hxxps://smartshare[.]eib[.]org/index[.]php/f/7428031

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2023 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://smartshare.eib.org/index.php/f/7428031

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133325511795225487"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3376	chrome.exe
3376	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3376	chrome.exe
3376	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 1732	3376	chrome.exe	85
PID 3376 wrote to memory of 1732	3376	chrome.exe	85
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 4772	3376	chrome.exe	87
PID 3376 wrote to memory of 5084	3376	chrome.exe	88
PID 3376 wrote to memory of 5084	3376	chrome.exe	88
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89
PID 3376 wrote to memory of 1208	3376	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://smartshare.eib.org/index.php/f/7428031
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee0409758,0x7ffee0409768,0x7ffee0409778
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1764,i,9354063113542515362,12714266306838154013,131072 /prefetch:2
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1764,i,9354063113542515362,12714266306838154013,131072 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1764,i,9354063113542515362,12714266306838154013,131072 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3204 --field-trial-handle=1764,i,9354063113542515362,12714266306838154013,131072 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3212 --field-trial-handle=1764,i,9354063113542515362,12714266306838154013,131072 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1764,i,9354063113542515362,12714266306838154013,131072 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1764,i,9354063113542515362,12714266306838154013,131072 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3728 --field-trial-handle=1764,i,9354063113542515362,12714266306838154013,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
6a211c8124d4e57001968b8d602d81e2

SHA1
13480b75c95071203ceaf35573d14f5426de29fe

SHA256
977f2495cbfcbb0bdf2f3ced608fb0ce56cdef323257328752e1cd83c930c307

SHA512
42e2008d0c57ded31bd6e02f6fb4f652771b3bd20d7210f1b6278cc297f5008a58fb9ab7b9d657d27d5e4231db22ea8f6009a32a324909bcba2de9edafc61be5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
2a3fe138d3d52be078e13db30ad2303d

SHA1
2ba72ea34e4a326ec0d79a22b3bee389c3d313e0

SHA256
d89cd24fa6b5fce7e12f9a065331fb49ea6cded03c551d8805654cc454567813

SHA512
2a5da288063725fe13204a13086608ff19ace67f64a3d7720756fbdbe326fd1f055a930278e53b7b442a313a43980fd81b914b8ce0cf9c3bba3b14c5e2d54c4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
49a359c4408b88c855c0bfc5ca1fe26b

SHA1
1ee45586ef1afffcd52ef7accfacabb9f69dcfac

SHA256
3a64bfcce0b20eb80a230f8a2fa097f1a19c786451790f0200b3d2ef299ccc65

SHA512
c8358484d9eee70694f5b4df141c1c191c2eac274bd948116541e50e370fc144c5bcbbebe81dbe0fd269a6b59d2b8efdfbfc8df0376ce0b39f6cdfdf2458a2e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
5106d5e2ae6d8003f0ef03bf7f68c510

SHA1
1bf5b14438c6469d333cebf8a9daf3cc7cfc490e

SHA256
00eb7817bf73925a3541ba557d31f86ce59019a6df597491b063610150c3df62

SHA512
af9f300c6f9bfb03c339822436a65b70cd4826ccfe5c98e88cee424ca5792c527a3febbf4c98a87fc7bf5529e8bbd1f0b0237a0f4ac43ae28932dc71dbfe3c02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
00beb8bfa43c72c3892ea429a8b5db7a

SHA1
97036e800e4e24ce4fce86ec8badd921e95b2949

SHA256
26bb8e589934f1be0b4a2c1c2d1448dfe88e88debac687e376029a6e10f767f7

SHA512
59303d1772b4e9c09947ce9ca64039a32007dea902a4c18f1674d7d30528b9728df10960502cae4a646dba51bc52f13ff21ab30a10d82d1d41dd0eafe3ab272d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
b3917beceaeff64cf0eec4f8f675009a

SHA1
55765e489d5dace7f898dd2dfc6bfa795eaa75e0

SHA256
4b52a56d8686e973bbf0f418afa15fc9f8ccffde843e692bc5cb421a365bed6d

SHA512
92a7d31358f90fc09fa4c1bf2c9d2ce374dd091358e7e416d1dddaf1445cf350be393a05ec9d83543a1f662618f0de23be3f6af920b9f19b820b0b4ed31e043f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
9eb26f5c8b3c9b0eeaa4cbc50214ba00

SHA1
9777fb880f8c16c3173a3ed71a1f0ec7464f3761

SHA256
fffe1b47c3b508a8a8eaa60d4e1ab26b71c9be28b9d812708d838a2c0fd9e24a

SHA512
5063ec0b1b3f8349cdc8a891a757978c3037689f07c288f0ae902c9b956466112b657b6322244dfbde904872f3bedf491692307595c7f44e6afdaafcf5989d13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
f1078fde81db8a81a66b20e6f100a2c8

SHA1
c7a39b88d2e7baf75a3ec53d4fe3606d576f2c31

SHA256
12d1df62747d8f7f2295887503c529b48a0f9982aa86f090fdd2fd0574e765be

SHA512
9cdca6497ce5c9be76c7b7e95f85eb19809f6189f214323d7e8a240812929b806adb2f1b2c6da2f5a758ca55bafb8db44994ea3a162abbc35f485063fb0a72ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
1c3e8f4efa90da1df3ba8cd132479918

SHA1
7ae17c9aa94db045041c37f799b70f13d306eaa0

SHA256
52defc9b4240411cd236368333261370bf9b8ada2f7d7c6a66a755b598411cca

SHA512
6f3ceea1734f8aca2d4c0a5bbf862d1555834999b13eb078506cc881ce2d374e3a53d8e4afe9a132c49405c5f167aa9215c48a4e52159191ce6d167135bff547

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
682386285444bd9ae0eeb86556dc1b76

SHA1
588cd8a28b2dc76847685eca8bf3233c30874fdd

SHA256
1400091f5c0292f3ae2f6c64f66737839d66e5812d0b40038708412d5f1d0aa1

SHA512
2200da4820b0a1379b58ad3cd6beaea81023fbd89eacde11df7b1b4023ed4971546159d802c5f53e7d5cb990d077a1e160ee92bd5bffbde49ddbed728a32677c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
954d840ce86a534e8e50213d5993ba78

SHA1
6fe70b651b0e23320515fef0c10af0661a4d63d8

SHA256
8a06b8dd640824f883fcfba7a37e91d196939d0a7ee2f8dbc4e814c4639eed6c

SHA512
eb308616f6c4279af0e1eea5f7973447aa5504713b4abd1122014ed698d494d3dcd4547bf13c6a79449ff8d40036f52223b5e0a5882388969dd15b735513f199

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5cdc9731a82c9564ea398a28a0e7caa2

SHA1
73f6d757b4982c6a5ebdb52ac835233699663344

SHA256
a1cfef04ee55a2e612d3e62b0bb29a5f04577424e785d963c72b4ea0101898a5

SHA512
eebf877a2117d128c9226b40be5e40d9e2770cdeb5a3bca185f8ac9c2c826fb8417c92ba9614de69a393a2e34393a852a69cee784df6be7a6fcbf6345ecc5d5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
172KB

MD5
c38ba98904a27dbb36a51650f2308ee4

SHA1
613d3d76c1e3ece8c1322cc7eb9cfdef9061f34e

SHA256
82f8bb321d8b10e96f3901bfe562200033bf100b3ff449ec006e5007146ca17a

SHA512
a5633f4ad1a5549109bab8360f7afdd1dea83e13d67350252c6212e5aaa612f5811c48d0bf0a4dd812afe44568e5f5675aa4764bc87d6bb98a88c2984f878288

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
99KB

MD5
8221386b1d55388f811286ed9eaf31d0

SHA1
7caee005d4050db9bf5f2ea6d4915189b6e144f9

SHA256
6bdc381a30a40086f10aa65ce38692e96bb2dad2030825558f7f355702139cf9

SHA512
f5ee16d642e590a44ae2bca04cb703ce02255f474a8f285102ce67324bbcd4b86331217f435a218afcc626304aca48344b3533dc14cdd13345e4c456cd712643

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe576755.TMP

Filesize
97KB

MD5
d2763f14ff663d26492ac39d84dcebc5

SHA1
2b9c5cafad60bae13a318cb66804efc516dbdd7b

SHA256
539d1c5a4a599eb4b14250b1b7deaded10e81316970a6d1a9fb789c8b766c111

SHA512
e0ba75b343509af732e5e1d9d50a668fe9cbadecce45feee85712de01476d8f226c32120237b28905e886f7a2ebfe793e12314eac68a46e0b2c38638ce3cbfbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit