hxxps://r20[.]rs6[.]net/tn[.]jsp?f=001con5U6vQse-gVY9rTfJrQzquo_Yt84YvmrtdS6pU5DfuVx5FI9vESApkvgfBl5r5kod2-IdLufmZ2thfeWj0CLRDFJxhxIm3veYaL6oLglJR5BWLicWVtQEbr1eWm9mIFt51CU7tl82xGlK4cUgR0WjXiYjegdidQaCCPb-8bRNvSMwQKz14lA==&c=1ZGnRJ6a6WhG0Pg6DFrjaxWT317QOho-EnCzOT-Zku3tw4GHpYZ1Dg==&ch=7YWXnewpldlgVRKuae-nmFb21RrdBT73VkAJfNBhjpYYI-ejAFUglA==&__=?e=c2NvdHQuZGVubmlzQGludmVzY28uY29t

Resubmissions

02/11/2023, 22:50

231102-2r8mysaf38 1

02/11/2023, 22:42

231102-2mse6sae46 1

Analysis

max time kernel
300s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://r20.rs6.net/tn.jsp?f=001con5U6vQse-gVY9rTfJrQzquo_Yt84YvmrtdS6pU5DfuVx5FI9vESApkvgfBl5r5kod2-IdLufmZ2thfeWj0CLRDFJxhxIm3veYaL6oLglJR5BWLicWVtQEbr1eWm9mIFt51CU7tl82xGlK4cUgR0WjXiYjegdidQaCCPb-8bRNvSMwQKz14lA==&c=1ZGnRJ6a6WhG0Pg6DFrjaxWT317QOho-EnCzOT-Zku3tw4GHpYZ1Dg==&ch=7YWXnewpldlgVRKuae-nmFb21RrdBT73VkAJfNBhjpYYI-ejAFUglA==&__=?e=c2NvdHQuZGVubmlzQGludmVzY28uY29t

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133434390284189896"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
4768	chrome.exe
4768	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 208	4892	chrome.exe	70
PID 4892 wrote to memory of 208	4892	chrome.exe	70
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 1940	4892	chrome.exe	92
PID 4892 wrote to memory of 3812	4892	chrome.exe	93
PID 4892 wrote to memory of 3812	4892	chrome.exe	93
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94
PID 4892 wrote to memory of 3360	4892	chrome.exe	94

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://r20.rs6.net/tn.jsp?f=001con5U6vQse-gVY9rTfJrQzquo_Yt84YvmrtdS6pU5DfuVx5FI9vESApkvgfBl5r5kod2-IdLufmZ2thfeWj0CLRDFJxhxIm3veYaL6oLglJR5BWLicWVtQEbr1eWm9mIFt51CU7tl82xGlK4cUgR0WjXiYjegdidQaCCPb-8bRNvSMwQKz14lA==&c=1ZGnRJ6a6WhG0Pg6DFrjaxWT317QOho-EnCzOT-Zku3tw4GHpYZ1Dg==&ch=7YWXnewpldlgVRKuae-nmFb21RrdBT73VkAJfNBhjpYYI-ejAFUglA==&__=?e=c2NvdHQuZGVubmlzQGludmVzY28uY29t
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91c0e9758,0x7ff91c0e9768,0x7ff91c0e9778
  2⤵
  PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1872,i,11213303346099153386,14895088630794138134,131072 /prefetch:2
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1872,i,11213303346099153386,14895088630794138134,131072 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1872,i,11213303346099153386,14895088630794138134,131072 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1872,i,11213303346099153386,14895088630794138134,131072 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1872,i,11213303346099153386,14895088630794138134,131072 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1872,i,11213303346099153386,14895088630794138134,131072 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1872,i,11213303346099153386,14895088630794138134,131072 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5360 --field-trial-handle=1872,i,11213303346099153386,14895088630794138134,131072 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3188 --field-trial-handle=1872,i,11213303346099153386,14895088630794138134,131072 /prefetch:1
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4812 --field-trial-handle=1872,i,11213303346099153386,14895088630794138134,131072 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3204 --field-trial-handle=1872,i,11213303346099153386,14895088630794138134,131072 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2488 --field-trial-handle=1872,i,11213303346099153386,14895088630794138134,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
4dc68c2e1a4cdfb09d22596e6b994815

SHA1
021807ae25bcc817938216335420d93259f8d029

SHA256
6dbcf98fdb2d798818e80e32c8b6f17c0422c7445f4c5c9ea8a6c116e5325688

SHA512
495571cb9306ae109dc7c47d5e12d8279655de23a1cf9f408ce504c678ae88ee48382de0333c57415ac41ae49c260760977418ad3a322a7d85afafd3e7293078

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
86c1d1971ef16ada164ff409612b679b

SHA1
517782a655c3d7f3b65ddd8ee6813a20115f977e

SHA256
c445ad01af6f215b0aee396e2a91c4ac1d083b60e7ab4cc73ffb78a109ad60af

SHA512
bc5e78335835288ba469fa53eba0b8e4e031c7efd00c3099a0505d07c1829ef06181a189acbebaf6fbf1e25103aba9fe34ae52b6c12f96a54d953cb85fa09c74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
0304b945ec02c2e1fcf16416d26a12e7

SHA1
9d38bc546feea9c54576587c2e983b31877a82fa

SHA256
cfd64610b1bd8dd2624dce081a3f9052659a1d60c51187b0da163379a3af5cba

SHA512
eecb612fee3b95f12370f9c6e6cea4327443554992eed6334bfa1975500f7b0d782977787a5f97f273a8afd71728479b5a894bfef8f7e58f97993fb6e6407f77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
ec39d385531b807261d6dde39c056ef3

SHA1
4719362e3adee19ac3b68caad7356a935e6948d8

SHA256
7586ada520396038ce741f22fb2ca8b17ef34cee7a3b5d4fe370aa6bbc0b436b

SHA512
295834acd9f4fdc7f799909de4e96aa949353ba7e96f0142042a3618c82cd703e75dad3db37bf478607b2867f0e6502c83166549ca844f0c7b8060e0bc1c5c9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
9341b07a13385fd9f65286a8271bd145

SHA1
ccef911ace658c05e558bcc2df539d1e9405b976

SHA256
f30b91e0f39d8e8e0d3d47633bf1b3d065ffdaa04711405a47f2e4bd3a4a0585

SHA512
79917d00b0e66b70907592c5db0093fe4feffaa06e4d8902cae6ea911173ca4b62dd2e1ccbbeeb8f31a33c6044fe7c8a7e97c209a9a7ec189901549c8f05f09e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
cd94b8837ec3af7641ce60a112424035

SHA1
2b0a7c80a076015da3c0d2d111f20856a286b906

SHA256
03f441d003be065037fd7e82acbf9fbbc7f634e51b34351239e1a3290d5349fa

SHA512
ecf97557b3e1779c8fa443bcb846eefc2061cd059a7e13905778092e77b4c76641c1c7245aac1e41285062a1d13c77691f467e2b7ff2f557d3092d56cf096ce8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1730002d73166cf5ed139123213243cc

SHA1
4e2b91743d26cfa7445c7411b3683a6b5f2e4d9d

SHA256
26ff76e6583aa77f3b845c3046303d547d47aede73302ef5465cfc6809b70e32

SHA512
d60555f65cd42b42a2f2e1beab8671dc64517213f91a951df8da13b2733206a2af97adcb706b73dda0075d90f3cbffd1b572b8f3c35602250f4dbce95569bb1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e817891ad238ed3bc8345d8841f7f272

SHA1
1896e93743cb68192e92d8101cc61a31ffd54c2a

SHA256
7e46cf603a9d7b3aa84e120e0da832ab9d1e623ffa8919cf48bf2c33e68d9d71

SHA512
e423ddbc2dd7add2aebdb8843c752ad6705245bfe01a557c9bb2cca18615f5e025765830834ae077aafa69a9fd65020183eb3df7f914df464cbb14d81c1ad369

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c916ac77901dbf3d41c83811ba23b3e7

SHA1
44d516e989a002e648500bd0b019cd9bba3e8bb5

SHA256
0244ec7ec791db73374dd435d480f2352a61cfcf79e6af4fc2a3b9110ffcb353

SHA512
b39ef349b925a52848479bed4ae79af39567aeba10b3d98d8f87e953146ad703c441b2767ec7b08b53a39f8e6a5be3be2f49f60b936ef4dca1e77fcc714fba73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
5b394091beff70a33326a2c257e6f261

SHA1
38495cbfca693aa752981801ede3a9ac300fe686

SHA256
4fc9e1bbe5935e359130a2d13733238d016acc3b23e16fc9c82d77ad88dfb101

SHA512
9301efb91590c32598e1ae46e1feeaa5e7ba207516598a6ec1ca06318350f2edc1f889f9d2cbb1cdf50e7ffd30c44db8e9c14ae6994180ed9f631a09ac6636af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit