hxxps://paytime[.]us13[.]list-manage[.]com/track/click?u=9f0a38af301683053f593fdfb&id=4cd2632436&e=b5ccd7b430

Analysis

max time kernel
600s
max time network
585s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2023, 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://paytime.us13.list-manage.com/track/click?u=9f0a38af301683053f593fdfb&id=4cd2632436&e=b5ccd7b430

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133446522497775934"	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
1916	chrome.exe
1916	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe
Token: SeShutdownPrivilege	4892	chrome.exe
Token: SeCreatePagefilePrivilege	4892	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe
4892	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 2328	4892	chrome.exe	81
PID 4892 wrote to memory of 2328	4892	chrome.exe	81
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 2692	4892	chrome.exe	88
PID 4892 wrote to memory of 1444	4892	chrome.exe	90
PID 4892 wrote to memory of 1444	4892	chrome.exe	90
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89
PID 4892 wrote to memory of 4128	4892	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://paytime.us13.list-manage.com/track/click?u=9f0a38af301683053f593fdfb&id=4cd2632436&e=b5ccd7b430
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7fffdd379758,0x7fffdd379768,0x7fffdd379778
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1888,i,3314474286308401383,14090496556949036121,131072 /prefetch:2
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1888,i,3314474286308401383,14090496556949036121,131072 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1888,i,3314474286308401383,14090496556949036121,131072 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1888,i,3314474286308401383,14090496556949036121,131072 /prefetch:1
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1888,i,3314474286308401383,14090496556949036121,131072 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4708 --field-trial-handle=1888,i,3314474286308401383,14090496556949036121,131072 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1888,i,3314474286308401383,14090496556949036121,131072 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3276 --field-trial-handle=1888,i,3314474286308401383,14090496556949036121,131072 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5100 --field-trial-handle=1888,i,3314474286308401383,14090496556949036121,131072 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=820 --field-trial-handle=1888,i,3314474286308401383,14090496556949036121,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9c14698e80798c1308280b671ba25eef

SHA1
ef9911764966975863e496dfe3a530e200676aa9

SHA256
5a34bc5b5289618d4731e717eb432ce7077f7fb962afd59b0c938e8d855dd2eb

SHA512
80f1e50b3311a93ed91d6bd9ae398ac8b35feedf2aca072182c084725fc257f9ac3397918400e9b52e6838284bdc0f635f545a8815619f3a230ec193585f79db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\522bc2ed-7e3c-4b06-ae35-6e0d912a5b95.tmp

Filesize
5KB

MD5
5984ac7db04c4b9ad7b753c7d529351a

SHA1
dc83c274fb6e2323b70ca0fbb20e9a924851e59d

SHA256
601bfe9b68fce5f7f6debc478ede0545002a437a25baf1791b8aa5247e28710f

SHA512
9435e1aea941bd824f782e56f8443ca99ce2ef0dcc3a1a0d5a8d2736214069b6621331f14205a2544a7dc4e125f6bd8ca92b8dba4a262298fb52b9ef2a06ae69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
cbaf5bcb24aa9ed981db104054ac4f48

SHA1
f714649f3fa39b26519eabced65804632c3b90e9

SHA256
bdeb561ffd7501451884113a5e6d24b2bcce59bdfe72045ac7ff3fca80496796

SHA512
5b27aaf4d5baed224cf0f4ae7961715fe35c4f16bb411cad950f4b34269b87ed6a9365b77a63a3e02cc260041daa9e1cba9c77c2882f304a86482cd555afe09c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b368ab9ad182ade2d11a8a855d709417

SHA1
af393ca44bfe8f7a59ee3643ef799482af6e84a7

SHA256
6f36c78feac83ce0a686ec5e5d5dd3d64c08598586687381cd635c25f6c0a0f9

SHA512
42694644fbab34c459fae326f59b01bdedde6210b0c14427272dea6fc8e6aec60322c5547d6c8b7b2c1809db2c5a90c17874ffb4ccc8dc01aa75e3dbb655b6dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
1e0a1f6a1c122f2eb5fa5924e6be22d7

SHA1
a38b4b0495ffd377d436a90dc71436c6813cceb9

SHA256
0e5a5d024f2d56df18f97b312c4b24ee4a3dd6f09ebd4ae4625e0e9fb073e41b

SHA512
6bcfc0f4dfafb7cfc2f9354dae0a50c42b7efaf5d07a603f2dec9703c4f9bbe14f79589548326ded09d6f4e8579f376161c49c6ac2f79c617755342650239258

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d04496dad0cddfbe59e803117706391f

SHA1
ad14d23032fc9d2ef5839517c7212e21265cb87c

SHA256
52d08f26d410cf2b6e29aac35514d6a9491a6d5db190373eca28b930b82be99d

SHA512
829553111c3194a186e289ffe745273e85fd4e449a94a0d32531d0b6cca81f432fec7b46e1bf6fb04eb9b9b078b8c78e0a0dee5b93147deb18bd64ef440f8cdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
3bffbe29a2d289a1ac893c00c1fef7dd

SHA1
af027f91c2a629cfca3563ffba2d8cb60d10f092

SHA256
e0a701356a1938ef4171a4c43042b8dd6fcd2554867d896b35d0903fb343b388

SHA512
3777d21c805d459265ac03a53898aaa85ec7c3ac87abce67a1943951d7f1958d63b27761e04e895c24c5361d0c946ead859a411769f47b6b4e5bf41dc0ed73d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
704B

MD5
424d9f5eeb8e37bda4aeaead1407f47e

SHA1
071da0dc453be9331d01384127b79b430348bbb5

SHA256
0f4c3f83c7bee01c969407d73c092cf4a26821fc5935ba27234a0be9c88cfeba

SHA512
6b7b894b6436643b2ed0da08b10a9169d73c2041524ed8411f80b045f8b28ad1018f5098177452880db4b056eb0c10f104ae651085f523a3a149f4509f450724

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d582add3df5f78584e9a1f0e830afb96

SHA1
1e5351a1483c3d3819bf317bc29d046cb74ec007

SHA256
9133207fdaf67b6d446ab39c92fbfc21853df74314bb3ff8394d915f8dd5cb35

SHA512
e0ed24d4721d3a2850ca9180cf79e7b110696714d3e17466588a5153d0336bd26ec89a8fcb6980ca71556a8b8768fa75aa4e4d3ecc75057edf2c0ba3e15f0736

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
fa66957e7a5d0b5e531b4686377c5ec5

SHA1
71eb4115f6296a0110a78fda0beb151508a14ad2

SHA256
d2485197faf00be1a43658ca903e5544a78aab90073ffdcfdabf56281df81b02

SHA512
0dd01af2d516479d7dae53fb8659d428b50305c94afd4e05c159a9a2763818361c160d4fafeeff3b1e64b8aa4e26b5be433dfb9fd5856b33e30951eca30e1b55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
3b50dd95f38b5898b4ad233501d2c65f

SHA1
424a631516d3dd1e8820b3141a200381df10b3f2

SHA256
c34f721317def8600a58de58d46c2eccdd2d0f0dbe0fc76168e9ed5c73b2765c

SHA512
380abba82c6f08b130c7c3127f0d8e51344ea3196fdb7ee1505c76f17ae2b8f433601bf620e46af891cd2c6e36af12daaed6810dac5bef414a8543972fd7d736

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit