hxxps://customervoice[.]microsoft[.]com/Pages/ResponsePage[.]aspx?id=9l9weTOXykCKUe0k2VXSUVTaWn7xzCVJpHB_dARoKGpUNTVKVTFXUzZIMlBaNTJRTVM5Qjc2VU9NMS4u

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2023 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=9l9weTOXykCKUe0k2VXSUVTaWn7xzCVJpHB_dARoKGpUNTVKVTFXUzZIMlBaNTJRTVM5Qjc2VU9NMS4u

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133464668313084564"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

784 chrome.exe
784 chrome.exe
4292 chrome.exe
4292 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

784 chrome.exe
784 chrome.exe
784 chrome.exe
784 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe
Token: SeShutdownPrivilege	784	chrome.exe
Token: SeCreatePagefilePrivilege	784	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 784 wrote to memory of 400	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 400	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3588	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3976	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3976	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe
PID 784 wrote to memory of 3432	784	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=9l9weTOXykCKUe0k2VXSUVTaWn7xzCVJpHB_dARoKGpUNTVKVTFXUzZIMlBaNTJRTVM5Qjc2VU9NMS4u
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbc7cb9758,0x7ffbc7cb9768,0x7ffbc7cb9778
2⤵
PID:400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=2040,i,13620814524082005725,16692307180169387922,131072 /prefetch:8
2⤵
PID:3432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=2040,i,13620814524082005725,16692307180169387922,131072 /prefetch:1
2⤵
PID:3384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=2040,i,13620814524082005725,16692307180169387922,131072 /prefetch:1
2⤵
PID:4944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=2040,i,13620814524082005725,16692307180169387922,131072 /prefetch:8
2⤵
PID:3976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=2040,i,13620814524082005725,16692307180169387922,131072 /prefetch:2
2⤵
PID:3588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=2040,i,13620814524082005725,16692307180169387922,131072 /prefetch:8
2⤵
PID:3892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4556 --field-trial-handle=2040,i,13620814524082005725,16692307180169387922,131072 /prefetch:8
2⤵
PID:3424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3960 --field-trial-handle=2040,i,13620814524082005725,16692307180169387922,131072 /prefetch:1
2⤵
PID:4296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5780 --field-trial-handle=2040,i,13620814524082005725,16692307180169387922,131072 /prefetch:1
2⤵
PID:1492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 --field-trial-handle=2040,i,13620814524082005725,16692307180169387922,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4292

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2896

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
312B

MD5
06547a0f6bd9a7787f8effbb4d199cd2

SHA1
a436d252e31e4b6682976ba127b1d4f8dea2278d

SHA256
3271e30bd3f789cb1995c8753925d86ef68168d283211ba367ee3bf067f3431b

SHA512
2e2c1df3a512f89947ebccb0cd65ef0b7a75be60bceff99c96587593e1a0c744eac202ebc44cdea3376f564983c90a44c3852cdc71c560f6c3a75464b390d845

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
e3f49c7436eb7e4d0d1ad9deecbbdefb

SHA1
d5b07c58f8dfa814f41263028a37a4d52988cfe8

SHA256
41bb8550e6087870538e950b0fc1af537486b1514f99b1b6d8c92af0f9fafe97

SHA512
6c35974c8223b71e936e159312b5dc5dadc1b9462241c2aa3cf60c15538832bb994fbda9817df8d5a4e16a19f0874cc0678b7b01f5cf66f07f4d6646fd86325a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
ba101d1d17609f79e3f4b96bc75879bc

SHA1
19c90af6552409eb4b1fb6421cf2ac1769d2707c

SHA256
f78a40b6c926d0e861947785d62a48f05cfcbdd0c19ee90d358a2bf1c6b66201

SHA512
fd32ea9f55b5ce395857af3680eb773d1497d2db2f63d45104f4aec937e7eb530b34af74b8eccd8af1c025b51830e8d66474c94e6f11ca430d33f19dad29fa85

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
866B

MD5
ede2fb2d5ae4d7a73bf20b57dcbfd84e

SHA1
c632e40a933eb9c4ca196a85f6b11f29681d5636

SHA256
da0790a9fbc9eeb417226e8ac40fc07b1d668002d9e59ed503b1b9ab165ad423

SHA512
a201a5faf556de1914e6e41cef7584b0523ad149abec28d9e13387d2995b8eda78a74ce143590552ec0d8d12d6819a4e7ee334e1f7ec2e842e733315c4bd36fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
701B

MD5
b1dbbbec8e22713d847bbafb21e2cac0

SHA1
68d272995b37b47138bc8d7564643b71e1bd87e4

SHA256
95acc64210c25721e91f2f8bca35ca975a7e4f03bcb0119357605ba9a57fd31c

SHA512
1cc1afa63f639a87e89092e5d07276e6bdd4b7da6d8112c8a0c4aba5dc4bd8bf4cb8ed0aa8f993c3f6fbb6d73af3a26358be8a815be5f0f6784e5133ed55a0db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
33507f8a389aa8e9141ea7667be62c0f

SHA1
7b71e5cf7e7d63c004d98b93c3a28617dcc5887d

SHA256
040c14ef60ff066939b0f6bfdbdb9a5602453378efbd2db087788d97e2b80fa9

SHA512
511653f6581ee9d463bda7b1bc1ae2ec73ba808e1964b1019f47e3be48041953fd28d01bdff31a08d768e17e5548dc3f1fa5c0bf9029db1f2eeda27e06a6e1fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
573758662db07a72bf6909bbab902fe7

SHA1
1feeb19c29a9191e14ced2c4e082a7963a30e563

SHA256
543d0a993d7c889a24d2f2478a2b2bc520fba1f8857ac7c910fdfff0edd159fc

SHA512
981ae39f7f457d9ebfde477e60d324b43b7eb74cd0a8715bf9e82b8e681f8a3f20541056122e52c020569dab5d1efc472c3a960497eeec870abae17a0726a625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
115KB

MD5
6f945cb0da96bf39ac188fc68872da07

SHA1
241360a384228a744231d454c0e7830a01d888e8

SHA256
0cc1f8fd72f82d5f7621d6b10e624a55d822c833935926a0d92a07ad7681789d

SHA512
68c70191b6b41aed64cfdf2a70ae5151ebdabbaa13f250790c059e55a1d10b6812ad380e6735a9301fc652b243a56f7c0ea78b988a4d43e3e975a09519a30091

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_784_PNOXUWYTKFANYQTU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit