hxxps://discord[.]gg/a5KVVbqyPk

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240221-uk
resource tags

arch:x64arch:x86image:win10v2004-20240221-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
21/02/2024, 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discord.gg/a5KVVbqyPk

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	discord.com
13	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3316742141-2240921845-2885234760-1000\{79F5086A-1EE2-4293-A1E7-86071717666C}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2784	chrome.exe
2784	chrome.exe
2348	chrome.exe
2348	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 4840	2784	chrome.exe	22
PID 2784 wrote to memory of 4840	2784	chrome.exe	22
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 1820	2784	chrome.exe	87
PID 2784 wrote to memory of 2108	2784	chrome.exe	86
PID 2784 wrote to memory of 2108	2784	chrome.exe	86
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88
PID 2784 wrote to memory of 1616	2784	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://discord.gg/a5KVVbqyPk
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a3c39758,0x7ff8a3c39768,0x7ff8a3c39778
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=2064,i,3971868768963645677,7767548996061940894,131072 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=2064,i,3971868768963645677,7767548996061940894,131072 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=2064,i,3971868768963645677,7767548996061940894,131072 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2768 --field-trial-handle=2064,i,3971868768963645677,7767548996061940894,131072 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2760 --field-trial-handle=2064,i,3971868768963645677,7767548996061940894,131072 /prefetch:1
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4688 --field-trial-handle=2064,i,3971868768963645677,7767548996061940894,131072 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=2064,i,3971868768963645677,7767548996061940894,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4848 --field-trial-handle=2064,i,3971868768963645677,7767548996061940894,131072 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 --field-trial-handle=2064,i,3971868768963645677,7767548996061940894,131072 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 --field-trial-handle=2064,i,3971868768963645677,7767548996061940894,131072 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5512 --field-trial-handle=2064,i,3971868768963645677,7767548996061940894,131072 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3708 --field-trial-handle=2064,i,3971868768963645677,7767548996061940894,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2348

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3248

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x338 0x3c8
1⤵
PID:4076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
096436464b0cdb8683faf186873a690d

SHA1
a464b8254420b5b9a60b3ef201ef5c8368a3dcca

SHA256
798f35e783bae3e31172b6c5bfb4c446ce089745a907f08a78efb84848e8b6a8

SHA512
65efd97e1057ae2d59e1f1ffd9b3cde553e4b0e56e0113a30c462d3dba6f21c60f67e46057cfbaab6154862d6cf3f8bf5813f6ad181545a848060c9dab3d625d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
da9abb89bfcad0aa91cf7514257d61eb

SHA1
aa7247a79bc099dd562944eea1bf3c87422b6639

SHA256
3a28f55b31b53c6bad97d6b4037ae1ce372eff364a52dde0916ec20c867e6055

SHA512
4f353451b211d905fa83b1f03d759d0493649dec0c860bf1dd379e8faf64b9b9eb74f777d568582eedd39a4435e6550058544de22dafe68b07c9451e8659d959

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
ff855dae237c866b05f5868db7dfc954

SHA1
f018bc9ac2481c7b912b6a20e7bc0e5fd867615a

SHA256
cc1eb96f3fd011bb0880caa6087841dbb89da8607fce5374a582f9ad013ef30c

SHA512
eae8cac6f01f6c1ba177a29489f0eb78e46fcde25e192f538f8b0bfb620e1f3df12b419aaf5400aabb823e028fa9ba38b9794b6369366066f13d3f6a425ddbe7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
84a3ebefa8dfc9a3ccf0220e3630f72e

SHA1
e2b576acd1b165e7f8a499b489cbbd03da3bcfda

SHA256
70b3eab6583567c06f4e4803ca35c1542087f05d7742c1fdecfca34cacdb6da8

SHA512
902092b413f720d4a4e1e422f7e5693ec707f92bd0b310583bf554b04d7af14812d417a48c4789c6554e9d0af876466d913189582d8660301b31031702201041

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
23fc80d14141f9aa7af03a64b422a4c8

SHA1
81cf8d4fbd5899bde6bcddde86be524a3239dedf

SHA256
23a6d07914d0ae64a5b2492aab7874e31e68ce1d97ee02fedb5d888d21e8af52

SHA512
7a560e1ee40adc773cb781a9eda46e98ac85bb61639d5ec386f709e6dcdfcc550e9bdcc7d187984cc4d9c19aa3a61c66cbba3a850993d41bb2b2651b61347ea4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
dba30234fca79f719bf9c5ebc9e0a10e

SHA1
2a8c1b0f65cd90b5e7ecb0902ab32899aa0178ae

SHA256
a97a45a784137f20bdf83af43daed912330e84b6ca7b4e0ab2dfa95b40a37f4d

SHA512
c7bbd6bb710958b9d3939424e779babd87616143a23fff7433abd4ba76d28f46b4c7408d519e40998870614147b162e5a94f7041d467343102aaecb7b852e139

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5425b685b47d7e5497244ecc548857ef

SHA1
25620951b2f12643d4195be30193496c9d9f85a2

SHA256
cef8817a6eac30a34d3c180371b0f924960260f92f46d34bd397d3b5a609c51d

SHA512
cf7a6e6d09deb063028023df1e0f4c74d3c6e63aba5fc7304dc26057ff226bfd3d843b8e6ff487f494d7394ec7eb100ac1df7d8c475df39ee551db30772ba7fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
592cb8c8f007da3e41c3dbed47563526

SHA1
a5925b93ee4e7f905d73365d21c37ac461d5a484

SHA256
361cb2bafa28f677d5b7da5395e2bed380e1b7184646627046a61fd3271fe93d

SHA512
599c9c809a9a61add714041b7a3aa8d4055855feab1eeca6617af01230e520da74db4241c8de91e78332ca9eb3fd1d8c119fa78a5a380dda955681bca1622681

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
140c1432acc947e0ded8ba34c691a372

SHA1
367e1e7b7c18eb14e0a5fdc26f43a21533cc7f19

SHA256
dc7e6f50c027f1876a814c5c0630df2dee0ff4fc1a82987d0071e4353597fb02

SHA512
9c275e08c404b6572716caeeeac05c27bb2321864e81804250f0ec991ceb5ffa1a39c47340d2503692229b939303e253d099a653e0098f641a1fb68e080637d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
064d2e7f2263f5f28c01857ec2f171e8

SHA1
ba1ee1d64775a422f6063527357da83d32c6d96e

SHA256
a33e8adbb77ac577cbfaad3ada40099a1eb381168833273ec7b480e3f5685532

SHA512
fc4f9472008facfb6cf43dc8bedea733b820823548b95cb784c8f35936d7f0a8b84c86d8d5402489ba539a813ae6e5069e20bec17f287b99fa4811bdf8ac5f47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
c57fcb0e35a7bf3e8ecf4b1d68cabc85

SHA1
26f78c036aa61f5f7970638d0de408cf502b28f9

SHA256
e7a1ff2e51eb3f16c659e0af6ec3b5d93b7bfb6c52bac4ea1c90c4a403ba3d68

SHA512
670317e6198152f4d9f27af223d40ae913d8b94ab6a41158dfdce672f1122e3b0ddd3d8a769ecdc9716230ffc6b19914293e471743a8e29acde89b42547fac7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit