hxxps://freethevbucks[.]com/

Analysis

max time kernel
599s
max time network
599s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://freethevbucks.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133544786316506029"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3828	chrome.exe
3828	chrome.exe
4472	chrome.exe
4472	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe
Token: SeShutdownPrivilege	3828	chrome.exe
Token: SeCreatePagefilePrivilege	3828	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe
3828	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 2432	3828	chrome.exe	88
PID 3828 wrote to memory of 2432	3828	chrome.exe	88
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 1540	3828	chrome.exe	90
PID 3828 wrote to memory of 628	3828	chrome.exe	91
PID 3828 wrote to memory of 628	3828	chrome.exe	91
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92
PID 3828 wrote to memory of 3008	3828	chrome.exe	92

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://freethevbucks.com/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffeb9c89758,0x7ffeb9c89768,0x7ffeb9c89778
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1872,i,16858879257790278247,17196908129994536019,131072 /prefetch:2
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1872,i,16858879257790278247,17196908129994536019,131072 /prefetch:8
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1872,i,16858879257790278247,17196908129994536019,131072 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1872,i,16858879257790278247,17196908129994536019,131072 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1872,i,16858879257790278247,17196908129994536019,131072 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4948 --field-trial-handle=1872,i,16858879257790278247,17196908129994536019,131072 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5708 --field-trial-handle=1872,i,16858879257790278247,17196908129994536019,131072 /prefetch:1
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 --field-trial-handle=1872,i,16858879257790278247,17196908129994536019,131072 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5104 --field-trial-handle=1872,i,16858879257790278247,17196908129994536019,131072 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4808 --field-trial-handle=1872,i,16858879257790278247,17196908129994536019,131072 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 --field-trial-handle=1872,i,16858879257790278247,17196908129994536019,131072 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3352 --field-trial-handle=1872,i,16858879257790278247,17196908129994536019,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
f4ffd5c30f815fc5b2933067a2fe32c3

SHA1
cb1a5285f85c5e91f31c7ebdbcc1beaf677e746a

SHA256
8439111a56c22f0fdcbadf7caece13cc0e342f2e46e4bf9ffc70a9fbe66a45b8

SHA512
fc52938230355dbb71750cda731f3dd5267ae8ce7b1850680717455748eeae59c479e253d61804a4b87616e5b5e40822a0c3de75d03e42fc8dbefa722c645fe6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
874807166eb26e8896b3b7c25df8b76e

SHA1
9d8722dc6b0444bf88f327d7a7e761fd4b72ef6f

SHA256
b0f39d186e97580eb9add3b5a3284bdf3df6d7cf8810d41a68aca9addb8a8a43

SHA512
10cc2ee99ea5ddd50c298c36b0fc7ec6563cc0f3bd94b6c1b337538fb938c514540ba59b5bb52a31e0266b26eebed8baeccc9231bcfd1a7983adad2b22ea2c5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
58cb7e68292dee7abd4a099db5062fd7

SHA1
3bae263f9f1c17546e5d2ef48993b4de9c52a691

SHA256
211929ef88689730397effac14ebf53d0ffe4e93e0b17f0414597e6b223335b4

SHA512
21f1a476d4508eedfd1121ccf6051dcb101a14d0657521c8c72036e56c82f61fbcd010e50ee2430fd2f004da1b761f5a0d5085c0db22874f332809fb5396b02d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
72886766e86613f30826ce5ddcbf6e7b

SHA1
df5af4c85f48ff2f7fd4b87e356ae19438f5f7d8

SHA256
ddc9bd746735149d8b8c4fd94bb746059af10fb336dc53b80f8e8683e30d0641

SHA512
9e38c69ad8dc74082d91e348cc48b0a6e2e0adb60e93ef23845aeca841c4016cc896dfefc29cb43e355a6471e8b0938471d79d1095a410890ac96350d4c08c70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ce509af67f0b0c479e33d38ba25bc3fe

SHA1
1fd5e5791d62c0dddd152b131461a42518f2c602

SHA256
5eaef0e1dd8243bc0bce9eb48ac89b9ced6c218eafbbc10e6bdb9e754f3a4bb7

SHA512
87d32addc239dc7d396c2a7b0693269311bcb9ff8b51f261b5346c80dd4e3578109475b670a85c979cafe42b036588e29e072cbf353705d2686b25822b8900c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5d9a13b72636321fde849b62d2fb7343

SHA1
cc7df35f9de474ea91cd36298923eb39b779196a

SHA256
dd551c078628a5674e151694547bbd07001dd0342b2fa1dd7bec3fdfa0873800

SHA512
3bba2a03980c12189b89931f289a79c94b4b32f7f75d20df3f070532b73bc296d0af4d046fec2a8bbd34e3bb4d0ec778a0cc9d9c354989be59480c293efef614

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c95f5474-18b3-4573-826d-96da482585d9.tmp

Filesize
4KB

MD5
42c34dde1706951217cafb6d041b3d13

SHA1
c16443922a09028f92e79e63eccbb329b44f1193

SHA256
b18ead3edefa33961f34b0178c516eaa496fbad7d3c6cd052972a5ea307fd131

SHA512
3b75b4c76e87d8aee30f0099680bf9dbda4d5df64b36e7b4217958a2b13f3ff8908fb1c6239c0afb39a4cba6f48f9764b1fb588330f515c83eafe5e8fc492e9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e6ad90850f7a40270eb8cbe8bc9478b3

SHA1
5cdd82ea83737ec10724c5e9da204e25b9c779a2

SHA256
60cda73b3cdb1fb8fd2770a6b32cffad3e34228086e29be5d25495b686c0d066

SHA512
0c82b7d43f65ef5d5a43c5b96eff33a83b82a89ec309c3e20ff64b7b74e56237f263705ed6da2a2a2e5251cfa34f3f4f07bfcdbc530de3e5e3949951803236e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
c72a56dfa958f243f68dcb24d883abba

SHA1
fc219279937bf807873f2fbec3d28e889a2ce6b3

SHA256
c010286900933f1b2083ca0dfe18c9cc24b05ceda1a179a81038e88a2e92763e

SHA512
32076c2169bf2dcefe3e458610809fdbfee6488511893f3afee79a6a8cfd5b1f6ae7d5deff29310047fc8157650bb46fb3de565bc2933c873953a1a2cff40b18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit