hxxps://docs[.]google[.]com/drawings/d/1EqOh5yIttLejR3FMx8VDfteOKOn18MpVDdJaHlg8RuE/preview#L7EngXXlklu0R8PaJy1yT2E

Resubmissions

24-11-2023 21:02

231124-zveg6sfa5y 1

24-11-2023 21:00

231124-ztrq4sfa5t 1

24-11-2023 20:56

231124-zrc5yafa2x 1

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2023 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://docs.google.com/drawings/d/1EqOh5yIttLejR3FMx8VDfteOKOn18MpVDdJaHlg8RuE/preview#L7EngXXlklu0R8PaJy1yT2E

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133453330177440107"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3644	chrome.exe
3644	chrome.exe
4852	chrome.exe
4852	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe
Token: SeShutdownPrivilege	3644	chrome.exe
Token: SeCreatePagefilePrivilege	3644	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe
3644	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 556	3644	chrome.exe	83
PID 3644 wrote to memory of 556	3644	chrome.exe	83
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2008	3644	chrome.exe	85
PID 3644 wrote to memory of 2540	3644	chrome.exe	86
PID 3644 wrote to memory of 2540	3644	chrome.exe	86
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87
PID 3644 wrote to memory of 4456	3644	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/drawings/d/1EqOh5yIttLejR3FMx8VDfteOKOn18MpVDdJaHlg8RuE/preview#L7EngXXlklu0R8PaJy1yT2E
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa03d19758,0x7ffa03d19768,0x7ffa03d19778
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1864,i,17639206900060671697,5285204804047537534,131072 /prefetch:2
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1864,i,17639206900060671697,5285204804047537534,131072 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1864,i,17639206900060671697,5285204804047537534,131072 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1864,i,17639206900060671697,5285204804047537534,131072 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1864,i,17639206900060671697,5285204804047537534,131072 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 --field-trial-handle=1864,i,17639206900060671697,5285204804047537534,131072 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4320 --field-trial-handle=1864,i,17639206900060671697,5285204804047537534,131072 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3032 --field-trial-handle=1864,i,17639206900060671697,5285204804047537534,131072 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2644 --field-trial-handle=1864,i,17639206900060671697,5285204804047537534,131072 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5016 --field-trial-handle=1864,i,17639206900060671697,5285204804047537534,131072 /prefetch:1
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 --field-trial-handle=1864,i,17639206900060671697,5285204804047537534,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
186KB

MD5
9f61d7b1098e9a21920cf7abd68ca471

SHA1
c2a75ba9d5e426f34290ebda3e7b3874a4c26a50

SHA256
2c209fbd64803b50d0275cfd977c57965ee91410ecf0cafa70d9f249d6357c71

SHA512
3d4f945783809a88e717f583f8805da1786770d024897c8a21d758325bcd4743ff48e32a275fe2f04236248393e580d40ae5caf5d3258054ea94d20b65b2c029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
b5553d40a3ce6489f7a6c16ac0baaeab

SHA1
effa5aeb87845a797cf461e06e137c9337db10a4

SHA256
3d424b1668c6fc4ea57ee8b03ad8138e639b4a18d889c1dddb47563f5ea4f26f

SHA512
f52ffd41d3a501f7d66b8df56de3f8f8696f26a1c1b470a03a67972ef504be45abdd47c310ad5a8f2acb076c0ab1bc2980425300924989ab2b6977961e764161

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
01a2b25bdff91a3924104db6e60f30a2

SHA1
4623de887884ce01085c3d341dccea7f8fdaa22d

SHA256
f52a33e7c3b0c76ecde23323c33605f90b298a4e1e0cf2d2d4cfcb4ddce4364e

SHA512
74940df9e3dcb5b8d916967090feb847b69e348ae56d71c57a3effdf2e5bfe03753204405046756ab4eb6d931a9fb5d854634e7b822713c7bf5e41ac59d237a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
21788f8905237d7ea4e4c73b7cd9693b

SHA1
92ba162bacc533c8c51ad87c2b8345062d5cd374

SHA256
b48e736b5df87e8107376090d7d69dc682a360e9daf3f8113b418980accffa39

SHA512
ee216c1d664558a3ecbdeca815aa1a7fd13e0d08e6488b2da07a5bf0e338e6fc9ba9f57aaab2a31a3f2fee59f2a84627dc1305a12bbbe8d3f27e93f25100047f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
5bf9a3f2bd3a566b201a3ccd4bc6c0d4

SHA1
e927bcd2d777bfcecc5f36bd33b9731ab0d0aad5

SHA256
c077402985472c2cbd5fafa414de372154f33f3977b467958f24f74878a83df0

SHA512
c24638c0fd664d4bce7a946014eb9815247400f93b9f71762564be224c05fd387dff5e525668b7230decb3d4250d062a3e79fb8ccb969dc642752bd2dce8570f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
a6aa3b89c33f9e0b0c36ceffe452f8a6

SHA1
954d04440670daec4d3e532bbc345e9a717ec66d

SHA256
adabffb5949305071b679db0b8ed5b328fb4c76235419982987d3e6e162dcc1e

SHA512
89d3f6552e06b5fdbb2f8ac07640cbfb49f8428f4ac44bf196c953bc807bfbcb55bb3d3b0df9c4b0bcf05966406c2d595b8cb00f9bb8a01fcff2f1da1cbaa1b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
883b6117a3d5ab0b0b48dfb8398612fb

SHA1
a19169820a5c566b0ffcc153530bd38a2f86263e

SHA256
4192c0fcdf22e6d265241b85048b05ec4bdb999634b3f36234fb50d58c836ffc

SHA512
d5a58175ca350a495c50272e42e29ac3a3ddf4b8a6b553c19de21b37cd50ec526003dcfb768abc301cc9f0a39628b2196d249adf4fa99d832530ed1983c6c872

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
efcc6c62716d35376268489c0ab84115

SHA1
9711e89989dffe9d53a8fd0c5d10ad36638f2886

SHA256
14515ec77b027c623c27b20fce90d8be7c5f3fa57d9e5aee0eac5bf7fba97fc4

SHA512
88c59fa8e58c98d62f6f69d0bae4963df71d4d5234943bdf8d14ef28cf4ed5342827b18c32ad9570b9c292c5ff3f620fb671805b7e16e036aca03c26bb2e1027

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
458f1974cc0ba464486534fb024d1051

SHA1
c1e08e57418710f223cd3bf0214e1dd08b784123

SHA256
0900a0fe476c5f937e212e87a6b058a9a1b9230bbf6ef217f0d0ca1611b68f69

SHA512
b0b8579cf032a53ae6995fcfdc1659cb690de0ae028d0d14106d6674df33b7093e81fc040a3f34a52e4ecfe3c36392aba0b46824e5e17def26e8ad101466018b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
57abc04e607ffeaaed0eee8556fb15ed

SHA1
0f2f04027783748392338764b6d2d3f1aab3c34d

SHA256
9fdd1dbdb94f5dd962564d581b36a0a9726920d311094bfe9a38baf3f699f3b3

SHA512
f03c83ed186e43a16630b641c0d6464f7ea92fd483b854cf1d56c53632cd0ec3c6ac032c7741854e4b0987ee24e89c8b6928dc6dfc99896c72cf7578a943b225

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
b1842752f87fd446161bfd849bca4c30

SHA1
0d04b3b6ae28adaee2aa5dbab27042894589ac83

SHA256
55a7952b2963440ce32f0a09bd922621f083613538ce6ba8d1bfad0c911c3e66

SHA512
3d4ffaedd7f2277600e4dc735432359066d7cae25bdf6ef6d82b0473d0b794e359529da22a0a383feee3e3734b1722ba0dd305e3c193dd2039ef7ca8b2225142

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
109KB

MD5
1ff2396d8e3c391ce6e234a114725ac1

SHA1
367d9347b17c7a56b0ebe04311f2da6c31510379

SHA256
5d12c636edf11c5f3fce63c9ff8f15cd0436e94a109adf0a3201bc9d6ccc0fc2

SHA512
964761de170c8fe49163044e2c108d6f51327752f9674f568b3859fbb6046ba4a869dbb19b27f5da7eaeda29a65d72acaf07332edf20911364e4aa7c4f9f3018

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit