hxxps://news[.]aiccampaign[.]com/p?h=HwOLjtfiGRoyVfP9G8tDPJVtIgAEaC&activityId=10205618&target=https%3A%2F%2Faccesskings[.]net/year/DOMC/Ym9zLmRvbUBzY2FuZ2wuY29t

Resubmissions

18/07/2023, 19:38

230718-ycr5wadd54 10

18/07/2023, 19:35

230718-yap8haeb71 10

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2023, 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://news.aiccampaign.com/p?h=HwOLjtfiGRoyVfP9G8tDPJVtIgAEaC&activityId=10205618&target=https%3A%2F%2Faccesskings.net/year/DOMC/Ym9zLmRvbUBzY2FuZ2wuY29t

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4972ACB6-9BA2-4EF2-A8CA-178EB2643F5B}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133341827447106519"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4480	chrome.exe
4480	chrome.exe
2176	chrome.exe
2176	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 1120	4480	chrome.exe	62
PID 4480 wrote to memory of 1120	4480	chrome.exe	62
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 4540	4480	chrome.exe	83
PID 4480 wrote to memory of 2188	4480	chrome.exe	84
PID 4480 wrote to memory of 2188	4480	chrome.exe	84
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85
PID 4480 wrote to memory of 1632	4480	chrome.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://news.aiccampaign.com/p?h=HwOLjtfiGRoyVfP9G8tDPJVtIgAEaC&activityId=10205618&target=https%3A%2F%2Faccesskings.net/year/DOMC/Ym9zLmRvbUBzY2FuZ2wuY29t
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd67a99758,0x7ffd67a99768,0x7ffd67a99778
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1860,i,5109295234339082187,2818415149766219769,131072 /prefetch:2
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1860,i,5109295234339082187,2818415149766219769,131072 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1860,i,5109295234339082187,2818415149766219769,131072 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1860,i,5109295234339082187,2818415149766219769,131072 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3228 --field-trial-handle=1860,i,5109295234339082187,2818415149766219769,131072 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4976 --field-trial-handle=1860,i,5109295234339082187,2818415149766219769,131072 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4604 --field-trial-handle=1860,i,5109295234339082187,2818415149766219769,131072 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3908 --field-trial-handle=1860,i,5109295234339082187,2818415149766219769,131072 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1860,i,5109295234339082187,2818415149766219769,131072 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1012 --field-trial-handle=1860,i,5109295234339082187,2818415149766219769,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
fc971559fe9957dedbf5556d23d96d0a

SHA1
6db847548fc452eb9771a4016d9463d04aea4527

SHA256
8549047f28c7fd0188314ce4bc6856cf8212a6c4dc0be0950f95c06c30ee43df

SHA512
7e09a08f6bb6fe1c3940093b6176c688fba9aabd484efb9fa17f8d82e7144ec13bc2ea5e097467d9a3eb8275a0caaea2ca6163f4c063e2ccb52f5385b59447d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
324c343e290061252e3529d3f6dbeaeb

SHA1
56a27266f2f78619d9bf76e43fc32db25281de84

SHA256
59181080e8e90d05af8ef2151074315dcb389de7b0fce110fd1014f8374a00b1

SHA512
e30259ca880497f43a14e501c58d15d6f0a8a4b18e76ea1631eba624f77832004c9559326a46789a3e43abad22bf0019c45fcc849d2937adc5ac0cd0318c7bf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
706B

MD5
9221f83fb83c0059fdc42a511d572fca

SHA1
4b87f23a077c5858d39f87bc86ba2cd714bbccf4

SHA256
61c73eb451c6df780679f9ac163791189655718f13d9359a79b2bc74ce770d44

SHA512
28488959abad70040a31ae1ec4351d5509e691c5d99b7b9fb96c6536be8371fede0d83e2f8e81123577960db3f1641cdc273d39dea66ffce4cb3dbc0ab025843

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
40c9d4d833a70f6197b2ef1b196be8b9

SHA1
0e2b56de054da487b0c04189c567789f32642f86

SHA256
a940e0b947fa7e32efa73993c502ca2157fd4e7102d21c14738c88a076106912

SHA512
f69ae3c8b2bf5730fa84c7a046f8b88da9d3cce37fe591a23631c22f2dd03b43a04ba4d6d546f8bfd77746f12914f017f914fda034aad76230e5a85b4847ff30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
8147faf6f5342fd029e7452312fa3e2b

SHA1
38d8b21d1cc2e31e6d5f9a90b2aaca138fb7a97e

SHA256
2eb1a0e85967ac66a5625a83358b966e06ccca7d00357488fadaee02b4ac88f3

SHA512
b6b16a9b2271dfd27fb3286d19868fb8ed802cd413390fee0731ce8dba83a288a80ba90102a5be707f320e30376cf105a66a8f973c15ba4232f41ba8903949e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsuAB05.tmp

Filesize
14KB

MD5
c01eaa0bdcd7c30a42bbb35a9acbf574

SHA1
0aee3e1b873e41d040f1991819d0027b6cc68f54

SHA256
32297224427103aa1834dba276bf5d49cd5dd6bda0291422e47ad0d0706c6d40

SHA512
d26ff775ad39425933cd3df92209faa53ec5b701e65bfbcccc64ce8dd3e79f619a9bad7cc975a98a95f2006ae89e50551877fc315a3050e48d5ab89e0802e2b7

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat

Filesize
29KB

MD5
35d68be60bd48152f7100c71a8e178d0

SHA1
601f5804572b772fa4a284f66ba8865429f91730

SHA256
e99250d1254cb5f3374336ce895a9732f597edfed0bbdf35137478cbe5af3802

SHA512
2b33f4d348f7ce25e3b16031f40a4d4abba7f2ed5943a0022ead0cb69afccf1b3893cece642953dba96fb2398e3049eee176e3b0722d2e71edd381e5c22ed08d

Download Submit