hxxps://mgcp03[.]engage[.]squarespace-mail[.]com/r?m=65e73d784aa82907275023d4&u=https%3A%2F%2Fwww[.]squarespace[.]com%3Fchannel%3Dproduct_refer%26subchannel%3Dcustomer%26source%3Demail_campaigns_button%26campaign%3D65e72a420d377a0d4ec3bf54%26utm_medium%3Dproduct_refer%26utm_source%3Demail_campaigns_button%26ss_source%3Dsscampaigns%26ss_campaign_id%3D65e73c786fe4b311d895161e%26ss_email_id%3D65e73d784aa82907275023d4%26ss_campaign_name%3DATTENTION%2BEMPLOYEES%253A%2BRevised%2BWork%2BHandbook%2BFor%2BEmployees%26ss_campaign_sent_date%3D2024-03-05T15%253A43%253A04Z&w=65e72a420d377a0d4ec3bf54&c=b_65e73c786fe4b311d895161e&l=en-US&s=y2Eu8OPhGH-0ATB-jt6aFlvuIN0%3D

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mgcp03.engage.squarespace-mail.com/r?m=65e73d784aa82907275023d4&u=https%3A%2F%2Fwww.squarespace.com%3Fchannel%3Dproduct_refer%26subchannel%3Dcustomer%26source%3Demail_campaigns_button%26campaign%3D65e72a420d377a0d4ec3bf54%26utm_medium%3Dproduct_refer%26utm_source%3Demail_campaigns_button%26ss_source%3Dsscampaigns%26ss_campaign_id%3D65e73c786fe4b311d895161e%26ss_email_id%3D65e73d784aa82907275023d4%26ss_campaign_name%3DATTENTION%2BEMPLOYEES%253A%2BRevised%2BWork%2BHandbook%2BFor%2BEmployees%26ss_campaign_sent_date%3D2024-03-05T15%253A43%253A04Z&w=65e72a420d377a0d4ec3bf54&c=b_65e73c786fe4b311d895161e&l=en-US&s=y2Eu8OPhGH-0ATB-jt6aFlvuIN0%3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133541323227440698"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1760	chrome.exe
1760	chrome.exe
4344	chrome.exe
4344	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe
Token: SeShutdownPrivilege	1760	chrome.exe
Token: SeCreatePagefilePrivilege	1760	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe
1760	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4640	1760	chrome.exe	87
PID 1760 wrote to memory of 4640	1760	chrome.exe	87
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 2764	1760	chrome.exe	89
PID 1760 wrote to memory of 4964	1760	chrome.exe	90
PID 1760 wrote to memory of 4964	1760	chrome.exe	90
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91
PID 1760 wrote to memory of 2656	1760	chrome.exe	91

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mgcp03.engage.squarespace-mail.com/r?m=65e73d784aa82907275023d4&u=https%3A%2F%2Fwww.squarespace.com%3Fchannel%3Dproduct_refer%26subchannel%3Dcustomer%26source%3Demail_campaigns_button%26campaign%3D65e72a420d377a0d4ec3bf54%26utm_medium%3Dproduct_refer%26utm_source%3Demail_campaigns_button%26ss_source%3Dsscampaigns%26ss_campaign_id%3D65e73c786fe4b311d895161e%26ss_email_id%3D65e73d784aa82907275023d4%26ss_campaign_name%3DATTENTION%2BEMPLOYEES%253A%2BRevised%2BWork%2BHandbook%2BFor%2BEmployees%26ss_campaign_sent_date%3D2024-03-05T15%253A43%253A04Z&w=65e72a420d377a0d4ec3bf54&c=b_65e73c786fe4b311d895161e&l=en-US&s=y2Eu8OPhGH-0ATB-jt6aFlvuIN0%3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0da89758,0x7ffb0da89768,0x7ffb0da89778
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1868,i,9301698332962377886,9525295578333735326,131072 /prefetch:2
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1868,i,9301698332962377886,9525295578333735326,131072 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 --field-trial-handle=1868,i,9301698332962377886,9525295578333735326,131072 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1868,i,9301698332962377886,9525295578333735326,131072 /prefetch:1
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1868,i,9301698332962377886,9525295578333735326,131072 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4736 --field-trial-handle=1868,i,9301698332962377886,9525295578333735326,131072 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4820 --field-trial-handle=1868,i,9301698332962377886,9525295578333735326,131072 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4596 --field-trial-handle=1868,i,9301698332962377886,9525295578333735326,131072 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5352 --field-trial-handle=1868,i,9301698332962377886,9525295578333735326,131072 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5184 --field-trial-handle=1868,i,9301698332962377886,9525295578333735326,131072 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=1868,i,9301698332962377886,9525295578333735326,131072 /prefetch:8
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3908 --field-trial-handle=1868,i,9301698332962377886,9525295578333735326,131072 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5288 --field-trial-handle=1868,i,9301698332962377886,9525295578333735326,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ce6b45a7333255ac71b4a3eaa213b21f

SHA1
1ef7a70c5524ec011ec6fa75011a3179c03848ce

SHA256
911fc471849c1122fffa560c7c9094f94facf113470f0c7e0f81e52f19477d31

SHA512
47bd7e680a60c820df562466839c0611e1797aa15d8861e7ed0aca1c3a7a7548b328c4f8bc0eeffee5c5f7d066845f2c6cfcd5cf9e00da616ed01e6ecc5c8af1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
ccb0b32cc901af29dc70d088bb6ccc8b

SHA1
8974de96cf643948cf6b77a3221a9c14781d60a2

SHA256
f8c5672c738cf4cc50965048b2d007dc1fdce2a1863b4166b2885fc0dd0abe43

SHA512
3ab901617f45356e35c766f2c81ec9f35c14dbdcdad59524d1904e7659537e2acc6e42d410a735d37b405e0cd81d5abb57bd93ae6719aff188cb6a23f80082b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
eb618561db64bee0629234e6b5fda905

SHA1
16c32c783b8796e938efd1a3cdd8f06281520067

SHA256
b65667b1d0802a3842ae4bce271d3c4b21e9d62471373249a002b2bea44790e3

SHA512
7c19873bc73117fe43f52737d542e016581e6fe7ae2f84af656549e2b7f8f11e0074eb0b1cc01d87c8104378b1e98fab6c4495775cce30d0b2e03a1fe8a8149e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b2770120167e86e9c7ee3f9cf4a67d48

SHA1
7bb74642c933bf929250d934c1d3d45849782a23

SHA256
af25305e2fdbe9cd36626cf884f0337910d2c66f7b82b0b0dae09c5b5596d72b

SHA512
141740607ab7cd4072daa95b0469db66bf49ee33d316d0c285e950ce7a216c85fbcfd0953bf52d0d5faccfdeafa0b75bf369d376fea2f2704f22a8a2f2643c17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
8e6a78329e64e33b0086a5c6d4031272

SHA1
3db68d000877e6c43d2a4ce3b5f992058852052c

SHA256
a1e4df8223d305b063407cc92b0802f05d85d51a8d287b5d3a6a0fedd561b05d

SHA512
67580cabebd6e5999dd70ebe44a08521699cd9a1442fb448e51e0e425015f7c10f7d53e5fe60caf571fe14c36d1b248b06de2a5c3064c803302aaaec85561ef2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit