hxxps://qptr[.]ru/qTxi

Analysis

max time kernel
57s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://qptr.ru/qTxi

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133532693589355766"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

656 chrome.exe
656 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

656 chrome.exe
656 chrome.exe
656 chrome.exe
656 chrome.exe
656 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe
Token: SeShutdownPrivilege	656	chrome.exe
Token: SeCreatePagefilePrivilege	656	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

chrome.exe

pid	process
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe
656	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 656 wrote to memory of 1848	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 1848	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2924	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 4192	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 4192	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe
PID 656 wrote to memory of 2760	656	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://qptr.ru/qTxi
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb5339758,0x7ffcb5339768,0x7ffcb5339778
2⤵
PID:1848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1892,i,14054368436795326115,16788373946181162043,131072 /prefetch:2
2⤵
PID:2924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1892,i,14054368436795326115,16788373946181162043,131072 /prefetch:8
2⤵
PID:4192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1892,i,14054368436795326115,16788373946181162043,131072 /prefetch:8
2⤵
PID:2760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1892,i,14054368436795326115,16788373946181162043,131072 /prefetch:1
2⤵
PID:1652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1892,i,14054368436795326115,16788373946181162043,131072 /prefetch:1
2⤵
PID:2080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4436 --field-trial-handle=1892,i,14054368436795326115,16788373946181162043,131072 /prefetch:1
2⤵
PID:1760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=1892,i,14054368436795326115,16788373946181162043,131072 /prefetch:8
2⤵
PID:4576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=1892,i,14054368436795326115,16788373946181162043,131072 /prefetch:8
2⤵
PID:556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4412 --field-trial-handle=1892,i,14054368436795326115,16788373946181162043,131072 /prefetch:1
2⤵
PID:4900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3840 --field-trial-handle=1892,i,14054368436795326115,16788373946181162043,131072 /prefetch:1
2⤵
PID:4836

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2004

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
16704c1ec342acf97b8cdbf3962383d9

SHA1
77268d2681f05c7b1c1f021ed971a5eec4d219c2

SHA256
463ee449cffa231dcccb534f24aac70b731975ba04bb254eb4c4c6f57b62580c

SHA512
f55980983dfcde77bb3da7f54ca86608a6df7c5736d0e112f934f6cf7a8f8a2ad6efbb1941f594bade735894b21d045d6a09c6cd4429c513f868205fe99a6c78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
e6aff9c0ee557a8c390cb7c85fec9b5b

SHA1
20fcfbdb2c401d5904a03a4bbcfed2e2136a1902

SHA256
a5368fc26c116ba3f641a3dce28a889152f4ea9f8f8e05cedfb980e66a6485a2

SHA512
bf2498de9d5f8fea96f06ba0bcec85e1f3f0abab9d78e7865bc21ebfe6be36020ee86d62d09936949ebf476296d868939f0865a6de47b09eec68e33bee3adb81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5cf8d1eb-1731-4708-ae28-ddd9962d5388.tmp
Filesize
876B

MD5
f100b211ffb0c8710feaf168ff3ba28f

SHA1
6cfb7e09bc91322c7679f8c21ab8b3cbc1859d3b

SHA256
1adb3747bc9a46a032d9957f0768a397d9705b35b5093066b708c9ba3879564b

SHA512
7c3f9cfd4fc7c6b0bb201ff55c1770ebf1b1df8e37b924472317ab5f9c84f2e33db487c828839de78e5b496dee4a271be3b73a79f0339866612d43c78733a3b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
578343edd2b950247f12778ab7c13024

SHA1
6f5935e2c0e0bf130b2af3e32a344634da70f44a

SHA256
5fd9db54bb4572e461d339c9fa1c844458a3958ae573e517fa386985688bc0da

SHA512
9a7aa742b0e7db27dfed884c54a670b4211a9a146072c764579faab10472e1b42434584036261f2d58e1d9988c2c5bcec52893bb21c56e5bd6d07be5537d1b3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
c5172a892d2205bc69c0636b51c5b766

SHA1
f9b4e22feb54d14b717cf65132bbabea02c396ba

SHA256
b12e2b989483e4796fe32f4ac45ff2aa13768d1ebb20fe2f6646839557aed778

SHA512
c577758d4e1f9691b1d0d18b76e66f2fcdcb4a1957eac6193e00ab9d1fa301a99f0bdc8319ba08d0b55473419d87a6fb7175578af1c2fa47366b0ca6b9d8f072

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
10dbe238ff8e51b1ae9aa20b8c3f3570

SHA1
265bbe5100e37e2dfec950948877b34ebb61d50f

SHA256
3ee7e9c76c9676da2b363a4596ba26ac9009536db296c81c3a36c0915b7bc192

SHA512
2f6a70c6f46c7b1d0b342b7b3a93a43f65057a8227520d647f0cbc398389120a3bcb9b761ec851e2c8ffe04493be3a25604e2b2f8ad346520fedbdeddc98e675

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
80f0a3a7ef3c4479c56ce5a89c10720d

SHA1
1df9d3dd06fba360723d219b22ab664ba78a30e8

SHA256
aec0617b66f1215998146508d6b187746472e881dc3eb550a56afcdbb9a58169

SHA512
b3cc4cb2f198defb8e47c74c9588fd985a1a266233d1fa4b8ca847f814e1d72093dc4cc733ddbc0f17e692df0f47fdcc23295bceabd76c702846963a2a5df0c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
130KB

MD5
907e6802de00c40bee621cd0f823b3aa

SHA1
96fe6979bc73223ef2d467484b1eac858dba0a71

SHA256
b1edafb44d43dd88c8de8aa5cbabdd74daa7e76c5dee653977e4678e04ac9034

SHA512
05fd29e55ee08b810856fdf58eaa78fb96bb2d339a6217b4b268e6e5ce4e46496d36eebe7cd3ffcd65d562dc839ef7e5df56ea98bbf50a51b4c418667584296b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
130KB

MD5
761aa2ee7cadfff641f9a2d16bc47e85

SHA1
ef8d6ac1a9d314ceef36b36a4fcd07070aa74ab8

SHA256
b89334f8a8dc803e2b7163ae28a5e4c4f29d3012e6d5b673f1ee2a88bf4b5811

SHA512
3642113685e19e1752c328dbac5ada0b93b800c686d88e54da52555953020484746a8e04fff961e5c835a8bfe56629ab8d7175898527ade3b595622428b9ed4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
130KB

MD5
4989846ad47b5d350800f51399eff4bf

SHA1
f5f3e101f8ee033be399a22db54aef78c83d27d7

SHA256
c44ade7dc7ed04c39d633d26fb09ef1581265aad1857ce173746288415b2b0ec

SHA512
788018b7afb5ceb2a5eab27f4c6b279da2cbb1e0b3628dc843699ca880facf058f7084605b1674f6242a1c7e4caf9d91dfc2b1b0d7dac09e40d5f236f3e239fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_656_AWVNTEOKCZNPSYYT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit