hxxps://links[.]email1[.]menards[.]com/els/v2/ymmVc0aXw4tj/ZjJOTTN5UmJtdFZRbU5iQzY1a2NEZnFSZ0VLZ3RzZ2pKdXozYTVqL2s5UnBScmtDNmNVYmV4cy9DenA0ZHdUYW1wem9vRll1RFBjRFI5YUd2T2I0cGVsR2paQmRYR0V4RnFuNlo5VkM1TVk9S0/Y2sycUdBTUVRWlNCL0Z4aDZjUk91a0RkV3FJeEtVSGo1MEgrQ3IycVRZMWFvalpXc2lzQmF5UnMzYXg3a29kbVV5NTljWkJVL2drRjE0MnlZU25lQ1FMcktQN09SbFVaS0

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://links.email1.menards.com/els/v2/ymmVc0aXw4tj/ZjJOTTN5UmJtdFZRbU5iQzY1a2NEZnFSZ0VLZ3RzZ2pKdXozYTVqL2s5UnBScmtDNmNVYmV4cy9DenA0ZHdUYW1wem9vRll1RFBjRFI5YUd2T2I0cGVsR2paQmRYR0V4RnFuNlo5VkM1TVk9S0/Y2sycUdBTUVRWlNCL0Z4aDZjUk91a0RkV3FJeEtVSGo1MEgrQ3IycVRZMWFvalpXc2lzQmF5UnMzYXg3a29kbVV5NTljWkJVL2drRjE0MnlZU25lQ1FMcktQN09SbFVaS0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133500847271643452"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3073191680-435865314-2862784915-1000\{E08F7870-86E8-453D-B3CE-9047D7A9010A}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
2368	chrome.exe
2368	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2584	3480	chrome.exe	85
PID 3480 wrote to memory of 2584	3480	chrome.exe	85
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 1120	3480	chrome.exe	89
PID 3480 wrote to memory of 772	3480	chrome.exe	90
PID 3480 wrote to memory of 772	3480	chrome.exe	90
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91
PID 3480 wrote to memory of 2436	3480	chrome.exe	91

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://links.email1.menards.com/els/v2/ymmVc0aXw4tj/ZjJOTTN5UmJtdFZRbU5iQzY1a2NEZnFSZ0VLZ3RzZ2pKdXozYTVqL2s5UnBScmtDNmNVYmV4cy9DenA0ZHdUYW1wem9vRll1RFBjRFI5YUd2T2I0cGVsR2paQmRYR0V4RnFuNlo5VkM1TVk9S0/Y2sycUdBTUVRWlNCL0Z4aDZjUk91a0RkV3FJeEtVSGo1MEgrQ3IycVRZMWFvalpXc2lzQmF5UnMzYXg3a29kbVV5NTljWkJVL2drRjE0MnlZU25lQ1FMcktQN09SbFVaS0
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c6ae9758,0x7ff9c6ae9768,0x7ff9c6ae9778
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1876,i,14154112604451828891,14867497359526842663,131072 /prefetch:2
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1876,i,14154112604451828891,14867497359526842663,131072 /prefetch:8
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1876,i,14154112604451828891,14867497359526842663,131072 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1876,i,14154112604451828891,14867497359526842663,131072 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1876,i,14154112604451828891,14867497359526842663,131072 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 --field-trial-handle=1876,i,14154112604451828891,14867497359526842663,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5176 --field-trial-handle=1876,i,14154112604451828891,14867497359526842663,131072 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5584 --field-trial-handle=1876,i,14154112604451828891,14867497359526842663,131072 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 --field-trial-handle=1876,i,14154112604451828891,14867497359526842663,131072 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1876,i,14154112604451828891,14867497359526842663,131072 /prefetch:8
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2576 --field-trial-handle=1876,i,14154112604451828891,14867497359526842663,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2368

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
a91277e9e9b4e1143a17c351979416b5

SHA1
9a3d37d5cdc742bc6f68b6039294ae99616d8f06

SHA256
e637f2ae7c43ad620ba51e7fc00d2ab3b97b58721d1f403a94deed858643d599

SHA512
ddc08013a1c79a88d568a9e47ebc16c3054e62952b5fe9b9adab57b6ad4b5f80cbe591a82df35dc2a9aee35796373c4cb05eecd9df08d7c868e2782af01f6913

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_services.sdiapi.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
24ddf9a9b96b5da4c990499a59ab2f89

SHA1
8a1ccb9f3af2c72a24b35dc20ff814434cdbc481

SHA256
0c68b67385593cbf7dae8378da53c1478ce1e219b146b22efff0f438339eee20

SHA512
774ce4ce82575eb03fc73304def42178ac9dbe5a82b8b855624069eebe648254f5ba5f055b2d013be409035f2de5c58a936621379a0eed29ac4cc40cb1b7cb78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
871B

MD5
5a265f62e8a1b365b909fab084b91969

SHA1
af6027c2e334ba98bd341ccdb474601f57e0d34c

SHA256
3572610e6ee68068c6701f435e47828ce5c1034ccd834afa8125ed5b429a7234

SHA512
d6a2f8b5616ba45cdfb75e7bedbac5bf2d586bb44c00ff09a906a32fac30f7ec73fc29e19d29fee9d19b2b432548f588254d1d4e15ac1aa5f54c961addb732f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c6892c6d5696772b71f746fc738feaf5

SHA1
cd38cc0d43ecd101967dd37e1f8985bd491d4bff

SHA256
8f933baf10b3e52ee01f4475d2025772b13b168affbc53a8b5a9eda868acffcd

SHA512
034e464f5f3575e2d761cc1162ce92e172f70fcfe882d1888cc3ad394d4adac11dea8a3aadb3ca11255e85345a65eab85566b3aa973862747a7a47ebbe6d1fbf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b7fbd92378203dffc9ffe406bffb7007

SHA1
1c70b18f8032c5f67b74c25a4720018481d827f1

SHA256
757b769a062ecefd1085e4febc766c25663d04770dabb209c2447307f49db9fe

SHA512
44558f1f5b34765c587d2910b8e70fe4655bee9da4291a0d7f8ed71cc9cd405d6f6cd8f53bdcaa831e9312e999a778a8dae5a75bb6069ed708e10e2fce514fde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5207c626694154acc153ffd11efd56c9

SHA1
0b3e1ff34274597124d094d52ec13cb55f56508b

SHA256
92502405a6b3bc733c821d6cb2ecd4cb3ac54c498d6cb9e500a936f97ce3cdc5

SHA512
59db0f8392c5b68469ee3f25815fd46b0b5235309a7a5d90ebac6a7821aeec1682aa2a38577505b73b5070d4517be9fed3750596d0d6c403ad68fc46ee4a6435

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
9cfe370a87e2945ead74dc144827d46c

SHA1
be096ba20a1d913925dacf872127b144747e4bed

SHA256
08835de2d235e71e4e58348eeada98c482807d562d10f1645b8e5485fca38bfb

SHA512
1d3b95fb2b9d671a84abe9bd84998f51dcd12cb9cff0147f4e32a5af0684f56f1a43bb20dac7bf5d04f2ce904beed483ccfd2c3540bea9d887801ca6edf3e4b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
d3ff3c3d6820fc3ae76b28af0e1605d0

SHA1
97533d73cac2d1a0bd7e5fd1963c3f7f3b35df56

SHA256
2a6d3b3bc76ffb8a826bfef8b2a3a52d49f485541f8c10250816a7dc04439134

SHA512
7cfebf61131a32262384ae48aac53f1975b46f6fe5fcccecea27ae95a09c46d10caffd1c4410be8f572d20fd841a03c88083921a18a8bfe206eea4135ddcad28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
96defc40eeaf2b3c438c6a614bd006d6

SHA1
fe6a8197916dc53ce0aa28dca388d4262c5b475d

SHA256
cee1bbbb68f79165d2217a77e54667cda7d622123ed3954020aedc917cf3f1bf

SHA512
ed5785c3c60af96e88833754bbc607be5c290f4b8b375bbc0d1a62728baf899f8866ab88cdc3b580ee473f497592bc90bfd5d70f216b7d0fe037560d0162b16c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit