hxxp://holy[.]gg

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://holy.gg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133432519662061096"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5092	chrome.exe
5092	chrome.exe
1432	chrome.exe
1432	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 4528	5092	chrome.exe	67
PID 5092 wrote to memory of 4528	5092	chrome.exe	67
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3828	5092	chrome.exe	86
PID 5092 wrote to memory of 3540	5092	chrome.exe	87
PID 5092 wrote to memory of 3540	5092	chrome.exe	87
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88
PID 5092 wrote to memory of 3268	5092	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://holy.gg
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd77539758,0x7ffd77539768,0x7ffd77539778
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1816,i,9838792384672161560,8190365737287123559,131072 /prefetch:2
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1816,i,9838792384672161560,8190365737287123559,131072 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1816,i,9838792384672161560,8190365737287123559,131072 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1816,i,9838792384672161560,8190365737287123559,131072 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=1816,i,9838792384672161560,8190365737287123559,131072 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4596 --field-trial-handle=1816,i,9838792384672161560,8190365737287123559,131072 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3268 --field-trial-handle=1816,i,9838792384672161560,8190365737287123559,131072 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4008 --field-trial-handle=1816,i,9838792384672161560,8190365737287123559,131072 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 --field-trial-handle=1816,i,9838792384672161560,8190365737287123559,131072 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3304 --field-trial-handle=1816,i,9838792384672161560,8190365737287123559,131072 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2464 --field-trial-handle=1816,i,9838792384672161560,8190365737287123559,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4064

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c8 0x498
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e6f1e3c144fb8cf693466c69b8fff92d

SHA1
b06983bf7e2ea831d5f30150a79dd205ed45c1fa

SHA256
4d0432f1da242ba11054fead3d946a5a92ae7b610b14242b6af92775a8a8c247

SHA512
8a5c48d2edb86ec658fb60c94ec67de8f046a6cc5d94c5828e14e18126f186fa89ab6336f53bf1df174923167b820b0a4bf5eeb773d977774441dd9946473184

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
2ba55b2f06fea1cc534a14d4ab864753

SHA1
3e0fac511094b5540dff95d9b562d41219863808

SHA256
faf62c7130a3ac45b5c0c4e771ed7ba9749bc84e1397ec76df73d45106f12dab

SHA512
56447a35af42be1aa73278672b1f14bdfed55b90b8bda612c2f308280ec0ac59f2f7ec92dbb07e4c2985afd54f6f7e1da6beb769defc828552e1e34d503e2145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
c69c6f32d11d1a09537558205fbd5ad3

SHA1
2d9e0eaa9ccdde5fc1eabf11c4740a39df12ac69

SHA256
44d4c1d33a4aa3ec0b101f6af4e447faad89d3c698651423e1a23a1596a761fc

SHA512
b7826634683d0233bb83ffcb76da55a52a7ef51b2fea65d539be4ebfd6ff7ee2ebcd52da0ad0b87c95288f1536a922d55def7fff28b8c70178833e8cf3372880

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
535B

MD5
ad00e31ff982747e44a519cf648d9e40

SHA1
82f92972766a5a9331bf2046b90411ffa38c9ab8

SHA256
f5be4cc6d61ed858f7f816cd0eb8fa9c97d0f87dd81fa2493ec45e7f21890362

SHA512
815e7934d9a446b72ed0f80caa37033b40614f7b4b3929f82864f7c7aaf3301d004242b360e687647a60facce9f2b0d7645446147dea9616cd2f9d0c6e4754b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
0fb3fbb2c6fde280bcf2ce99cdb82573

SHA1
6c3206f57f1677b4ea5550e6afa8721f08c85b79

SHA256
00b3a3816195f093c5226140a74b9d26f238b443ac46579035467303cbab16fb

SHA512
d35cab5803bf399a28427812f0c0192cd6a7f9d057d6e9415533978d066011f354e0467ddef7bc729c80d43bc1331fdbdfa60d0596226221ae66c3195c5071fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
5722181cf52325e800c50c6f8f1726e4

SHA1
6d68dc2fb4a650e2004a0891c9f4ef9f38982910

SHA256
32f484808bddfdaf74a26a03929f50ea7b9e2e2c6b3ebab55f08910c1e44de6c

SHA512
56c2c963301a5fd52e63035c93650b783a2b9bb29944cc3f4408a9b21cb597821395d43e5cb2e07135e5fe2f3b5bdaa7b2a5e278ed03e25b52293f5b1deb7309

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
85cfc438858ae2e88ab14781b28f3fcd

SHA1
894e6ebde14524ab0365cbc2ac136535c62e56de

SHA256
ecd1cedca27e6ed8b5d594bbe2a444c2a5d0644d53c40ea00e4970197938a391

SHA512
6bafb8f50af996d6999accdc7cbeb0ea296264acdd62d04dae86de7a9e8c1f6ffed48485e70a268361a530714de696c71421c6fa1080cb747e30c98188b4a56c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
d767e36294a53c47ec4b3d14f42c4914

SHA1
3ac23a3518e48dd0b7547af8e1814ca1bfac7ecf

SHA256
1730590cc783730c2548c3dd6965ea62b0cbd036c024aa22d48fd4145df75977

SHA512
acb504a0f7230934a8d0060dc233226c747eb992f2ed09c063a5b280887f755fc2d4b580ac3a29bfa7719abbf1457a70390937bf7268ade75f34520853e95ce8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3231178f3c2f0cceb65ec29f41b27355

SHA1
469e78971cffe0ef045e01c7180c52c5b2fcc57b

SHA256
53539cb026beb76883d83707b56f0b66b036aa634aff7a35492794e28a88fad0

SHA512
9d311136300147be10616a1fdeb9925c7f2aa6e833029ffa7fc876045d6d1a172c6efb086c2b76dfc4dbac3ec7205febdbe96bdcfdf5bb106e6964a7d653c15b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
f7817003efaecd1b6cfe1c8d1b823b33

SHA1
50e22effc4d3de1a1178bb5a8bd6c889683049b8

SHA256
9c683686b9e4a2fe5201719d166aa84e715f8dd58c3ab9aaa81fe1f725d064dc

SHA512
f54bf83ed71e625505cbe575c9a005b71c4ef8be6ea29dbe141ec6436359538aba9802ee20d08a4caf6093785e0cbc9d05dadf5c59546b46e652f70ba619f933

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit