hxxps://zapwx-zgpl[.]maillist-manage[.]com/ua/optout?od=3z99350760356a4b1c2c7d31fb265886b2d2da344dd5ea236b84a2ca8986a63f9f&rd=11004a9b525b5e988&sd=11004a9b525b45a69&n=11699e4c1736b2c

Analysis

max time kernel
171s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2023, 09:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://zapwx-zgpl.maillist-manage.com/ua/optout?od=3z99350760356a4b1c2c7d31fb265886b2d2da344dd5ea236b84a2ca8986a63f9f&rd=11004a9b525b5e988&sd=11004a9b525b45a69&n=11699e4c1736b2c

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133406279672517728"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
228	chrome.exe
228	chrome.exe
2716	chrome.exe
2716	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe
Token: SeShutdownPrivilege	228	chrome.exe
Token: SeCreatePagefilePrivilege	228	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 628	228	chrome.exe	44
PID 228 wrote to memory of 628	228	chrome.exe	44
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 2040	228	chrome.exe	88
PID 228 wrote to memory of 3892	228	chrome.exe	89
PID 228 wrote to memory of 3892	228	chrome.exe	89
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92
PID 228 wrote to memory of 4320	228	chrome.exe	92

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://zapwx-zgpl.maillist-manage.com/ua/optout?od=3z99350760356a4b1c2c7d31fb265886b2d2da344dd5ea236b84a2ca8986a63f9f&rd=11004a9b525b5e988&sd=11004a9b525b45a69&n=11699e4c1736b2c
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa211c9758,0x7ffa211c9768,0x7ffa211c9778
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1852,i,18157428791988148804,14792013381002652466,131072 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1852,i,18157428791988148804,14792013381002652466,131072 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1852,i,18157428791988148804,14792013381002652466,131072 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1852,i,18157428791988148804,14792013381002652466,131072 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1852,i,18157428791988148804,14792013381002652466,131072 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 --field-trial-handle=1852,i,18157428791988148804,14792013381002652466,131072 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4012 --field-trial-handle=1852,i,18157428791988148804,14792013381002652466,131072 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3940 --field-trial-handle=1852,i,18157428791988148804,14792013381002652466,131072 /prefetch:1
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1852,i,18157428791988148804,14792013381002652466,131072 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=884 --field-trial-handle=1852,i,18157428791988148804,14792013381002652466,131072 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4932 --field-trial-handle=1852,i,18157428791988148804,14792013381002652466,131072 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3748 --field-trial-handle=1852,i,18157428791988148804,14792013381002652466,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2716

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
113KB

MD5
7b9d3764cb756da15a69e567c27aa8d7

SHA1
6f1f86352a1d1e24798da22d687fc9b9309125d2

SHA256
3afe5ece5cbe54b1ebf174e83622f67a5dc154de3fe47f8756b74f930a70172a

SHA512
ba7d666f743b42e13caf8d9a1381a9fdc99e104e94f975a83a9ae69bf6d80a67391516f1553958c81fa1f4716009e4dc33fdbdd2e34f901e70dbb13d6f894743

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
125KB

MD5
e90d07f3ad1b7542ad2eeb4200719785

SHA1
46ece602f71dcf735aa71ef94d34e575bf04374a

SHA256
3ec730a457368c524e7de2f2916ff98856c71ba04e8e14598e891e7771ff7f2c

SHA512
74d1e6d0665818d2bac882ce6b2d2d3792ec825f98145de1e57eaefe0e2043eb82debcbaf1ae787b2ea73999778507efbf646e06f28fbca9da5a49d5b9b9e74e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

Filesize
1.5MB

MD5
b663f2e4d69be749bb99f8c9332620bc

SHA1
efc322c7c94f3a9434a1711e243d11f347fd25c1

SHA256
75d0c0962d6f6a1942bd2c0d24ddeae56aa1219f9116b67caac29e5ffa073c55

SHA512
052868c372a4c1efc781519731190798456e11bc54544c50d15bef39ff926f7a68a191b8427fa67e98596c61da5668f3a9c8353d6fa674790a8cca3bfa61a87b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
7a985cda01def25ff6a197d6e9c6be55

SHA1
ac181765c2bcc43239eda6af6e2550574149b8f2

SHA256
b2d4825196b33b5ce385167e00eb85ca864fb286e1317e32498c490b106ccf0b

SHA512
774cb8e490256c8a554d4e95fa368a76b4bc93d6321146e2931c71084293310f754f7df6aacea5145387b815ffa4c7bdab0c6931c48b266a642068e46c3bba13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
b9ce79d5be121df99a57d296a3735e07

SHA1
6eb26b600a93b6933ea5166a675dc4fad2f34e47

SHA256
a62490592bfd7249705b609553ed187c19061478bb2e543e99b79e5c86bbfdd8

SHA512
39df2ecb1f99fca02f5a9d2b15cc74ec3ec022e2c64cf6c406aa0d51412a25c785997d15ff25b568f05766dcf54817c4d877f32bf044da3f35b9cdb192835396

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
2b3671b164977890ad89ad7d7fd0a27c

SHA1
eb2e1a1072006653eb841f1587f05e37fab7efb7

SHA256
0f2ed37e32f1852acdd5755161ea47d09f40dd4de591d93808b9bfd355a499da

SHA512
a3ea54e1640129002a72401f3aaf5379e0837dbee698e11199f20c3ffeeaa141feab19e8364453335391f25349adfd1adaedca5093cb5fa618bbf8d1ce0cde75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
873B

MD5
f8295e8b58c332704db42d36b6c51b4a

SHA1
b5cee96b05f687adbf0e31a28eceb0ce791acbca

SHA256
ad8ec8210a36a29e5ae30482a76bc5b792f251cce9af95bed0c81fa7eb34160f

SHA512
304b0525e533d09e1b4cf9747749efa38919395d7ca1d5b8e19a442abfebb9dbd3eaad78de9a750f64bdd84b22aa080649bd139875140b08e2046deeeef90fe4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b2b542370ed74d11f0fe127916cd727a

SHA1
6ef12f83f1fe86ca8ecf20d42ea1777137cec217

SHA256
2abccc4e5c87b894d5a2bf5bb7bea89d439b7056313af98517cd2b8ae502e9e7

SHA512
92dc082f5f0947ab75b8661b1c9cfdcd3cf9cb13cc1ff8944daadde84f94e52b5c8ed8398b58e6b46c68c70b91b3ed9394b2f89502900637fc685ef304c166e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d3169b355e83f1f056c4b27d177eb967

SHA1
d3e043314b5bdfe82d71eaad8d9ef565050ad750

SHA256
9f927bd58a5423ab5d96ff4b637d3e37003f3370261e70df24d043be427417a5

SHA512
d35da7d0f85de750985b7c5825657835c6443fa56cf084c601729638c14cca3ff93972d0d1c01b7a42543027081213bb426b71bf0496f7871bf19c6eab759d1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7bd8516c32e9990908b69e8529835cfd

SHA1
7a4b958e440a74429fc4b740b73597a1ae4ea3a8

SHA256
afb25012c55754f8f840b3adab9857f4ea725b6c71e8ef3b4fdec932c8a40fe0

SHA512
3fec07584d06628bd72454b49c76d901bd7b9c2e527846165664f2a73940301742998971b61d6ac2fa1db32eaad7a9258f0e9905286a61dabc488cbc0c5cfcaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3268950d1c456f201568a623fb2d1a72

SHA1
5d7cae4f36c03b93324e2e4ec727fd0d113c0d5f

SHA256
50e07ce49b2f2d1297bdad02cd44fa9837a9ef105e32be8e78ab0e220cadf3be

SHA512
e755bea0ce76db2cec5dfde067e8403e3e09cf79d2db0534516b079af1ae3a379992b6a88ec15b927a49f8642eb8bbd306b6b7d6e9c06ab42acff5eb70261fc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7acb070579b731ddad3e47e7a513fc0d

SHA1
ddae532a1c1dfedc1a8b353edf714c0d283067f0

SHA256
61da6c4db37aac55d9e20e1e7db7c951b68caa2f9dba455935bfd82f13933812

SHA512
b4cd6614593934c0f04b3e01db36c2d8756c7b83f00c16821224dc2599084d0234e20e1fc3efdddf194d738241a94b38261e8511d1bb44e5b62efcf3915c5436

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
bbe4253304dbc08ad66186924c7018af

SHA1
f3463c79369f306a68526a6cebbc04840d4bf2cf

SHA256
f4b2edd37490f432482b248f1ceb1558c0738cd6458e6521becd2402dfb29d3a

SHA512
a88095b68a6ad7f51b0067fde8d8e0f26c3fe3081ebdc6b161a63f4579c9ab9b62b018db9b8e228d9b6e65f50b44be570fe2b88127ade0a735760dc373f236d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
a02d34b1d358ed49b76d53f0e1843a25

SHA1
e30b40477369527c159c2ca9530a74572fc191ba

SHA256
8692aeee1ebdd1d00a49edc3ee0b1f2ed53e42da1c979b3b1ba33f7fc67f52d3

SHA512
4e35ab70e5ef8c64f2a13a0ba2dea7e9c4a35f86edaa2381f905e95e58d983bde81c6cce9880a973bda6aa52f4032a727314f14fbb06002ce4047f5236adad28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
103KB

MD5
406f3be335c1f7938b83613a8679e822

SHA1
f7a2c911c23b2ab1d5818e6a866e99e0a3d07f33

SHA256
2dc4b723224fb3377a127639fcfffbba284003f515ceb726d4e78a5fc3e91e54

SHA512
d418c4b229dc725bf2537bb619b0d865915943495ff0f5855f897f12b8c7e20052dd08550fb3cc6c81e9b4bd4a6aab52b5fec5c4477cddf671a2c4dff91a01e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57fe46.TMP

Filesize
101KB

MD5
fc48db938e115f6c7cfd3c348c93cd4c

SHA1
3d3fb8e3dd23c540127845ca91b90682ab64c963

SHA256
0c61e1e318ffc9e76f250a17e8247f873f51d8347d4e7a2fc20c09e259d06dc2

SHA512
6329da9600d945cb861f77038519c4b832004fac877d9ac0e07a2c8887c8a8573c65e713155ae5e0296913f62f1e7c63d1193667d353f0318f3c40fd2afe7303

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit