hxxp://www[.]deliantra[.]net/images/deliantra[.]png

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.deliantra.net/images/deliantra.png

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133547788388260675"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3924	chrome.exe
3924	chrome.exe
1784	chrome.exe
1784	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 4576	3924	chrome.exe	88
PID 3924 wrote to memory of 4576	3924	chrome.exe	88
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 4988	3924	chrome.exe	90
PID 3924 wrote to memory of 1188	3924	chrome.exe	91
PID 3924 wrote to memory of 1188	3924	chrome.exe	91
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92
PID 3924 wrote to memory of 3412	3924	chrome.exe	92

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.deliantra.net/images/deliantra.png
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ff8939c9758,0x7ff8939c9768,0x7ff8939c9778
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1876,i,17440276596660281807,5314792088128256488,131072 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1876,i,17440276596660281807,5314792088128256488,131072 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1876,i,17440276596660281807,5314792088128256488,131072 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2780 --field-trial-handle=1876,i,17440276596660281807,5314792088128256488,131072 /prefetch:1
  2⤵
  PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2788 --field-trial-handle=1876,i,17440276596660281807,5314792088128256488,131072 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 --field-trial-handle=1876,i,17440276596660281807,5314792088128256488,131072 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1876,i,17440276596660281807,5314792088128256488,131072 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5084 --field-trial-handle=1876,i,17440276596660281807,5314792088128256488,131072 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4596 --field-trial-handle=1876,i,17440276596660281807,5314792088128256488,131072 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=820 --field-trial-handle=1876,i,17440276596660281807,5314792088128256488,131072 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3312 --field-trial-handle=1876,i,17440276596660281807,5314792088128256488,131072 /prefetch:1
  2⤵
  PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1092 --field-trial-handle=1876,i,17440276596660281807,5314792088128256488,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
a7c606c362ff48ed9363abeca7872070

SHA1
5f5be3c61c35f55866f353a8b75c418c19b30145

SHA256
9c1672299f80c5006c8930c7408f48afa27065996432180aba98e90741a99745

SHA512
26bf8e55822c826233339fd7a76862e4063469530f44f5bcc60c6b9d00e01bd9e92eb11e5c14f913793ceee978ca9d5efb6492ed782e04d8f8f6fbecc79eaf04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9248df67-eb4b-4aad-8bcd-1bf0d6a13bde.tmp

Filesize
3KB

MD5
3961596539e4e62f966b9548fb21f87a

SHA1
7733e1a1427e4635d169564ba319b4946eedeaa0

SHA256
1142b87775d24b4e9096a99118cad96832e95f442737fab6a8c4cc4d12130653

SHA512
1332501b2d5293cbf09d3d1bac7b2be6b61f23d04eb2ba188c25297d529ae4c6ac22742702d1c7dfc5e2cf2c4e418c1ce69dbdd5ef67f0029704abd0aa7ce300

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
c6d11d672da2ecaf55e90ec1a314ae86

SHA1
0e50c4ec8bf04a3a88ea9bd84c2cf20a3f8e2ab2

SHA256
4f75457e077e738e5fba1a86f0e080a523ab0221ff6862212940571e0649d86c

SHA512
de19ccb65ebee43492a09999acd05c836f36fe6bb29568b30a585cfcef24d9a322ff1cae75b6cfd119c641a88565c54336a8a6cb7b2908697d52ec2a483f0e55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
4b4278ea0e21f8ff79c1e24e988a3b5f

SHA1
8f982cfb0ee3b716c75c8298a90b5664538ee251

SHA256
22e89fdf3102183f83294ca9b9eb8faa54669d5f3c324cdd10299454221a548e

SHA512
d8cb66dbbdcc3c1f6b57c6401b5a769f8aa655808bd16554faa81e5d74bcfadd9fac643e823150063330eade800e72c65d3bc1126f359ef55d73b1ab102322cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9c2a638dc47c539d021dd434fe2fb010

SHA1
1b7cc8edeadbc294f2f4e1ddcce1cc0e8219c34b

SHA256
621f34ab91ccba8ba96cf8e604c2c8cd096e94ba4e218a7193280096acd5f983

SHA512
eb8e6aa079fb89374654e3ebc7da8adf91d9db2fcc6ebddd50bd08de7dd46d953f24a03f751e9b840e73847846f835bd0b6ed371fd54435e25bdc0e2183b2491

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
04943c805d68d56d98a06734b93d2889

SHA1
af4f6533d1abf2fd03bcb224f3cb87ccafb4445f

SHA256
410d9406a50b0f13b04640926334a765e82626b4b5cbef57af52f08f88b019ac

SHA512
fe24ef5566f76a5ee375e3d42aa2b49973a6f729e50cc8a3aa81b3a8be75699a58c180b2aff20ed33eef04367e3c4965a3d8fc23eddc1ebea1f137658786bfb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b0082d7dd399cc04fcec292cac24884b

SHA1
1cc3bfb9010c91dd036c644f1e87acd91b243266

SHA256
e8bb2a2a3942166cf1678a082dbf59b39182669154031774650db2ba0ea70549

SHA512
c980f95bd2135e2617f29362cc01a4d5908eab8aa274a0851209890f827af5c8e1aad1b880d2dc3a25f4d6f7ba6652647de4daba18035fa5c4c98dd2d2ffda74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
dce5de49cd9cd8f773095cae1bf73bd1

SHA1
1ca62529698e7c9cc126f18038198226658173c9

SHA256
b4fc332d9413b0480df765993298ca7a9bfafe6318849531885a0168666daa7b

SHA512
0cde4cfee7b78a6830c1afd59809503c98cb68eabb8c07af3c0bcd720a58b870ddd9d7a58901f3e040a8d3a2ee6efb1a3b7a0b98a6f384be38275368f4608a22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6f0945d6175990fb54d70763f9d7d5d5

SHA1
e00a766b3b27645ea9de1389ceee26e6b1b0c8fe

SHA256
ba4dab889349c40210b7a7ebf71ca936e3dfa1cf6b3765e893d6693d685a8f06

SHA512
71e5e1a99ee48431eabf2af01f43a604dad12e8385db8975d0b042608a5541f4c62e66baf21263e11442b1a751d8881f53f3ae0f2f9091cac836853e106cec71

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
4207db0ca377afc0607e52f6534a85c2

SHA1
684cc66d600265d2da016074a4f92c295b1ec635

SHA256
cc7887ff142a00aab9d46dfeb255e0d7be22bf38e0eaf393b6cb76c16b74dcf8

SHA512
6f5147de694df53607949b252c07b9c75d08b7b53fc8f6f2ff960631d8f67e554a55d84981c5a52ad84ae0da669b5a13cadfeae6dbdb485621c9c3a9a546e9db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit