hxxps://freethevbucks[.]com/

Analysis

max time kernel
600s
max time network
546s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
09/03/2024, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://freethevbucks.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133544785723926482"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
804	chrome.exe
804	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 3612	4428	chrome.exe	71
PID 4428 wrote to memory of 3612	4428	chrome.exe	71
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 4152	4428	chrome.exe	73
PID 4428 wrote to memory of 2044	4428	chrome.exe	74
PID 4428 wrote to memory of 2044	4428	chrome.exe	74
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75
PID 4428 wrote to memory of 1568	4428	chrome.exe	75

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://freethevbucks.com/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc49059758,0x7ffc49059768,0x7ffc49059778
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1816,i,7293938195107135461,6450829704963596983,131072 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1812 --field-trial-handle=1816,i,7293938195107135461,6450829704963596983,131072 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2040 --field-trial-handle=1816,i,7293938195107135461,6450829704963596983,131072 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2848 --field-trial-handle=1816,i,7293938195107135461,6450829704963596983,131072 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2856 --field-trial-handle=1816,i,7293938195107135461,6450829704963596983,131072 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 --field-trial-handle=1816,i,7293938195107135461,6450829704963596983,131072 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1816,i,7293938195107135461,6450829704963596983,131072 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5048 --field-trial-handle=1816,i,7293938195107135461,6450829704963596983,131072 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4388 --field-trial-handle=1816,i,7293938195107135461,6450829704963596983,131072 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4352 --field-trial-handle=1816,i,7293938195107135461,6450829704963596983,131072 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5168 --field-trial-handle=1816,i,7293938195107135461,6450829704963596983,131072 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3564 --field-trial-handle=1816,i,7293938195107135461,6450829704963596983,131072 /prefetch:8
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4468 --field-trial-handle=1816,i,7293938195107135461,6450829704963596983,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:804

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
a82c93dd8158135701b8251ebc2d3469

SHA1
ef579cba37d691d266c5298a3baececc3aee8160

SHA256
4e83234b9c4ef2d499e45c35f771c5e72343d9ca7d4a6eed7b8c91c1d4936322

SHA512
7a01d89ed3da88158127ca4652e3387743c7bcfa0ea965abbda8d6c2db04089a6df0689e7e699c93586da47f4112df97d976f1f117a3e4af28e7b42bb189c9ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1018B

MD5
94a8dcef5e1eedaeb7e667e7edfcee63

SHA1
666e6cebc5c6cfb208e5324a7614a293bbcd0af5

SHA256
51093ab42d7a67599748d69a55615986cf7740f58b09ac7df0872137e2b506b0

SHA512
2c5996bcc161ba38eece17b64f9a8fcda2cf996be6aab93c540158c1a2e79257b4c88edfec989672d22ecdf3a571789438c333e2e6b8ae1f5c7000a550df2d4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
10bc3f50e530cac485c5b678dccf5f37

SHA1
a8891e211f5831378d295fdffe2f6e687933b479

SHA256
46c01617b8bf1eff58d43d5d241896d44b4a43f5e427e3f7fb2c2f4ceec13924

SHA512
a99c7935080f1448a64c650b0f8a3f31da5b8e02455c5a4d1b7b5a48eb16b43343ee8e24f0d8d86aa605e10b304a3a327cbc87656516d6e078b67c60e4eef7fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
164262f5e52b7c102959edf2f04f10e0

SHA1
2fa747e83fda424659557774ee4445dadc12d156

SHA256
eed0347d1c5eb03b2743b195628e61d04366a4f988260b566dcf85206d6361ef

SHA512
fe580344f7e98c60c6fd8dacf9fab19fd60eff321877fea149e3273274183e5ce1ac727b86094571ae266da3307cd09fb078b033b85adab519d9f5c37424501e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
442105169a1e052969c991b5b7e87b0c

SHA1
0fc48629958b3ff6f1f470eb50e0e1fa1132fe28

SHA256
924b185ea6daf90fcc143c44ca061a3f2be311bfa6f9302876727237cf226a9a

SHA512
32ed93dbfd57803f8b7e20c29ce49627e146a07c2bd498752d6aa954bb42bc1924dcb60d267246248de29153efb1aea322c93a2d0da31272dd4df8a675be6b9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
7be27eab9f05c58ca1f57a8071d2541d

SHA1
f53634441174ea158b1439bd9dec16d2a70ed85f

SHA256
aabfdb42e2aa4988591bad2973864e0df67c5c4b647cd5a95157adec225aa41e

SHA512
1c710b0eb7e8f41c5e6b99d392e71db7f6440ad51cea450fe069593f2f831afabe1d4822a8b097e3f7a3501b8192fee94305aad6c777826d2ea2830668dda690

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9f462745b2490990228ea9379a0cc7d1

SHA1
bc39094ce7258f60d169b0ce8e6d8d08ae14c573

SHA256
683e041400f798e0b5fabe98df956a838eeecbb359c0f0959c165fffdc8c2109

SHA512
03dc78499af7d50b050b0988c2c96e53b3c20c79af00704a7b709009e01674ba44f12da2c1cb76b0e4fe20fac41783cdcc2b45016d8438f810553a8092a04420

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
51ff2ece11187a78adb4abb962434c0c

SHA1
5b9c6a5e3caf9111c7a84c0463e387f542beffc1

SHA256
b4989862056d7c71727b7cf11f355ad80d0961943645a9d5e3e11b5c93acc1a5

SHA512
b16179ceffdbe49679cd8cb4c7c256a824096c15057ff492effffdfeaaf127606cae833aaed113f7dec3950c1372b03ea5f48c941280fb9875fc9a666bfa76c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ca87e10c0885345eb476652cd5843564

SHA1
b023fd3f46ae1d062c28a9c60aa882fc7a24e453

SHA256
d5c5ecb8ae8699ee534b171f64ab23a818d813f3d719ed9973085e943bd07e2f

SHA512
635386b0bea3913ddfad87c08055255fd725152104822aa72daf6f74bf1a04e1233b3728c805cf729d16bc724977fc3bafb4ed95af88f001c43f6cd9716fa7a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
197f298c63463f9612cfa9de2b784fa0

SHA1
4ec586a7b17cdd18fe113908ca5845c0bed2b0ce

SHA256
16a675a2831aa4d06e04a3ab4354d79fb72248f55cf6ea585373a17b8440d101

SHA512
8f9853b658afca8cfa6aa016555d727f2e1f652b192a86f633fd25e0913abfa2f3815e33d83fbaef086cc04025fc83df81f31e645529af2a62d84d2cf2cb3ac7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
2510dfd03f46e025e9a5743bbf1083de

SHA1
65d0c470fbbddf0e1be5798cca281cf83547d86a

SHA256
80051f37685c3ddbe657db5cd720a70d73554d91c37659dadcae058f790aa207

SHA512
be8efd990ca5cc04a44c66271737b9a9957ca69b37fbe4bacdb6b8c108e97cb2bb0adfc2a14ee30bc17dfba7f1489d68e0fa8cce3aeac0b57e84e3f45eb4ecc7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
f18118d6c7fc37de81589c27f48db9de

SHA1
671e814f57f5f1abfabc1f226d85a54df7fbea26

SHA256
09ba9055137580b6df3449c4c8b1ff60763f57b0a2cc81b32b0ca8bd4f829147

SHA512
af10735d17ce6908d4228214148fbbe8df55592c0cd739a8c95e7860ea5bfa54b73ef95cc3aa45f2e41534b78d00b38e5e4f9dd34df91c47275ecdf7bab45f3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
100KB

MD5
d92fe45875e7ba659460ac87d2299256

SHA1
bd62c3fe8d251ce03c5ce8e1993b1d39c05dbfee

SHA256
2418ba35862f579a6d49bba02c5fb327f7a73feb11be3569d9624ee0b7343a57

SHA512
e37f6aef2f04d662317402f628fd9627b75b4dcb9fd9f8ffe8fb259143413496ac08fc4ed2474b9d10554fc9460d72643128d6d72f9c1650131868559ca0bec9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58080a.TMP

Filesize
98KB

MD5
d8741c75bc38dd4f31ab97776e0a9936

SHA1
446913f2f8e585a9f2dfcb24856cb654fb89a246

SHA256
04cb959b62c5a612892df1ddb5b9f3eb851b9b60aa204ff4ef18dbd9cf3e5255

SHA512
a625ed0444be7e9225a2db13ba8a27ace0a3da5a28b9efbe0303300e6964a452af025b6404ccc818dc621fa1c5a9b81edf9eb1399dc1a37b43ece38ec7618d40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit