47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8

Analysis

max time kernel
149s
max time network
147s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
12-02-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NoEscape.zip
Size

616KB
MD5

ef4fdf65fc90bfda8d1d2ae6d20aff60
SHA1

9431227836440c78f12bfb2cb3247d59f4d4640b
SHA256

47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8
SHA512

6f560fa6dc34bfe508f03dabbc395d46a7b5ba9d398e03d27dbacce7451a3494fbf48ccb1234d40746ac7fe960a265776cb6474cf513adb8ccef36206a20cbe9
SSDEEP

12288:1PQuO1JLx2auoA82iqOxdOc7XPkmpOw6mqc5m937hnTMktj1H:1PVqJx2auYqw7dOw6mql3nNBd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133522403097211188"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

4668 chrome.exe
4668 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

4668 chrome.exe
4668 chrome.exe
4668 chrome.exe
4668 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe
Token: SeShutdownPrivilege	4668	chrome.exe
Token: SeCreatePagefilePrivilege	4668	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe
4668	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4668 wrote to memory of 4692	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4692	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2860	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2484	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 2484	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe
PID 4668 wrote to memory of 4188	4668	chrome.exe	chrome.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\NoEscape.zip
1⤵
PID:1116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffbb82d9758,0x7ffbb82d9768,0x7ffbb82d9778
2⤵
PID:4692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1712,i,4600884138748180576,10253537904324907084,131072 /prefetch:8
2⤵
PID:2484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1712,i,4600884138748180576,10253537904324907084,131072 /prefetch:2
2⤵
PID:2860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1712,i,4600884138748180576,10253537904324907084,131072 /prefetch:8
2⤵
PID:4188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3096 --field-trial-handle=1712,i,4600884138748180576,10253537904324907084,131072 /prefetch:1
2⤵
PID:2252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1712,i,4600884138748180576,10253537904324907084,131072 /prefetch:1
2⤵
PID:1100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4464 --field-trial-handle=1712,i,4600884138748180576,10253537904324907084,131072 /prefetch:1
2⤵
PID:4260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4912 --field-trial-handle=1712,i,4600884138748180576,10253537904324907084,131072 /prefetch:8
2⤵
PID:4016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1712,i,4600884138748180576,10253537904324907084,131072 /prefetch:8
2⤵
PID:508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1712,i,4600884138748180576,10253537904324907084,131072 /prefetch:8
2⤵
PID:2136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5200 --field-trial-handle=1712,i,4600884138748180576,10253537904324907084,131072 /prefetch:1
2⤵
PID:3780

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
194KB

MD5
36104d04a9994182ba78be74c7ac3b0e

SHA1
0c049d44cd22468abb1d0711ec844e68297a7b3d

SHA256
ccde155056cdce86d7e51dfd4e8fb603e8d816224b1257adfcf9503139dd28f1

SHA512
8c115e3e5925fb01efd8dda889f4d5e890f6daaf40b10d5b8e3d9b19e15dadcb9dcf344f40c43f59a1f5428b3ee49e24e492cf0cb6826add1c03d21efdec52ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
f24b9cd2ea8f6087b06212132ad76ada

SHA1
71ae26f3e2228c381c3d241fb9e0efb3e715df8f

SHA256
12e8a622c910d5f3b5db3e3d5ba4bd96ad8b5dbaecbd40ea0865951e9f44b09c

SHA512
2c815a158b54e27c856da8f054fd17f597528fd152525e46ac21c326d2307456792aa29efe00b464d34e00bd44a85e1fc0e0b0ab80c2edacee2ec773f05716db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
9c7c9a3b54a2be32010f84b90facb1b9

SHA1
6d4f10e70048aab90a412a4751240a1547836b80

SHA256
f848c93535b18f217ee0d04234fd2120f18c24a5088da368f36517b88b9d90ec

SHA512
159a04e70e17f4f7cb2196396b56ea68e273e376a71301d14b1b9de296af3ad3026d9df2b997433dc197d49b6748bf3120506b66445a78a7d88f440f7d39fcca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
f9ab944b06b3bd0de41a7a1ea87f4129

SHA1
2b8c84f502469e42e2c573113c38b53bf9eddbb7

SHA256
b5ca912124f36952b82e4b24d1e7702df279d1d27138111d8e3f2c948d9060af

SHA512
f6023d8db9181e01c9e1d60847409d99258424aed902080c139fa391958f281666d6e0b624cc1eaa476c454aa6404f8fc9159954fd54bf863fce87bbdd73eaf8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
937408726b5afca220576c39c27ad415

SHA1
a1afeda7a9dc15ffd7f63d590fc1e1c4f952edb4

SHA256
cea3b04434d9bfa3d4a21d8b81c7f6f71fa3b07a32c96d9471689862f5811d24

SHA512
7152b2baef6f2ed26cba779654f3e7819fca0efab0d5d69acd9328787c5d56f981b8b9c382c135aa74443a4e5b24cbc45506d0fbf0feb77732ea366fdba26c27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
940f648921654df0052d4ab93e12cb21

SHA1
e5f12e46b5b4f10f4d0003b3db31f4b9e3db6a6b

SHA256
1a8d03439e78287c54762e27a7223021ab3248656f81b287663060468fed84fc

SHA512
cfd2bca955a4c5c9e726d3eabb2cf97df497ea79e4732c985f6c888d01121c98ec445518459257c0b63116c2e4952fcad2c241a1af65e5b8f6f0835a493df266

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5a77b553f1e5af87637aedc597eabcea

SHA1
5dd394bd8da433724bc1364022716f38aed5c197

SHA256
47140dbf81d5783c0e493961c005eccba69962bc509e7c4f43fb56ed866b1883

SHA512
7898ef29954da9e1467f79ea0ac2ff867ddfdc25e0e0d6408458175ecb57107192c66ae74b9f0bc2469649c9f4bde997416ac0875f3986a14d6f71abe35d3d9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
59baae196650881aaee3be766cc4a3dd

SHA1
9af5942f3a27ec3cfef8f7138e10ab50aaf85491

SHA256
6b90b56b507723d7cda820840961792f17d51cc9fbdd385fdffa088296c65e43

SHA512
dede55c43fdc9359cbbccb1897ab106ae785da954f011e5236318852b0c1457987710d1ba07b0726c10c812c2f2e8fa8512acf01c02d03467f94f4857df53b39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a51da1564f5c756e9a6ed9e79d95e96b

SHA1
397368baeb48af1d91a3ca7530a6cb4ab7ea3bf9

SHA256
21b000173e9e7c2abb60786f9ed9da4c06b0a962ca295bc7bae687f1baa36a59

SHA512
9b4cb1ec49f48b758d1a18f98dd2bcc758accc71147f34ae39caffaa19c1f96524de4adb961952076784d308a4eebc1f668a9180193ca8ebdf7a50342c6eeabc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
12KB

MD5
775b37273d097d582550a1c8e4b452d3

SHA1
5828f248254b468c35d69c3f4acee94b79ea1593

SHA256
cb2c8cc1dc8f6e5f6b497f2a87bdbc19dd0bbed8bbdee23d6b7d8d1750ff08c3

SHA512
cd72d7ed042a1b6757a112aaf468a554d9a588b530ccf76cacfec52c0a7596097f37dceae3f1af6ab0dc76ce2b23dfbe7f32706bfca132c4e31ad96d3d609d51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
238KB

MD5
282129bb27b6bc5282f71c996cac6724

SHA1
9ddf2c832e6402a8fffe000fb6de1195a3318416

SHA256
87a8823fe63f1d6bddcf77485bc06b650383b43525d17401daa459bffd5928af

SHA512
ddccbc6b72dbce6c6e7733adaff647ceca31fcb8d714a9a8f4356dc7a4fc1de3b3bb6a9ca1b3a2104293b94cf5f7babe04eb0d2fd16bed14f24b5fc2ed3b535f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit