hxxps://docs[.]google[.]com/presentation/d/e/2PACX-1vQCpiwyXsA3QW20AtDefOU3MQWcs8m9sAMH-ZCMbL6M5N6-9SF8AqVltz95BqnyGv7pp5jODpqm54fL/pub?start=false&loop=false&delayms=3000

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2023, 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://docs.google.com/presentation/d/e/2PACX-1vQCpiwyXsA3QW20AtDefOU3MQWcs8m9sAMH-ZCMbL6M5N6-9SF8AqVltz95BqnyGv7pp5jODpqm54fL/pub?start=false&loop=false&delayms=3000

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133444189908793755"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
220	chrome.exe
220	chrome.exe
3708	chrome.exe
3708	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1096	220	chrome.exe	18
PID 220 wrote to memory of 1096	220	chrome.exe	18
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 1340	220	chrome.exe	88
PID 220 wrote to memory of 3632	220	chrome.exe	90
PID 220 wrote to memory of 3632	220	chrome.exe	90
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89
PID 220 wrote to memory of 2052	220	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/presentation/d/e/2PACX-1vQCpiwyXsA3QW20AtDefOU3MQWcs8m9sAMH-ZCMbL6M5N6-9SF8AqVltz95BqnyGv7pp5jODpqm54fL/pub?start=false&loop=false&delayms=3000
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb06049758,0x7ffb06049768,0x7ffb06049778
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=312 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:2
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:1
  2⤵
  PID:264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:8
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1716 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5112 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5584 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5340 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:1
  2⤵
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5744 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2524 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5368 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5008 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4908 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5652 --field-trial-handle=1760,i,16218963008654138294,1010595426132848054,131072 /prefetch:8
  2⤵
  PID:3940

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
d60d071a38c8751e1c0d75a1c6258260

SHA1
72632caba290c404e722e4476e56cccc22b22b1c

SHA256
99ff3b046207505d097bdb5904ae7f838cb7f2dbcea8ce760c2f51e018428167

SHA512
53974dce1295e16dfb749d325fe129c1e2bfac4ff4c55f6879fa8eeaa11206b34c069e1e7c19df605013036a502651410bafec73f597dd7c441d6935468a8a23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
42c315afb53ce32daedaa56916f06265

SHA1
f565213b5d255e2aea6a6143e0525b35788a91ea

SHA256
c34b1ff1a7c5cc7601d209a68298eafb8ed19a59a4346ff63c3c588cf17c076b

SHA512
6b6f407b2f3ab7851d1582a584cbc2215bdfbd99747578b98ebdc11db6dd2b8eef1ed61af228bd80742f6303458696f57eccfdd2b660b460a176d7ecf7f3cb64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
45b3a0b672cb7f1f966d38c37c686c20

SHA1
3ddd33f392a4019467aae422257efce3b7663efb

SHA256
bed435f43fd71cbe8fe76e8db2cd25cc28f607dc39da88333e584fd1a9e9cff0

SHA512
214bb5e62fda0e81fd45676edaf3af875fbd8c4d79df5333bef30c6e58ab49e533e6403f4933a446fdd7843c8163d144b7e3108723f3c993326ed27635d983cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
5c31b58aace2efce25dddb1ad9bc3ea0

SHA1
c73f07f0ed4ec6f4676a7e83d2b979c5d2c90054

SHA256
a2ed32ba0358156c1d66a2ef3374144c7e30cfd2a92a4d2a087640c9b0d6b635

SHA512
b7bdbe2b740047315dd17810bb6f465e9ff7e02d23af8b018b138f339438c832796649b1ea041c95e1f3925efe18c27c1723057e039c625930fbc44593310cb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
704B

MD5
45f512872c79d685c1b6e89e7bc5cf5e

SHA1
450db9a7653c94bb59e5bbe34a5fd49b238bf1d5

SHA256
1f9665c5e2c5bdb8e119637478632e8c40bdad79f8ed184d991ba18a285bc2b5

SHA512
475dc25a4570f59ca8cfe4a009a04f6764f986268323a7f4fba33d6c8d0341f966abaf42e4fd3a1cf056b860ce67c82d722ab10442652b5eea0c4a2983e11fff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1c52eb8867446016ca58d5b8b62b41c8

SHA1
9f1786471f672762ede17a48780eb107eb8713d9

SHA256
aecd20c85c9f745a36edb80779f1f89764ca34f9673ed190cac4fcd186ceae68

SHA512
c5d9d37a5b0b79abdc82e296dd3cdad6bc537a2fc9a0c78973b34ef99b7f5d080c0d7b0b5b291b034c31603740241d62cf67ecda28db5e51094a9448bb3c2cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
313b7f6855a200750d8426f5b9e03253

SHA1
8dcf1d610896de278af6611ff4c7c0c3c8247796

SHA256
29190f904bded9946916c0711adafd250f54f1d5ba8d0daf58c1610f76e65339

SHA512
454430d135ce88896b1541dc78c5e51525c2d125562734ad6d0f3a510faacf06e00ee46f3dd1d5c73a029986b610c9275950361ed93c2b4dd128c7b246aea7dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
9f552a7eae1892a23fc45168d9baac69

SHA1
2e19a7c78a7a5bb5e79928ad58e45d22e73e3445

SHA256
99c2b933c39bf131171ba09a09ddb572de9d9a414ed3461f23897ca3fb9f984f

SHA512
b842f4dd4daa05d693f2f5d9af1158320394550b4a3fcb3def326ba2cd7316ea2df9539ab22f47ae17d80a6ee4528b2ec8e82f28190838e422b6a18b659e6f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit