hxxps://r20[.]rs6[.]net[//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//][//]tn[.]jsp?f=001TTysXwBh2Y9cHp5V6-vN-taOSDMJOVF-WZ_DGGgk2fAVnAOsA5pMsnHtincHMXHxSqJERUAPb4PNPuLDkKXg2hdEmoz68T7YIbQ1mqNvp5uEgn4y6UohWmFUQSzzmHOMVxL-UN00gjwGM75MI-dF2TEjYPMDk82cqALyEDcY2qQHhTfVMcKdHg==&c=&ch==#YnJhZGxleS5icm9ja0B0ZGNqLnRleGFzLmdvdg==

Analysis

max time kernel
106s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://r20.rs6.net////////////////////////////////////////////////////////////////////tn.jsp?f=001TTysXwBh2Y9cHp5V6-vN-taOSDMJOVF-WZ_DGGgk2fAVnAOsA5pMsnHtincHMXHxSqJERUAPb4PNPuLDkKXg2hdEmoz68T7YIbQ1mqNvp5uEgn4y6UohWmFUQSzzmHOMVxL-UN00gjwGM75MI-dF2TEjYPMDk82cqALyEDcY2qQHhTfVMcKdHg==&c=&ch==#YnJhZGxleS5icm9ja0B0ZGNqLnRleGFzLmdvdg==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133409961995218165"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4364	chrome.exe
4364	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe
Token: SeShutdownPrivilege	4364	chrome.exe
Token: SeCreatePagefilePrivilege	4364	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe
4364	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3596	4364	chrome.exe	84
PID 4364 wrote to memory of 3596	4364	chrome.exe	84
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 1544	4364	chrome.exe	86
PID 4364 wrote to memory of 224	4364	chrome.exe	90
PID 4364 wrote to memory of 224	4364	chrome.exe	90
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87
PID 4364 wrote to memory of 2352	4364	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://r20.rs6.net////////////////////////////////////////////////////////////////////tn.jsp?f=001TTysXwBh2Y9cHp5V6-vN-taOSDMJOVF-WZ_DGGgk2fAVnAOsA5pMsnHtincHMXHxSqJERUAPb4PNPuLDkKXg2hdEmoz68T7YIbQ1mqNvp5uEgn4y6UohWmFUQSzzmHOMVxL-UN00gjwGM75MI-dF2TEjYPMDk82cqALyEDcY2qQHhTfVMcKdHg==&c=&ch==#YnJhZGxleS5icm9ja0B0ZGNqLnRleGFzLmdvdg==
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff810199758,0x7ff810199768,0x7ff810199778
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1856,i,3562961570195713068,15836642639319049244,131072 /prefetch:2
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1856,i,3562961570195713068,15836642639319049244,131072 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1856,i,3562961570195713068,15836642639319049244,131072 /prefetch:1
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1856,i,3562961570195713068,15836642639319049244,131072 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1856,i,3562961570195713068,15836642639319049244,131072 /prefetch:8
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4644 --field-trial-handle=1856,i,3562961570195713068,15836642639319049244,131072 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4648 --field-trial-handle=1856,i,3562961570195713068,15836642639319049244,131072 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4920 --field-trial-handle=1856,i,3562961570195713068,15836642639319049244,131072 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5336 --field-trial-handle=1856,i,3562961570195713068,15836642639319049244,131072 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5460 --field-trial-handle=1856,i,3562961570195713068,15836642639319049244,131072 /prefetch:1
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 --field-trial-handle=1856,i,3562961570195713068,15836642639319049244,131072 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 --field-trial-handle=1856,i,3562961570195713068,15836642639319049244,131072 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5600 --field-trial-handle=1856,i,3562961570195713068,15836642639319049244,131072 /prefetch:1
  2⤵
  PID:376

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
2a36d4cd1586868d2e6c70f1f622e89e

SHA1
c278d5ab3ec0d79a37611b18251f2a8404f5b51e

SHA256
62d76500ac0b3f762e8b5a670d9846ff53a1bc2290f1e3e0c401a1f84c2565ed

SHA512
d62ada4324f7f32f3305dfb3d8335a5f42db3ecbd5b37de3b718aa98c095aded9a4201c10176086caf60b50bb95b931c06fb91464eea1fc7b38e651ac757985c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
47b73e812b43518df9fe79ec4f9dab2c

SHA1
a320d7d87b24f7a2b90274f1fd0f6e0789fc6606

SHA256
5d95dcfa134b671cc29f246471dc24fa8661cb1a24ebfa96c4018bd02923925d

SHA512
907689e2069bd53fcaed2eb2a01229467c51c6d43a681014d8e7ede61294e07142fcf582e7fa9076ed88ed526579db028155205b707a968d79f02e207f070e9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
732cf1df588101925e5b22a40ebc9755

SHA1
320572aa932f54f8a6efc9c9d8f121458748a522

SHA256
1eb5d911bd2cdd172d39fc9b7e0e37ca6c39661908fac1b71efe0f62d635c9ca

SHA512
aedbda9af9beaed142b48338252afc181591ef25ca7c7d00e9f1849e087490411b86fe429ad97da7da43433d7ac3e7ab343f8eeb5d9bd23da572f0b5f9ddf9a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
2ed8205f4d07f8566dfb05629bc58bc6

SHA1
4fd03331c5c2fa0055289b50c97fc0d77cfdacf3

SHA256
4cb90d375e8e8bc377433a599f62562c7258ee35480e46805b98d4f3c061e844

SHA512
575b8641a56adf06a0737ddeec90bfc876b13c20e68c1ed6c0a675603fcd985f52b8e5e202b23c18fc1617f117808c4ebb61a2d42c2d9f0adc3afd01a19f62bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6b0bc95ce917a0332d4c79699b279618

SHA1
5448f447c518015293711f7b039d527e071ea34a

SHA256
2274a5e2e5a9fcd4802bf898bf6f7e78ed110cb67fee679c73142c6a25f147ad

SHA512
9a634bee1f302c0c64e0cd81eb574ab13373831bf3e3bd124704ae936cf9abc5a67214f19157102264e1e15383a849ad62eb7d1932eb9bf990db1319dbac6139

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
62f7eb5ba87627a8eccece0be2fd20af

SHA1
972bb3e5c781a76f6f5995c5c61d85d8c118b799

SHA256
39784235b03e305e08bbd5b58bd34ac281b763f64dfbc4d2354746528db48dc8

SHA512
cd32ed6ea4492fd4ded60c7e7a717ae080b6923f7a7fe1cf68b87998a37cd701e87d6b252e4c0f86aea66600ba83d6597497c1ad54188334f73020cbb1f2cc69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
463d614f29bfab8529628172238796b3

SHA1
4213316b79a63f5717500152508bc95ae9aed410

SHA256
284ebd0f5879e002561fa7ac37269c09c4fbdce0a8e3ec19cba719e3dab15227

SHA512
df5f9cae963f6c4311c7f8ed133ab5222893b69c5bd1cabd4f9793d23ab5442b693fde76449b95b0f7d8704522387fed484f646df027f43e2a9d20547ebb68bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit