle=1816,i,12567330251945043950,861283736054602401,131072 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2840 --field-trial-handle=1816,i,12567330251945043950,861283736054602401,131072 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2656 --field-trial-handle=1816,i,12567330251945043950,861283736054602401,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
5ae9dd7a90ff0495d258179485542fd2

SHA1
3b14da9f8773f77f6960eeb345740258e6da72a3

SHA256
b032d2b25be49b1322b3a7c2e14f3784cafdba80b671b489d55a6a375204739b

SHA512
7ddf1e2c04ab6310b984973aa60d786c8598507c29a5292bc6c0fed71fe754c2311643f0f5a1f58088308f22165f66dc4164a651d28d1f1e6138cb634be7e9f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a2f2a7f140515812a5b33dc4582ab06f

SHA1
a84470ae2e90f320766035ee33b85f2e2a3bc6fa

SHA256
641f039631f00fe5ea5701b9d09650307336a782ab911ccc24e58d735f99a2b1

SHA512
8e129a65bf851f9d4b06e7244c133c759dfba755e12af141419936ff684e8859d98ed208ea993b761b82e945c9e1bb53ca2fa1d72f80c695b9e3160660955f91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
71165ac8050dd5c09c28b7f8ef2e9bd7

SHA1
9abb33376397afd737bb059e1adefb429af9ba40

SHA256
69b6f10ae7e9dab2f9b767fa11233a1ed21df84466e8baf09d216702c316aa08

SHA512
f4b730f1bc774be7392ddc8d67a611f457e3dd60169499b03de2c5168bf3e8973dfc63d3eead7bc0cf87eb763bc86f56ae1f9be6b5b964db993fd1b23a3c2b22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
153KB

MD5
3c205486e868041b8397c03de98b9e78

SHA1
d1a01e1c8d7c5153b95fe9bb1bfebb828ea4e690

SHA256
8f22cdf91ea8d656f44ef74fa6101bc13f8352459119423b5eca5fc0831ce6e8

SHA512
462a7479096379ebd8fd30abef12b0a25d8ab7e754e4c6c485e1a6e26b73abdae0678caf3166df0aaca7dc4d5d552735bb601a67d3df208c9aba2a08dfa07bfa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit