hxxp://gax | Triage

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://gax

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133496881425480182"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
5252	chrome.exe
5252	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 3052	2484	chrome.exe	76
PID 2484 wrote to memory of 3052	2484	chrome.exe	76
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2312	2484	chrome.exe	90
PID 2484 wrote to memory of 2880	2484	chrome.exe	91
PID 2484 wrote to memory of 2880	2484	chrome.exe	91
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92
PID 2484 wrote to memory of 4848	2484	chrome.exe	92

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gax
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1cff9758,0x7ffe1cff9768,0x7ffe1cff9778
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:2
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2840 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2832 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4340 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4320 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4784 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3940 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4660 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3200 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3364 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4612 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4684 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5444 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3712 --field-trial-handle=1800,i,17321599431553797019,3329320548377572949,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5252

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
dc20184289bac88a1d4c691fbfcf96a7

SHA1
6f63b764afdacd73924abc42c3d3090c491c6e69

SHA256
e79f66f6dddd4b403ff7d4cbab425a22a46cf9445665670b1891c3c74bacc27d

SHA512
690dec971b28c6c21410f469830268bb1828f34bca247fa07e527a453ec0385306901606e1b6988a39b1179d4a9fba57da38e3afa558d631d229d172b833c952

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e3afdacd8d28a7d808ae74a8b4286814

SHA1
6fc73b107fb6eb42a52ca611ecd27134e4502010

SHA256
eb436feb32d048eda717800827d98295f754e69b0b0292813f4c6846f4eb6c4c

SHA512
7e499a588749b5e799fbfc02b126b878b386317c2ab8aa6e78676096e905bf65040b9fd605474743368d0245fbe4167b73ba17958e7beda1ffe8058df809b6fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
4b6f1416947f50599a2f6f26d568f12d

SHA1
427ab2bef4db5b113476513e76c4cfa7c24f29ac

SHA256
b156127da03c9581505e064484f483b7e20bbdf8892006ea63ddcdb79fae0e19

SHA512
6bee3db699fc762eab0e5c44c9c16e815ae86b3abe4d5efd94ae2214d918dce08fed37f453a76c8cf477b2c05d5134eaae8609c762eb9946a4f4a8903d1fb316

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
369B

MD5
f384108749e648460d1a054a8994d8e2

SHA1
dcc16907134758bc141bf17bac091814d1bbc22f

SHA256
b36a373b23a7cafdabbdea3c48e482fda82bf1a3fd09fbade99791168890a172

SHA512
c4421d4322ee81dc51439267dce2f3bd664a04dda81172e2779f5af6d0129940457806922d3f351f1fa3f1664f1aa658bb923552f4fa458197c1c8520e4b2216

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
5a82d7b53bc13f7b9dcf363e1ecf2354

SHA1
7330d6fac7cca99ed7d61d9d30c93cfb349e5e20

SHA256
819ce6ce1896a184c8ce1bc2ecb9e0d1a2d7a5cf1559987393eaf774f3a28c3c

SHA512
161747aefc40caa56713adcb35eb3e384e5f124ead6be2d4e2c75624bc242da5b8b9c62ea5ebcf087be895a5ec2d56d8e8e2a61e58685930cb556643f86100fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7cc4f0010768b69ca3028c9e7b6d92c7

SHA1
5186d82fb0ff6f560f3a08d84633e07b5be2924a

SHA256
a9b8489531db162973c668ad650745abadb76ca91fb86c51a26d4d0ed9b5d41e

SHA512
34bd4b2792b92f68a504674e92fad67eb23f55f782a9a991d4a2064d50168288b29914e8c4e667d964e1c579ad664801c2e6f48f6896bbdab01f773a958843bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a13019907e6f7c047de9f4db46f73069

SHA1
722f25a4a287523400d2fc97fc596e130770b1ed

SHA256
225d3cfaa5e90d2e0ac91386e145df01b67a7d8a052a2081288d0b444475401d

SHA512
c8fa08139f6377070d6a1ea9243801df2c891e60447333806d7a0465f10e52521ae3283f784baf97633bfca68aa69931823061cdbf5fb820b05088b1d72cf125

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
55424a08754f0d18ebc997684e74a463

SHA1
fec4af37c791302d93ac1200cc6d80f8366413e3

SHA256
dea7931a40c065877838cc0dff792f4aaf2c75a90cd9f68922968babcb6e5fc6

SHA512
62327ed6acd73d8046f3d21f8d51ce595129b52a345acf355c254266e3b41eb9f1572f4594bd483864300ad1ddbef80ee3b5ed39086f732d0fbcfaa4120e7358

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
fd0e4d2f4b3cae8668cbcfc7d7b157c4

SHA1
93d5df891ee04f52183ebc9c198c397b0910144b

SHA256
f11ecae83c8dd504c1629feebafec3b44ff4083d540b288111b676f09028a020

SHA512
3b58c1610ff55bf08112a7c34347d0c66ba8332ad0b1630ba46aa02f147d48f46cc24b6093d07f09954e8d60d41aabd419b9e6ac9d787a5957674e71fb39250b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit