hxxp://sendgrid[.]samlearning[.]com/ls/click?upn=cdgxOuG-2Bu09ZXcmeaodBy8HdQ2qxItAbQQIzDoZa-2BCOesP1yTZ02Rw6FEd0oKoH9eKFMIaTMv6wgQ-2BqIqmehTDHJ3TXLrF-2BXjbgGeypfkrIzWu-2B95mEEmrMlNqQZ-2FPJzDYPd_BzpNq-2BF-2Bo7i55xAoTwN7BWSJPACUxwlBpeCB6MaOxTp5YS25BX-2FBHhRlO8oByaxxQuvNpY2trYepygstzPorjpFH5SidDu6nz3gzTcA8QhmLAgaVN-2BfOOKqMyltQv7OsbUByjVnxdAwKepaf1yopFR3UZ6sXQoazY-2B2mKids-2FMNJw7QeV7equ6zGrkASH22Y3P6ZqlAL-2B05KgGM4krYxgutTUMNntLuxHhGmyAW1oeM-3D

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2023, 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://sendgrid.samlearning.com/ls/click?upn=cdgxOuG-2Bu09ZXcmeaodBy8HdQ2qxItAbQQIzDoZa-2BCOesP1yTZ02Rw6FEd0oKoH9eKFMIaTMv6wgQ-2BqIqmehTDHJ3TXLrF-2BXjbgGeypfkrIzWu-2B95mEEmrMlNqQZ-2FPJzDYPd_BzpNq-2BF-2Bo7i55xAoTwN7BWSJPACUxwlBpeCB6MaOxTp5YS25BX-2FBHhRlO8oByaxxQuvNpY2trYepygstzPorjpFH5SidDu6nz3gzTcA8QhmLAgaVN-2BfOOKqMyltQv7OsbUByjVnxdAwKepaf1yopFR3UZ6sXQoazY-2B2mKids-2FMNJw7QeV7equ6zGrkASH22Y3P6ZqlAL-2B05KgGM4krYxgutTUMNntLuxHhGmyAW1oeM-3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133397827133154478"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3612	chrome.exe
3612	chrome.exe
4680	chrome.exe
4680	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 4136	3612	chrome.exe	17
PID 3612 wrote to memory of 4136	3612	chrome.exe	17
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 2436	3612	chrome.exe	86
PID 3612 wrote to memory of 3300	3612	chrome.exe	87
PID 3612 wrote to memory of 3300	3612	chrome.exe	87
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88
PID 3612 wrote to memory of 1796	3612	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://sendgrid.samlearning.com/ls/click?upn=cdgxOuG-2Bu09ZXcmeaodBy8HdQ2qxItAbQQIzDoZa-2BCOesP1yTZ02Rw6FEd0oKoH9eKFMIaTMv6wgQ-2BqIqmehTDHJ3TXLrF-2BXjbgGeypfkrIzWu-2B95mEEmrMlNqQZ-2FPJzDYPd_BzpNq-2BF-2Bo7i55xAoTwN7BWSJPACUxwlBpeCB6MaOxTp5YS25BX-2FBHhRlO8oByaxxQuvNpY2trYepygstzPorjpFH5SidDu6nz3gzTcA8QhmLAgaVN-2BfOOKqMyltQv7OsbUByjVnxdAwKepaf1yopFR3UZ6sXQoazY-2B2mKids-2FMNJw7QeV7equ6zGrkASH22Y3P6ZqlAL-2B05KgGM4krYxgutTUMNntLuxHhGmyAW1oeM-3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdce69758,0x7ffbdce69768,0x7ffbdce69778
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1452 --field-trial-handle=1828,i,12685190840545325341,14126718548679033262,131072 /prefetch:2
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1828,i,12685190840545325341,14126718548679033262,131072 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1828,i,12685190840545325341,14126718548679033262,131072 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2940 --field-trial-handle=1828,i,12685190840545325341,14126718548679033262,131072 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2908 --field-trial-handle=1828,i,12685190840545325341,14126718548679033262,131072 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4640 --field-trial-handle=1828,i,12685190840545325341,14126718548679033262,131072 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4632 --field-trial-handle=1828,i,12685190840545325341,14126718548679033262,131072 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3232 --field-trial-handle=1828,i,12685190840545325341,14126718548679033262,131072 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 --field-trial-handle=1828,i,12685190840545325341,14126718548679033262,131072 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=1828,i,12685190840545325341,14126718548679033262,131072 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4708 --field-trial-handle=1828,i,12685190840545325341,14126718548679033262,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4680

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
76a85c7d70dea29c288a2dae85ca70a0

SHA1
d1cf80e85b5a7900b0f9011bc27b815d11fe159d

SHA256
27adde65d28685aa000d85c0029afa04b96b39376cde99542f09a00ec6cd22d6

SHA512
f07b168ac971fe2ad95c277141884fff99eb84745ae40a8941ca1897061e991cca3b4074fd8f232e90a29616637f7287a1cd82a768e80bd378532fa41984cb31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
17f10f64303897dff06bc3fc2c12870d

SHA1
c20683fdae3f8c96bdc118f863c4c36bd577c1b4

SHA256
3ead0f6bb46ef67bccf4892ae36a231338616e9e4bd4d2097c75ea1052217b3c

SHA512
b8639f5e1e6443c23cc040f81054b17f9d052c682bdf8f5cc572a0c619d359ea996dd989943c85a1c22bbce70b321a16dd2b15a33cd9891b0644aaf115ea1431

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
3ae2d9c71b82e8ca15c3c40aef16d3bc

SHA1
2568ccfb4f4535e8b5d0065f3da0c0483b4b7d29

SHA256
e53431fe74214ec79832d0e068e52284c29bf28e4166a6f18c461ec4fef3a388

SHA512
4f66e4fda28d379df245978639c48a4ad865364c16bb70279cfb656627ac49c26c67ff858a497cace69d715ad37764450c10353afc42560bbc108ccb385c834f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
cf6c88aca2558d9245b9e13289113d20

SHA1
b35b827272ac495944ab37e7704e9a0de93f2c57

SHA256
af6da182f7e6d8b9459fbcb34174cd726f9923bc62d6010c0f6ef4c01cb4bfc7

SHA512
5e462a6d14d42d09ae8eb88b463a7c60a98f10e0c5b93b943547ad5c5839934c4ec526a7ccb102041bb8d80a3927f33b989b222b2684efcefc3dda6f391e167b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
0868bc1e4fdd5954ae5aa842d32c344c

SHA1
78bd01dab1565b7cd6c956d83e96b8dd14f905b5

SHA256
7e2162d5f530f5ba2724c3f974b529b7eaf0b4785ec2e761edc6ff4f1baae852

SHA512
c07d02f9845caec58bce03a3132ba88d60ec340a045027c50e1037f399592aa0659445a93893d0f6f1d5d716ab7d7d705233359df6846d9b82bfae09ae56b62f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0a99034a369b13a79e87b68354287b47

SHA1
00a9667c80bd5a874b45c1f3b1c2675cacd76f6d

SHA256
cd978433c9b7bf832d233728876c4a70cf78be6e683c59fdb2497e639ef9735b

SHA512
2689e1cefbdc1b8e4e4c9ce2964ef47953391277197b4093639436dcf6da925e18a1680f164ba913d484082ef1a3b5d955781bf14f372eb0d232d54ffe54fd2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3157e11718d92383ab4aac0782e26b14

SHA1
4c8c67613299bb3c93930d69b35d03d145f8b3bc

SHA256
36fbd6e6d6c9597e9dd4d3ad5b88c14554c445b33ca2e2330afc83f8d78a8480

SHA512
921f30e0f171e366db09daf892a3f4a5232092590f8509bc49f38c992a474f25d90bfd8f8861d98b3434f6f71099edbc5b09237bdbe0e826e34c1f8b728fdb21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ba14ffda4685a11f1b28d7f5a2ac1730

SHA1
c07cfd8e38df91e084a29c3405baae8d5bad3db4

SHA256
89aae2a4eef3c9c444a4c3948dd0003597a6dafffe3d8ffcf7f0550d0b50bbc6

SHA512
9dde47b7846596e53dfa37f6ea4b37f6503ead3826ae4b6347d70e450e4fe9c53f6a473455f7134dd2bf8fbaa4169e1bb701478915964343f7b55b2b02ab71a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
102KB

MD5
deff376e69f96016800e438a4c19916f

SHA1
d2f753c83c0b444ede9eb88812d23da72a314820

SHA256
73b356f5ea4432f69ce39a1a5783e0380efa6449363dbd93fffb68b3c3d7ea2f

SHA512
f9eddd0b95acdb91157dd9aca4e8e9a7f12c7ac5c451c28b468b2818ccc7641163f78fa38a1f8a58cd35172097e6d0a531a7cc07acf7bdf62f5532acd467edac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit