hxxps://r20[.]rs6[.]net/tn[.]jsp?f=001FUXmGedS_xPfk-w6WpzsexR_ZxYdVBgZESgN1EZ7t7LmQIRydzCgkrALXmZKDucpRFKtjo_35rvYy5YYl1W7JcAG9C3IpBFS5Ie_2zuuKPWbIlZ0EuC4aAlZm90mce8E4NaiV-NbL3MDE89h1tvPmeGpcAUNPPgrNh20ZfwbAxTX6ZIkAE4jOuQQsmvEspsUQXm_ueXfGctKobT11HCDqsKDTdKn8hXOnxjARMVdHDHCzOi8cCTD_w==&c=kvrbIzCDhB9g5lrayUcpAOBx8MYfTy12eD9c_HVxhRyMoBAHdOd3-g==&ch=akXoIAWDONtj0lCQZ-I0y7Zr2t8G25M8-fG_rNj8exit0NQ_OoOnMw==

Analysis

max time kernel
300s
max time network
304s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://r20.rs6.net/tn.jsp?f=001FUXmGedS_xPfk-w6WpzsexR_ZxYdVBgZESgN1EZ7t7LmQIRydzCgkrALXmZKDucpRFKtjo_35rvYy5YYl1W7JcAG9C3IpBFS5Ie_2zuuKPWbIlZ0EuC4aAlZm90mce8E4NaiV-NbL3MDE89h1tvPmeGpcAUNPPgrNh20ZfwbAxTX6ZIkAE4jOuQQsmvEspsUQXm_ueXfGctKobT11HCDqsKDTdKn8hXOnxjARMVdHDHCzOi8cCTD_w==&c=kvrbIzCDhB9g5lrayUcpAOBx8MYfTy12eD9c_HVxhRyMoBAHdOd3-g==&ch=akXoIAWDONtj0lCQZ-I0y7Zr2t8G25M8-fG_rNj8exit0NQ_OoOnMw==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133504757055279367"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2944	chrome.exe
2944	chrome.exe
2248	chrome.exe
2248	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe
Token: SeShutdownPrivilege	2944	chrome.exe
Token: SeCreatePagefilePrivilege	2944	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe
2944	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 4728	2944	chrome.exe	56
PID 2944 wrote to memory of 4728	2944	chrome.exe	56
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 4588	2944	chrome.exe	90
PID 2944 wrote to memory of 1744	2944	chrome.exe	91
PID 2944 wrote to memory of 1744	2944	chrome.exe	91
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92
PID 2944 wrote to memory of 644	2944	chrome.exe	92

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://r20.rs6.net/tn.jsp?f=001FUXmGedS_xPfk-w6WpzsexR_ZxYdVBgZESgN1EZ7t7LmQIRydzCgkrALXmZKDucpRFKtjo_35rvYy5YYl1W7JcAG9C3IpBFS5Ie_2zuuKPWbIlZ0EuC4aAlZm90mce8E4NaiV-NbL3MDE89h1tvPmeGpcAUNPPgrNh20ZfwbAxTX6ZIkAE4jOuQQsmvEspsUQXm_ueXfGctKobT11HCDqsKDTdKn8hXOnxjARMVdHDHCzOi8cCTD_w==&c=kvrbIzCDhB9g5lrayUcpAOBx8MYfTy12eD9c_HVxhRyMoBAHdOd3-g==&ch=akXoIAWDONtj0lCQZ-I0y7Zr2t8G25M8-fG_rNj8exit0NQ_OoOnMw==
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff921bd9758,0x7ff921bd9768,0x7ff921bd9778
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1860,i,13587203369654040505,4839765109501370495,131072 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1860,i,13587203369654040505,4839765109501370495,131072 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1860,i,13587203369654040505,4839765109501370495,131072 /prefetch:8
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1860,i,13587203369654040505,4839765109501370495,131072 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1860,i,13587203369654040505,4839765109501370495,131072 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4924 --field-trial-handle=1860,i,13587203369654040505,4839765109501370495,131072 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3256 --field-trial-handle=1860,i,13587203369654040505,4839765109501370495,131072 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3952 --field-trial-handle=1860,i,13587203369654040505,4839765109501370495,131072 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5392 --field-trial-handle=1860,i,13587203369654040505,4839765109501370495,131072 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=1860,i,13587203369654040505,4839765109501370495,131072 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 --field-trial-handle=1860,i,13587203369654040505,4839765109501370495,131072 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2712 --field-trial-handle=1860,i,13587203369654040505,4839765109501370495,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029

Filesize
201KB

MD5
c445ab4315d0633d446998c80764cc36

SHA1
47d3dee9845cc6e29b6771dd6560793b8b93000e

SHA256
5635695eeb70b51c449aea7a5bd3c9699c3c28c64498fb7fcb8173aad45d7242

SHA512
83a32ffdddf3ee56e89f232c8d05a4b00265895b0e41d13700f90fa389f0bf3f112c291c24c3819751803322b11e2ff866971d835d601672b36818c4e099bff1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
7127457cf905ecde5177afbf838df51a

SHA1
b2554c55027bc6faa1a79d3a18b6e7561ce8e483

SHA256
17991ade1fa6215769cecf57dfcc06879f40e408d42803befbd2a99fb7956a29

SHA512
9f49b0232d7a9914e4a178c34d6b520bf9a7c7497c8bf9ee73d1cf5687f6ae2d8671227ed0a56c9e5877ffa1eb57ec556e7545cef65fd79e397467e9a3384892

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
0c7815ef92e9b760e3b504e8888c1809

SHA1
65b4efbbd49b997e63229d4e3209121f21c449e3

SHA256
95812d31e734dd3e6e54a850c0538349f2db85393aaa9c226ba349957e3ef73e

SHA512
8e8ce623c21401bbeced850018db748f57c97aac2716da9056fcdeafcd987a1584ed822f0212aa165777923280ee68e4cc907da6004f59c56cc0e0aed9cd3dd4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
e7d05a284d742a80b1dcfd2184c9de9d

SHA1
93ba9f60c8a370bb3b3047f5b8f4fa5bb0a74174

SHA256
c7c66c18d8d2e22ebe0dd64839a5b592cfd06bd8ebae250753e47aae1054979c

SHA512
c33ac26aae168667f0ae063f09c7e7125ac2206e716e4dee9f9424cc2b732bd3405502fca0539663b258e68ff4c9176b3593849221c3981704d0c8ee04446c8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
889e007d5b76cea0189cae232421ee52

SHA1
c5baa10f76cbd055abe69d6fe3543b9ec83c2368

SHA256
c7d0db3e3f7ffd91194d910554ad9b341dcb1c4228c2cbb053c7095104504ea0

SHA512
e561ba31ea6bed089299f89b3b0539604106afede3480ed6d51d6fa211cd06b5a8b4acf8d3f5f3587837d6d5ad816e1466da2379c575e5dedbd1d7bb16271f17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
c6e951ead31f1748c3d71d1926eef5ab

SHA1
191b38f6d7080bc403d49504ce6d26da1e18545e

SHA256
1dda4265750ec7e68d10b3d195cab2f22b64fcd79de29b74ef7e58cf4e94edc7

SHA512
63105a2bbc5e553f54c347a981cfa925efc1c7662c5423d03920e2dbf4453ef691023e0f72c00b2eaece0f3a71e66768a78b875635e9b8d7a0ad6989dfe7aecb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0b9392d96fbeeca2e95cc2f4976c1d8f

SHA1
b496ec934a296b7157f2982ffdf124e4b93e28cf

SHA256
35cb1994e936c5ae5fb8fe8f8687174cdf95a4a2a63e2c95f81fd9033e80536e

SHA512
70fb9da49c1ac06d17a90867abcc99a9729a4a6a36f9c3444814fc0988356ad8c8427dff3a87516a23a4b4262939f02dde1e5ddb4d0f18f159b6e6bfd9d646c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9039f2427adc9bf6181a7f7c61a86de9

SHA1
f4c263dda0ab5890248c146b152af5b64c183f3a

SHA256
2f3573318643c45c2641ab2910e6e36a64211fce26140aa905a79e05e5195306

SHA512
276d9c8e21b23b1862e87064beae5f8cf2d7bbad83d041423e56089e44a7a6fb84eb197cd8ac4e0f02a584abcc1610d65c79e28d75358fbb26c0241299d59360

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
61d475ed8dfc90769db41a7c34c8b798

SHA1
15d719364a88258fb223027e823da5982a117efe

SHA256
dcfdf9a36ed90ce4e149d03aaace8e3156a6130475ab4a66110e3ea9e0002baa

SHA512
aeaf67ddf2964c568b5182c1c408e5c8019390d3ddd462e0404758646ba7b1f3d476530d22cbe56fa003bc2218da7ccab4688add70579bad49354834f0bbd31b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
a293d8833f4879403024282ce8178d4d

SHA1
0cbd702fe8e8d5aa271b8c75a821ccd023452e9e

SHA256
df80cfdd4b172b9748075471dc748b9dcd70f330201466d9b6f26cebcf696d90

SHA512
14175dc3f0ea8825373f6031ebd53e568195fe2672a78a06824dca8160838f6601d1771fda275889d432b65be4a518d9daee65e1a1b488c1e024362f2594d11f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit