hxxps://github[.]com/puckiestyle/powershell

Analysis

max time kernel
161s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2023, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/puckiestyle/powershell

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D67AB911-EEAD-4905-BC21-6FF01CCFCEA9}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{966C0069-859C-4D2C-9602-3BD062A9E71B}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5891111B-8288-4A15-A959-C33FBC768307}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{B215D048-5491-43AE-93AC-7608AB08B828}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{3D75A2D7-3731-43D1-844E-958956E205F4}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{11BDC4F0-18E7-4102-B281-43AFB8BED6F3}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{510C5F75-78F8-413D-856D-DCF85BED2866}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{7FA5AB85-0833-4D83-A8DF-200356FD8CC7}.catalogItem	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133324344614799164"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3892	chrome.exe
3892	chrome.exe
3836	chrome.exe
3836	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3892	chrome.exe
3892	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 1460	3892	chrome.exe	83
PID 3892 wrote to memory of 1460	3892	chrome.exe	83
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 4252	3892	chrome.exe	84
PID 3892 wrote to memory of 1156	3892	chrome.exe	85
PID 3892 wrote to memory of 1156	3892	chrome.exe	85
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86
PID 3892 wrote to memory of 1660	3892	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://github.com/puckiestyle/powershell
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7fff74ee9758,0x7fff74ee9768,0x7fff74ee9778
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1796,i,1403115851301101428,15756094935746503106,131072 /prefetch:2
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1796,i,1403115851301101428,15756094935746503106,131072 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1796,i,1403115851301101428,15756094935746503106,131072 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3180 --field-trial-handle=1796,i,1403115851301101428,15756094935746503106,131072 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1796,i,1403115851301101428,15756094935746503106,131072 /prefetch:1
  2⤵
  PID:32
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1796,i,1403115851301101428,15756094935746503106,131072 /prefetch:8
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5008 --field-trial-handle=1796,i,1403115851301101428,15756094935746503106,131072 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 --field-trial-handle=1796,i,1403115851301101428,15756094935746503106,131072 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2828 --field-trial-handle=1796,i,1403115851301101428,15756094935746503106,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:4936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6b6e6c562f8ec2a4e2aefe575dec8536

SHA1
b63e42ccb162ef8159a63ef609116d379144f289

SHA256
020953972b97cb597fdcab823c094175bb6602f5e9bf4c863033f79a51af322b

SHA512
59e4df14d35aa499d0f7e563071d146f973b035f4210af1d2742850b9d334640f44259fe8fd61cfd922dde118a351f7e2ebf37f0a0b443affc25d56ffc2c9688

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c44e4b3f3f83881a4833c27004d80de1

SHA1
8e38a8bda77ea8819748e185a1f2b41bad21958f

SHA256
e20d3a81d98bce67a04a181d0f12c7b22b7a093b2d4a9cf1edd6ba4cbb9bda7c

SHA512
aee245b612e7bde7d63d68e517517300bde892070a729afb742baca98c265243547249ffd4ce2cd082c2397f46ab00d21ecc993274209d14981e316d8337e3c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
d8977886904d48b58fb966308d83bcfc

SHA1
33e5f5a55a366e2a7b3b4e855afad88f3321c155

SHA256
1089bcca2423462c40d55186954d799a905a6d460391e18a70863bd8631801fb

SHA512
723d565a7e0a6ad4514484d7f094ab830538d3de7509668c90e9d21dfaaef5df8a959ff554e5856d8f42a9bfdab704740e201b822c0a81456aed9760a34837c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
1d02bf80b46eb12193c48eece1052c76

SHA1
51a717d57d0397201a4126052832c4bd114f88c9

SHA256
53871ae2509f57f47d537edbae09111d510347c348d482b62e26efc8cd8347f8

SHA512
dbb90b1cab3e256aad463fdd1ee50c4222bcddae89428b351938a541b600782ae0f3b404e4a64c13b57ec72c13697af6db37f13c61fd2782380ad45c319eccdc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
cdfbfee8061a8ff50d42b23aa0c2c00e

SHA1
b7ec527f003efe319e8075805910ecaeb02a3719

SHA256
ad36848512cf8a5b7d705796833656a38be8c94b0d52dfd1a1b4649148c1023c

SHA512
d344de0cce017a2a00da1bd30275975b610806782513e93f4189d44a25c3072a42badae49e0613c4ebc79530d7e3a53d7ff13fd2dc790d8d3691a18aa3caef46

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b0ad3a8c48c7c68629c4cedd5b00d80f

SHA1
72d911cb3a3156abed67f5d6560cabe80e45ff9c

SHA256
a0b74a0f26a930e898f042e3cc708d1e8197243b8e86d735e1b2c83fd88a379d

SHA512
f9decece63e2bb58e07cf9b8cb64d224a8158c07e52607f77240d1801eb83bae0c44196a37e792ec0221f5d077febfc73bc3a32675d3e275956299b24309fb11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a42cf42a2903d585cecaa23ef2114ee8

SHA1
a4517c13b596d95625923a7ffae81a3b686d3795

SHA256
61587b7aa6839f988f5a3a31571b86a00f52f3817ac7eec2d1cbb4a0e1282e0d

SHA512
81c99277d5b483a2a76c2a19105d3b3c5a253718bafbe78d8af27ddc5dac1f7ee7eceb6fb2e351ce5a490539c4db9fbd2b5fe2af7ffecf2684340f4403daa389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3d1748c5bc1cec297edad2afb37d18d2

SHA1
1f70441718752cad7c7fd0c783e65fee3d24d076

SHA256
9ccf8612298c7d8c098f42b2b4f62b6a460cca2ac0a76d36336b274951fbfe11

SHA512
529bf8a6402e3ef745a71f803bd89aa96b9ba604bea495d1524f9c5b758e9d072c93c0c1d0cd806c5fed5e29965f553b22c8c95a80a76d7771b053361cc96354

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1dfd728f69022cf07e4941808167d8e8

SHA1
8b8430293a3e2380bdd5567843c0c477758706ee

SHA256
ebfd662162c1a0ce6144c6cbf60715453a08d92a725c7c2659fe87afeea69eac

SHA512
d6009e155ac13bc6faadf88956e6e561cf641e7ab286a4012f1000feba08caae029bdf5298f5c22c06620f719618292ffb91d124f784d39cce3a38ac5b92f5a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6888b15992699e1fc8028849506e5e71

SHA1
f3b23f13c7f07c6a11f2e7ad6c21a91af08337b3

SHA256
c00ae436ad4ba5866bcab0bc3a40a20b7397e7b33b34f040b10b868e84a8d1be

SHA512
fa269427b26c940ad6dfbcd97004d3d035f719381025890254b9cdca258b6886fc525ff05e835eddd688a0ef323f330ee5be1b79706cc9dd9c695e643f029e20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
c476c98b2fadd31f991f0950430fa803

SHA1
9c4e69d61b25d9fd416641d7f89dcfeaf79d593c

SHA256
c295f61f6285a25a610b9d332953071b1a76ab90c4466d315f9a3c29bf2e5cef

SHA512
8088213f0df3d000cc0819e782e6f117b4fee1a7d07f2c208fbdd57498cae7091f66d5a8cf38e6a0b820ddae5a872d1351884ce20187e45a8829704513773695

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
174KB

MD5
8b724610ecb216abda1007a97c1fbc8a

SHA1
a4b9d5468051f7d9efaf72cf112ce276a31317ac

SHA256
6e11d7284921453538b3cec9d13a951f30f8c5e54ae06d203f4e8e344f44e51b

SHA512
8599621ce6b75035ec701d91e2e134180162e5a33f96ba0e462df7fa8dd3147d4e21897b32f8ab879aa0c79d5252650022ed77a077c2c38227ef517bea47f4b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit