hxxps://mandrillapp[.]com/track/click/31135033/llave[.]cdmx[.]gob[.]mx?p=eyJzIjoiQnN0dlU2S1FFN3VLT1FUMWRoT09XOE5XUDRRIiwidiI6MSwicCI6IntcInVcIjozMTEzNTAzMyxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2xsYXZlLmNkbXguZ29iLm14XFxcL3B1YmxpY1xcXC9SZXN0YWJsZWNlckNvbnRyYXNlbmlhLnhodG1sP3U9Mjg3NzQ4JmM9OUEzNTM2QjJcIixcImlkXCI6XCJlNjlkODMyY2FmMTA0YzRiYmM0NTE2NzA2Nzc4MjM5MFwiLFwidXJsX2lkc1wiOltcIjFlNjc2NjE1NmM2OGJkNGJlNzgwMTRhOTc0ODA0YzVmYWQwMjFmNjZcIl19In0

Analysis

max time kernel
296s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mandrillapp.com/track/click/31135033/llave.cdmx.gob.mx?p=eyJzIjoiQnN0dlU2S1FFN3VLT1FUMWRoT09XOE5XUDRRIiwidiI6MSwicCI6IntcInVcIjozMTEzNTAzMyxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2xsYXZlLmNkbXguZ29iLm14XFxcL3B1YmxpY1xcXC9SZXN0YWJsZWNlckNvbnRyYXNlbmlhLnhodG1sP3U9Mjg3NzQ4JmM9OUEzNTM2QjJcIixcImlkXCI6XCJlNjlkODMyY2FmMTA0YzRiYmM0NTE2NzA2Nzc4MjM5MFwiLFwidXJsX2lkc1wiOltcIjFlNjc2NjE1NmM2OGJkNGJlNzgwMTRhOTc0ODA0YzVmYWQwMjFmNjZcIl19In0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133494400303097083"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3964	chrome.exe
3964	chrome.exe
4588	chrome.exe
4588	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 3028	3964	chrome.exe	16
PID 3964 wrote to memory of 3028	3964	chrome.exe	16
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 1884	3964	chrome.exe	34
PID 3964 wrote to memory of 3312	3964	chrome.exe	33
PID 3964 wrote to memory of 3312	3964	chrome.exe	33
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29
PID 3964 wrote to memory of 3488	3964	chrome.exe	29

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc0ec9758,0x7ffdc0ec9768,0x7ffdc0ec9778
1⤵
PID:3028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mandrillapp.com/track/click/31135033/llave.cdmx.gob.mx?p=eyJzIjoiQnN0dlU2S1FFN3VLT1FUMWRoT09XOE5XUDRRIiwidiI6MSwicCI6IntcInVcIjozMTEzNTAzMyxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2xsYXZlLmNkbXguZ29iLm14XFxcL3B1YmxpY1xcXC9SZXN0YWJsZWNlckNvbnRyYXNlbmlhLnhodG1sP3U9Mjg3NzQ4JmM9OUEzNTM2QjJcIixcImlkXCI6XCJlNjlkODMyY2FmMTA0YzRiYmM0NTE2NzA2Nzc4MjM5MFwiLFwidXJsX2lkc1wiOltcIjFlNjc2NjE1NmM2OGJkNGJlNzgwMTRhOTc0ODA0YzVmYWQwMjFmNjZcIl19In0
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1880,i,6455181293747677483,10379730701198585181,131072 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2936 --field-trial-handle=1880,i,6455181293747677483,10379730701198585181,131072 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1880,i,6455181293747677483,10379730701198585181,131072 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1880,i,6455181293747677483,10379730701198585181,131072 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1880,i,6455181293747677483,10379730701198585181,131072 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4676 --field-trial-handle=1880,i,6455181293747677483,10379730701198585181,131072 /prefetch:1
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1880,i,6455181293747677483,10379730701198585181,131072 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3168 --field-trial-handle=1880,i,6455181293747677483,10379730701198585181,131072 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1880,i,6455181293747677483,10379730701198585181,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
ab70a6adcb06f545333b7363eec37d11

SHA1
574087ac78dddcc70f0fecbc92ae5da9446d1feb

SHA256
906403b8521f1307a98715b293d3f0d6047c91cce2fb604f4daaa16862b883db

SHA512
6a9dc0486a6f2ff487c14c097828e2a82f14275c6101b1d288a45fc7cdcbbb14865e1c82403c7317e104c83b387cfb7ab62d3b92a0c690d23fcf139a61283ac4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
1496c88f1fde8fb1302cafbe6f5a7efc

SHA1
083f032d26463280bd102d969a1d755519602504

SHA256
5fd098260a8a41ddc779ca23dacef94f20ff78675f6c2bdbd238764b0b9ddc4d

SHA512
0bd861099c9473ced3c03b101940a99f6b494f57756b163dacb7070b7b73ec705b667f9ba9229b466197ece5370c52fb955b0df0afe12c60fd7a592315d49697

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
1cd6fec09b2338f0855bae1a81a7516f

SHA1
2f8304e5c079ca6cd698727363fa212514c470da

SHA256
ecfee9ab8d6f0ae1510a5bab35082134dd5a0280f479a9660eb6cba6aeac727a

SHA512
263ac849ddd2aede1ef0df8646448fc0d710519563a8bd7c04c542742f11be70f588d398296242502ee40830d642968b6371f5b5f79f1e123b368febeda20335

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
706B

MD5
2af3c3bd70cbf2bdc3bfea84cc5f4b70

SHA1
490b07dc22d5bfb8cc951c2ebac035a7f0d3e9e8

SHA256
0ec4477c16ac5054b46988a06d884e378c98ce7e7c70e76084e0e8dd2f230e1a

SHA512
7a20d45eefb4487b49f6eb773c62d2e5fb995f64750f06983303385c96393bb6edf7883f6728caee3b06bd9ff9eab9e7d79c591a861108022bb1252dfa69b380

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
873B

MD5
c1b7c1e35584f7bde7ec4b734f40b577

SHA1
bc398b0b29632655e4d8a953b1cfdbad3debf27e

SHA256
ad40348aff5fd037b8208a469703a82465be6b096a4006395d032505e6720f9d

SHA512
4472676bfde447a2f70e09ef9b40e4b4a6d126c297c07173538164777c58b0d80137f89f2d1eff88ca9dbfa9e2ba8b6c5c9922b269af9d53c46a4a22a36a554d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ef5038b56d57ee1da5135a784d64b668

SHA1
388d53ebda0a45fb88f35f8ce3965e34cd6e399f

SHA256
dfcd12135a6ed402895b95a8e08de41c9d09c3ab058673fcf7cf4dc8ee11d027

SHA512
fe7db49144037be85df7565b6ca75a59c4ac44430b500950f68200705427403a6ee76de97a08c19290b6bbde3d6bb4fa84a84c4fdfcb8268eec175f649cea67d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
85848f56df17e6136a34196314473603

SHA1
6f35809af78deea5ac41a84e5d99127a66a68577

SHA256
5cacbb8ac4fdf20f63653c0d7089645769f0b3ddbc551800bb254a355c5e2fac

SHA512
a6eb4578420ebf9b0aeca848ea05649e575b5e3d5d188ad116b30af69bf8613b2f7482afa2960a878a24561e249d5f8c7c808640fb81645521f31b296bbdb84b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_3964_NUWLZQKMSQTNHDAB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit