hxxps://pexp92d[.]sweetpeachandco[.]com/?jtehkfbt

Analysis

max time kernel
138s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2023 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pexp92d.sweetpeachandco.com/?jtehkfbt

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133450681360502218"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3824	chrome.exe
3824	chrome.exe
2980	chrome.exe
2980	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe
Token: SeShutdownPrivilege	3824	chrome.exe
Token: SeCreatePagefilePrivilege	3824	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe
3824	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 3804	3824	chrome.exe	86
PID 3824 wrote to memory of 3804	3824	chrome.exe	86
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 952	3824	chrome.exe	88
PID 3824 wrote to memory of 384	3824	chrome.exe	89
PID 3824 wrote to memory of 384	3824	chrome.exe	89
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90
PID 3824 wrote to memory of 3604	3824	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pexp92d.sweetpeachandco.com/?jtehkfbt
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95fb49758,0x7ff95fb49768,0x7ff95fb49778
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1728,i,6387867953985150717,664199474984166306,131072 /prefetch:2
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1728,i,6387867953985150717,664199474984166306,131072 /prefetch:8
  2⤵
  PID:384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1728,i,6387867953985150717,664199474984166306,131072 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1728,i,6387867953985150717,664199474984166306,131072 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1728,i,6387867953985150717,664199474984166306,131072 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1728,i,6387867953985150717,664199474984166306,131072 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1728,i,6387867953985150717,664199474984166306,131072 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2540 --field-trial-handle=1728,i,6387867953985150717,664199474984166306,131072 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4972 --field-trial-handle=1728,i,6387867953985150717,664199474984166306,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2980

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2d51e6bc-ed8a-491a-aa30-94f9e1a34218.tmp

Filesize
6KB

MD5
ef68cb3c1c58ae8109655c9c9ed43941

SHA1
2998f6db46106c9dcb25dc9aac6388e414333afb

SHA256
c02232d7d910f2f3596eed6229c0e63ecc5048e2c4e25ab9e2e8d6974da50b5a

SHA512
8925f42f18532d373cf1b92071545c55067cfad9673580998fc4c31e9bf4efaec0bb8b082e5c9b9a5194e23a680adc5b879ed75ac86d6816bdba665f4c4aa099

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
96KB

MD5
f6b6b3340e69734b53f4b7dc1bef24f5

SHA1
ee367d09a0bf23f2c34fc6978a39bbdd03023fe5

SHA256
0cd1d0fbc1d7ad718431cb2487d86ea62fc951ccbf11e27e8f1716859fe51f5e

SHA512
9052b0e91795b31958e5f7e8efeb83c88e58b024834a4ab374eb8d930c5cfe89edf513ce17f50505cf7ad109652f55d8c178dd62f7c69f6f5a3cda2b3aa80c40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3777445e-a575-488e-9e65-2878b47fe803.tmp

Filesize
1KB

MD5
310aee1251d0bfc48c44b6a43d4b5be1

SHA1
b2f8f86067b214fadfb45dda405702012e47ea31

SHA256
2efe5aaf4c58918aba77a400d0957d58cfd3328d2c53cfa8ac7af4ac6cbe0ee0

SHA512
c5bc797c6dcca289a0627a27bd59ad7845250c7637e2a83245eae1e6397145204bb5b12bc2fbb572f540acc802cd1f72942c8c27967763c4fd9355ab03641731

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
682e3ee519b0a4e45384c5445af5f81f

SHA1
951692f00ee862b7f2ef497752c1524f4e145dff

SHA256
10368ee05cf3c4242e699da9d1b2e405887f676ab6c32a39b9a9a4572811ba05

SHA512
44522b5b0463af5aa74453c3d5a5eff9d1a092282ef557da06fae8c6049eaaefbf64e378caf9cdee8636c3fafd573d6c996c718d3d36364630a1b0008fb54408

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
736ae17c3b02471339a1ba7347469301

SHA1
1942e18972cbb4cbd3b6b4b9c1fc46e2848f7305

SHA256
423413aa1f822448cdbcbf5f19f0e2e765da06363b22574b10a8201ee7b37386

SHA512
c3889ab50afa82920956d8698436793c1e1e7f7d8353ee933a886eb010cf052c0244ba8f11b67a617f66e24d4dd76b402ac9f4b38f8e7e585dfc262d4e6ba669

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d6b3afdaa57517c9c3e18d5ee97f87c7

SHA1
249e954f906aa52acd8cee742425a5a219ef7526

SHA256
d30374a0d6cb1447f863282f496f02e0fce253f673816439d6d4f2c09209f783

SHA512
a9322efc6f38e82e758b24e2c19be5fb63583bca5febc1a051f944a7310d1334b615e88661a1f4aad8bc3b8884909a6888a526049bb0b30af413077cf6b662d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8bc8e76b0de086ae3323c230c7cfbef3

SHA1
e56a61450385306c350ae617e9c77a6e3d5afa78

SHA256
202f4bb89189e455eb3fa38c1004474891cda3bbbf3409824cc1c0a8494afe71

SHA512
9b119814dc8110b8e8412310f9ba3554cb2f8961573e388c0fb1f6e87d47986abaf84148d604ace1b8085b1bd55d343fb0f9ad8465a5c11b33721562bcc46ae6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
5ac2faceabb01e926a474aa8e8a693c1

SHA1
4915c8a3ca62506dcb956671ebd4aeafcba07d23

SHA256
7b54aa5cedc8262271f4f01ccb312cb5c8c7e02d8c45da253d6d64c629097c27

SHA512
0b2c71e6d1eb8c707d90c95bfb2d6ef1067c0884854f44becb4bec40fa518f1a3c9d0419d082fe3fa09f557b3c5af5a36e21a242b00067e9bfd8fe68730d5200

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
f6f602b8a3226e327b0b444b1fe6d7cf

SHA1
1bcb62d663dd00ea43e708b75872730b2e077c07

SHA256
c1ae5e69212f57885d34312782dc8cf3381b24244f8d827f1d2aad0234684407

SHA512
674eacb2f3620648964c7ac8802dddec438353c7e504c79161d4e7307e62c8f96ae9f1c37c0502318eec631eff24b4b9bb7fd3bfb9ca8c25961b49dfedd971da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
103KB

MD5
7020f09e997357ed97ff1b0e47240d9d

SHA1
f01a08327bf104e9322771316d7fe20a74b0d225

SHA256
49560f1af8fc2729692e84dfbd4fc6000c768c240360a10390b39a78552a1db0

SHA512
4d1a575e68dcbae1ef8d259c54200d22438a017e0a92c98fb910bf3e5f9dd779feaa45649da0e4c2a15ea77eabd0c486fe2d2f347027a724fbdab3b5e4d0a75c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58945b.TMP

Filesize
101KB

MD5
b74e0ca65792549d82f2a86e267a8055

SHA1
0e2b42fe954fc5c2b77a157c93d00aea1af1f96c

SHA256
dca219316b93e27a9f5884f415f86918acdff1cd1819f11e22e7780a644b4881

SHA512
2340461bb017bb7077916fd32e58f638c352530e1686685e2a60c85a589a8154fdf187eee453b0f231ad925782aef5e041e02e4405e76177011274f23dab2671

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit