hxxps://click[.]txn-commsvanguard[.]com/?qs=08d4fa881e288f734b513d0d6075002c868210452a2836b90aba1f9f2ebdc5917a9c2c27bdb928e58d6cab496d8c762f1de9aea39108863a

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2023, 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://click.txn-commsvanguard.com/?qs=08d4fa881e288f734b513d0d6075002c868210452a2836b90aba1f9f2ebdc5917a9c2c27bdb928e58d6cab496d8c762f1de9aea39108863a

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133329663435861186"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3548	2808	chrome.exe	86
PID 2808 wrote to memory of 3548	2808	chrome.exe	86
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 1644	2808	chrome.exe	87
PID 2808 wrote to memory of 2296	2808	chrome.exe	88
PID 2808 wrote to memory of 2296	2808	chrome.exe	88
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89
PID 2808 wrote to memory of 4216	2808	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://click.txn-commsvanguard.com/?qs=08d4fa881e288f734b513d0d6075002c868210452a2836b90aba1f9f2ebdc5917a9c2c27bdb928e58d6cab496d8c762f1de9aea39108863a
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf3e69758,0x7ffbf3e69768,0x7ffbf3e69778
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1888,i,13250574635963512802,16382518268410008251,131072 /prefetch:2
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1888,i,13250574635963512802,16382518268410008251,131072 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2136 --field-trial-handle=1888,i,13250574635963512802,16382518268410008251,131072 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3120 --field-trial-handle=1888,i,13250574635963512802,16382518268410008251,131072 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=1888,i,13250574635963512802,16382518268410008251,131072 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4684 --field-trial-handle=1888,i,13250574635963512802,16382518268410008251,131072 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3816 --field-trial-handle=1888,i,13250574635963512802,16382518268410008251,131072 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5100 --field-trial-handle=1888,i,13250574635963512802,16382518268410008251,131072 /prefetch:1
  2⤵
  PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5200 --field-trial-handle=1888,i,13250574635963512802,16382518268410008251,131072 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5336 --field-trial-handle=1888,i,13250574635963512802,16382518268410008251,131072 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 --field-trial-handle=1888,i,13250574635963512802,16382518268410008251,131072 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1888,i,13250574635963512802,16382518268410008251,131072 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1704 --field-trial-handle=1888,i,13250574635963512802,16382518268410008251,131072 /prefetch:1
  2⤵
  PID:4516

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9f4cc6a0c61a3de5dc9bb3c79638edc8

SHA1
1ed9b8c50ea86d0360014353e63e4948998fba19

SHA256
7ff3081602302543d6469b0c84205b65fd7cb98a98f4aeff0ab349da858806dd

SHA512
8b33f94823701b6aae924944ca683d50ab506334d47a9be43155dcff297d8e7becc54a9fa026a734d65574e76cf1c9cb18b7be9496babf9e0e829d8822e33d2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
37cabf5f29a366f8db52d1117b472a63

SHA1
b7877afed5c91d8ce04faa1470489e9af9cc1e74

SHA256
9f80c44a87751ad04956e0af7a7e3f5eca871ca56350b90e08fec15cf3753a32

SHA512
05d262d145938c07484b6b5b4347214e69bec570018a4e9b4a131a156a466dc758825038e38e12c4c8d55e411a630c97a812f4558c151c1fa3dcfdec5b191339

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
26968c023335abfb1c01ef12f73b9a3c

SHA1
63e97cc7afb3e9226301ddd5603436eab47d2e85

SHA256
8443940de0d960e6c53d81ff4ab89d2da9b248046ae9be18f52c0f1173106b2e

SHA512
afd7d9e2e38ab5625c27e968f204efa6e8f2fc0975a02c19fbd7e74dfd627eff7f4d25e776fda37bc47ba111eee299d6dc3184acab693fb13a116c7dfca9914d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
c55176bf839ae5c60a4bdc5ae5ab2991

SHA1
2d637f91407c51556335ef44b05d1441742ac28b

SHA256
7d0938e9ab4a36768723f20c4513b95f606724781e49b52c7bfd5b5030112648

SHA512
98cd08a5df5ef2227a0868422693df421a42572f487121d4d98c863129237df8684811281f0b5f470027c53b3de18a23cac61a24b4419bebea2cf4c0a2a362ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
6b4cf8b72bf71be3a2e656351d869c3c

SHA1
3da85406f5e44111b4418e9f9691266d05c54d7a

SHA256
0fb6ca879cda2f36d8152e445b57475a0a70c59fe703b96138702c55e882134d

SHA512
02eda487781dcc77678ece62a5f0e3bcccc386f74668e5ec9c4cc52cad0bc714f841f14a53e4e64726054698c1d2b45db2c38a552bca999fb83faec8bc07fc15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
25fed315253082ddc3f49d49edeb3974

SHA1
43dc2b89087c5bfc44441814fb54a97caa2f809a

SHA256
06e6cdc31ae58421e60244b4264032a73239b90735e48086ab64927ba80f730a

SHA512
fd07ccda1eb7c05601d0b690cd4f3f4b3326cdfab30a06ce6a0d3f179d8dbc978e9b37f51fc1bb92d03e2d8d9b2d6f6d7dcae2b280fba585101ffdcefaa8e521

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
fc3c844bdb468e35cfb59ae3b6088f33

SHA1
8ed8070ec093af04edc160d12e510f2498d468f6

SHA256
c56a80aa4216ba94f19599266799eb5d6a6970d335bee40d454efcf4887d1ef8

SHA512
8040b9743fdf1f5b9a7e7e7bc8e3dafdb902a3cd436bb7820a1a787bc27db4ec9b1429fe2b9ab4f7d95f2fd956bdd67030b0e27cd177c7260bf2de7eaf3460ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0fdbbb408cf047a8d29a8c1fbacf2da9

SHA1
50203e6d799e7e0df3996a493c9e788bd906a65e

SHA256
daa425f88384416972f0c28dff3c458c5d6d1d010c18f65f1dbb6005f108d249

SHA512
444898e8c07e0bc73c8e65038d881941021b3f026af9024e4e77239d5cc4ac39b642d9e63f532fe40466d24dfadc0ad078b9570477e42379e9a66cf8c297ecb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0706ee1c634f22db684b860ca7a02905

SHA1
63769063d064ae60882592f3a9dc1a5976314151

SHA256
47da707d2f4e7fa026ccf9b6e7d7ceb6894e73e156ab84299c3396f861930539

SHA512
da9d3ebd312d1ba99fd300e2019b571aa4252602f226e814e89e52d21570ed48f6c34842d63441dc090beda3374de380bdebdc5a49e6002d956e6958bbb4a65d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
57a5d007b983a65883a0ba5c2d45f04e

SHA1
dcd0969e772376cfa82ac6e605e7336763fc2048

SHA256
c991c5f5b90523d061ebf1feb10f7db8a03d7a2b2253471f07f0e93ed0732fa3

SHA512
7bf20b26f5689f3ef5e81278cb4229eff225c9edb545e148635fbf559155363426c59ea7e889971677f19927f88fa4b7e938883c119dcc62fa565300553c6469

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
2176539844fd0ce464eca8a1e79e586a

SHA1
054e9930c6ab5e9eb3e288322a32403a784cc08e

SHA256
c8aed765d4d2b9d755d155dd230776aac68b18eb45ead33131e6d3fa56b9f02b

SHA512
3cd7c28149cfb2c90528f83d65850704e912be55aae53c0b79ae66a8dd34c863dd828f872b001efdb2b3cd9fae76fc90203b9041070b5ce16f61a825dd032c0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
172KB

MD5
db391a6f8afb97bfea9422b73fbc366b

SHA1
1756ae18eafa38631c31702f010949258d340af0

SHA256
e2c2cbf08240133f46758ab7a15cd86d381084a43d40f027b6693f3aa15228d3

SHA512
4cb1ced4223b6910eaacf94a13adb8eab3d4e27e6f4367c162a9d9e7e2145af8d4894f4060013731c3426327dc3d75bd7635f93817c083d0e106da14935aaca8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
172KB

MD5
e3e67977ae8cc4fa6f68964af20b6f26

SHA1
5c32696bb3ad88068aca2d6738a69aa79f683987

SHA256
95c71c2ac2afc349540d858923521b4d3b03840efeb7d8420828d0f630b1161e

SHA512
d08cf8562ac8e3382c3e7c99386ce86e0b6bbebeb4b7b2a23749e6321b1f8ee97dcfe36bf304d4390aa770fdce6c50be0290c091f6786d85816283a830993a21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit