hxxps://cs[.]moi[.]gov[.]sa[.]waps[.]bio/wpsnone/portal/?vr=contents&pswid=Z7_0I44H142KO3AEwcm%3apath%3a%2FMOI%2Buj%2FMynrtyrtyunnddfeOI%2BHome%2BContent%2BARwcm%3apath%3a%2FMOI%2BDiwan%2FMynrtyrtyunnddfeOI%2BHome%2BContent%2BARwcm%3apath%3a%2FMOI%2Bln%2FMynrtyrtyunnddfeOI%2BHome%2BContent%2BARwcm%3apath%3a%2FMOI%2BDiwan%2FMynrtyrtyunnddfeOI%2BHome%2BContent%2BARwcm%3apath%3a%2FMOlI%2BDiwan%2FMynrtyrI%2BD&db=moi&tgf=nddfeOI%2BH&v=Mozilla50iPhoneCPUiPhoneOS16_6_1likeMacOSXAppleWebKit605115KHTMLlikeGeckoVersion166Mobile15E148Safari6041iPhone&iwa=n%2FMynrtyrtyunnd

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2023, 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cs.moi.gov.sa.waps.bio/wpsnone/portal/?vr=contents&pswid=Z7_0I44H142KO3AEwcm%3apath%3a%2FMOI%2Buj%2FMynrtyrtyunnddfeOI%2BHome%2BContent%2BARwcm%3apath%3a%2FMOI%2BDiwan%2FMynrtyrtyunnddfeOI%2BHome%2BContent%2BARwcm%3apath%3a%2FMOI%2Bln%2FMynrtyrtyunnddfeOI%2BHome%2BContent%2BARwcm%3apath%3a%2FMOI%2BDiwan%2FMynrtyrtyunnddfeOI%2BHome%2BContent%2BARwcm%3apath%3a%2FMOlI%2BDiwan%2FMynrtyrI%2BD&db=moi&tgf=nddfeOI%2BH&v=Mozilla50iPhoneCPUiPhoneOS16_6_1likeMacOSXAppleWebKit605115KHTMLlikeGeckoVersion166Mobile15E148Safari6041iPhone&iwa=n%2FMynrtyrtyunnd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133437238185842909"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2796	chrome.exe
2796	chrome.exe
3984	chrome.exe
3984	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 116	2796	chrome.exe	18
PID 2796 wrote to memory of 116	2796	chrome.exe	18
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 4868	2796	chrome.exe	88
PID 2796 wrote to memory of 1160	2796	chrome.exe	90
PID 2796 wrote to memory of 1160	2796	chrome.exe	90
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89
PID 2796 wrote to memory of 5048	2796	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cs.moi.gov.sa.waps.bio/wpsnone/portal/?vr=contents&pswid=Z7_0I44H142KO3AEwcm%3apath%3a%2FMOI%2Buj%2FMynrtyrtyunnddfeOI%2BHome%2BContent%2BARwcm%3apath%3a%2FMOI%2BDiwan%2FMynrtyrtyunnddfeOI%2BHome%2BContent%2BARwcm%3apath%3a%2FMOI%2Bln%2FMynrtyrtyunnddfeOI%2BHome%2BContent%2BARwcm%3apath%3a%2FMOI%2BDiwan%2FMynrtyrtyunnddfeOI%2BHome%2BContent%2BARwcm%3apath%3a%2FMOlI%2BDiwan%2FMynrtyrI%2BD&db=moi&tgf=nddfeOI%2BH&v=Mozilla50iPhoneCPUiPhoneOS16_6_1likeMacOSXAppleWebKit605115KHTMLlikeGeckoVersion166Mobile15E148Safari6041iPhone&iwa=n%2FMynrtyrtyunnd
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb06049758,0x7ffb06049768,0x7ffb06049778
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1912,i,17919219189202093997,13805821931196709828,131072 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1912,i,17919219189202093997,13805821931196709828,131072 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1912,i,17919219189202093997,13805821931196709828,131072 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1912,i,17919219189202093997,13805821931196709828,131072 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1912,i,17919219189202093997,13805821931196709828,131072 /prefetch:1
  2⤵
  PID:336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4704 --field-trial-handle=1912,i,17919219189202093997,13805821931196709828,131072 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 --field-trial-handle=1912,i,17919219189202093997,13805821931196709828,131072 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3412 --field-trial-handle=1912,i,17919219189202093997,13805821931196709828,131072 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3496 --field-trial-handle=1912,i,17919219189202093997,13805821931196709828,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
42KB

MD5
de8c2c22f26f1c1fc94b4bf8479bd64e

SHA1
d7b8c0fc6bfb78721d59f386c1c859d3db00f38a

SHA256
3b7ec01b377244471d01329d2e42ebb477ed7ddce3bff1466ad85c571ab785fe

SHA512
bc31e0ab9736582a0377bf95f1fe8538b93c9c5e30c51dc21d34485bfa3e555798d11efb31f82c9e46ac0b0245bf30f62b0a89c02efceabba4423780fb35b1e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
e31816b488768cc7543c2ddee88090f8

SHA1
725a6d46ed329977b95cd3190689c2ce8db21f49

SHA256
ec0d74c235fea1385c1bb87b1bcd24079118c3185dcc9788e293e2fbbb373a33

SHA512
f0da3b967c099c61250513a78d6b1d5704a7e804a9f5451d1eab6d657f8b822edc928ef4dc841017ea6aa55790ce474c74b7219bd4eaa6d5816cf1c5b34b1fd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
e67193cb8f50f0481e0d8617deaaa3bb

SHA1
aba19bfd6bdcbb3c609234742458ee86dadf8450

SHA256
4e22cbe19e7ff8819cfc2775c618d877e3ae03f8915f45c9185a47aae7dfaf82

SHA512
cc27c2aa68e0a0e2f4143aee7bd84f07d82b30e7b82298c8f7dcbe6f91b23e774eeaf815f534319a53e09dbd71c0f09f593373c1f605bd29f250ec5625afc6f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
536B

MD5
475942ddccf717b4b85ac4d5bdcf37a2

SHA1
8d2bcc2bb993ecc73373f6aaf760bcdf2751dc3f

SHA256
986332dcb395232ca125bcc1dd13457dd1d9a43ab7155481f32293aa265105ef

SHA512
868d1c192aed85842ccd5248fe562d218da59c44e36a3afad80280d80115c54885928ad7877e20f888d936a2fde87dbdea4d81f226a4aade17ec66a0ea16d919

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
536B

MD5
7cf6f24215c4a6749ef1ed2717975b0b

SHA1
dbf950edba3bb94510de5b2d6e915ea6391b8c5e

SHA256
886804e6f93b9a536459abb00fedd1e1996b8f29e2edf1965dc66c415fcfd067

SHA512
7bed81e750e3777d827264cce0fb4be518b086d2549c7adca2ca3f78a114a0a4f50e3b0cb2a664d0bde5772505d5436e01b94c4eb50f56e289be1b0362ca5014

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
536B

MD5
6cdfa9357786fd6383301c3dff90be80

SHA1
233089b44baf38a05e5e9b16c266a83f84247fd8

SHA256
d210bacb5537c40c7ab84e8f6b8201821643970cc690703dd81c752ccf8c60f2

SHA512
c6c85215b4fd4f151a72ab34076d0dc63804c5b2ee71e9129eb51874368fde9bc9a1f6a1b0693e73cfe3d3510ad135753b3415d10fcb1974e94f5d6824aa3b7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
39a9b3e5d878638a09317aa3e73f3cf2

SHA1
6e0c8dc4b7e63ec2e35d2fb7100ef771118aaa97

SHA256
12e65f9b2196f930d3ab2d2cdb011f160c7b6b39a2d5b87242fd924dc8c2344b

SHA512
46695bbcc4c43188e7b6363ea9c7aaf6efbefa92b98679ec1e314dcaf2df305bd819125dcd3693d61e48d888c60a59848408b9cad6a45d3015bf16c09cbbb167

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
2f4329490e7132e03b423a012ddc2e08

SHA1
5c54a84954871038a1576d4353e1f5775f42f8c0

SHA256
3ee39ecd6ccf277f566477c4c6d653581b6bbcf57e02621a2297c3d1dbdcbd79

SHA512
ee2202da3f55ffb2a0e1cf63d4d9cae25d3db06e5ce6162681c0cb3b3e522aeb5dce7b6d4f0d2184102e33df12339dab322bff6733d7139d22dbe21c3c6d37fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit