hxxps://lookerstudio[.]google[.]com/s/gYgg1fl58ZI

Analysis

max time kernel
270s
max time network
261s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
14/03/2024, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://lookerstudio.google.com/s/gYgg1fl58ZI

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133549081707117332"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4500	chrome.exe
4500	chrome.exe
4556	chrome.exe
4556	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe
Token: SeShutdownPrivilege	4500	chrome.exe
Token: SeCreatePagefilePrivilege	4500	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe
4500	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 2800	4500	chrome.exe	80
PID 4500 wrote to memory of 2800	4500	chrome.exe	80
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 3204	4500	chrome.exe	82
PID 4500 wrote to memory of 4684	4500	chrome.exe	83
PID 4500 wrote to memory of 4684	4500	chrome.exe	83
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84
PID 4500 wrote to memory of 4900	4500	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lookerstudio.google.com/s/gYgg1fl58ZI
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc35379758,0x7ffc35379768,0x7ffc35379778
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1848,i,17960503070318086988,10854220638500892864,131072 /prefetch:2
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1848,i,17960503070318086988,10854220638500892864,131072 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 --field-trial-handle=1848,i,17960503070318086988,10854220638500892864,131072 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1848,i,17960503070318086988,10854220638500892864,131072 /prefetch:1
  2⤵
  PID:336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1848,i,17960503070318086988,10854220638500892864,131072 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4536 --field-trial-handle=1848,i,17960503070318086988,10854220638500892864,131072 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4952 --field-trial-handle=1848,i,17960503070318086988,10854220638500892864,131072 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5000 --field-trial-handle=1848,i,17960503070318086988,10854220638500892864,131072 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=1848,i,17960503070318086988,10854220638500892864,131072 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3892 --field-trial-handle=1848,i,17960503070318086988,10854220638500892864,131072 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5456 --field-trial-handle=1848,i,17960503070318086988,10854220638500892864,131072 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3212 --field-trial-handle=1848,i,17960503070318086988,10854220638500892864,131072 /prefetch:1
  2⤵
  PID:344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 --field-trial-handle=1848,i,17960503070318086988,10854220638500892864,131072 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1060 --field-trial-handle=1848,i,17960503070318086988,10854220638500892864,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
198KB

MD5
06d38d9bf028710762491328778f9db6

SHA1
83e1b6cbaad5ca5f6dc63453da324f8df28de193

SHA256
91558d69c027808e375e11c80166dc6ba245fbcfce715c9588decc55b4a33dad

SHA512
b197e5f92add72688396a07246ee9842a3b0de36508aa57f0254531cb109c77d0392e00ea28e006f9fbab1b8fee9b333998946de47ca7526b631e8c810780781

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
27KB

MD5
d4f12e9bba6c17004471da93df447cf5

SHA1
d236837a62faa0c72596a123b511b8faa83b2d2c

SHA256
e100509bb106fb3abc276686dcdb4ba74d95d744ba0cb4350dd08c4ae17c0b37

SHA512
4bef26f1b2c9e6be67ac5ffbaf0ede82a25851d1b44b4c484e8600dbb319e6d6db82fc7ad9823d900227e60eeeb5d1b3f628c75a73484213bd27901768363644

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
9fb7b4cce1d3d747ec177d898f34b0e8

SHA1
2ce4fc69926e4fe09b79259db3017ac7d8c8a57e

SHA256
bee33d62a7a63faaae747720ef92314de0c4789fe246c5a16627a0100a522ada

SHA512
7669c05a6fdb6ba6c7e2a41ca6e2c6a669d96cf32d0442b37f83ca24069d3c3282a3db6bcaef13e5b3492a35d99526e24ac943be7d155b458f74f15787578d92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
3f28ec99dfea57f1fdbba57fa5da92e6

SHA1
e6fc0a6c6dd60189ccc1c91b1c0c70f17550fe9b

SHA256
fdf56c9fcbaccfc94bcb55be744be8242180a7931a1cb2de03242f06c17fd30a

SHA512
7bebe28f1d0c03bc5f628048cb7c0ce2a3661afe073586ad48008f2b24dc462ab75203991cc3f3db421d895799fa8d5b51603ed27ad20a41dcd0716e59096465

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
52d4a4b8bc7cf4dc1514650bef6d7615

SHA1
d3a222d17a498983e1aaaa7f299bf670a84c04de

SHA256
38cd13d19b5e1d7eb95c233a395b36dd658274693fa4a4aad2b8099ee4ed1720

SHA512
8be2fcc1a238cc64e0d1dd37d3fe070de8fd4f82d52e4ff75c3d2362ebbd4f7c096abb9ebd3a7cdec3a73db555515fb9dce9e6ecc018d77d2c9758208f34e9ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
652ebb7b5e2752a22a1d104f2ee8c709

SHA1
a68f072e05267ac1cb862b8243b37256c2fe0ea5

SHA256
07aa2ae39229d0367ec42fa4b6094172e8f590cf7780b1f00f069f83fedfce73

SHA512
d897c4a7acf9a2eea4cca5661694018dc7c6dba358809c8b9f2eccc83f39f82d52ddb27db46118eb96f98d7a2d6bc8518765cc0316253cc319308d69ed32d37d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7b8a1cdd230b14af418f122a436b6f73

SHA1
892b28ca3b55253de5be37acdb1ca576b16e0147

SHA256
fa615479584a9f586e51580e98ebe501ca1d4d974c9c84c2be5e67aa4144b279

SHA512
b761073e15074ac29621d63d479972e91e70db2a20e709166515a438bb99bac3a0ca17f1085cd2420cbc70b771d0bc7c95e72518dc0d5f3757855531fa8a3c86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
960ff4e3f8ff214763a36b5a601d4330

SHA1
1d3a596fb5dc1f4e8bb530097f586de7cceeda36

SHA256
3313c403ee2edce25f8d7f81f620f029b6aa6d1e08791d984e77500492b5898f

SHA512
da95ade6c2e653952ccf066fae8e4322d1ac252aa5efe568a84591693e6e6c945c1172c0a4b99fd771828faf91e10dfc48f5b6d604d5d9283f6f666ddef68844

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
eea45dd0a5d14dc154e260dad3d12dbf

SHA1
53415a83ae9013916807b5ec427ffb5706235b0f

SHA256
b2a35178e5bc3735756365f6a7d1c1e368ccb49433961915bd40ea7a29f071a4

SHA512
c990c349a1cdb5c6f5d2b3a6a96032fbe06ed6eb1364ce83666ffa69f5cc509aa637eccfdc2ffa17e20be8fae18ac708d8568ad75ead903ab8eab25192088e48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e50f371edc1277d038fb31be7a1c9590

SHA1
898fd1895eb90bc67dad9daefdc10d835db7cf6d

SHA256
1792e92b7b21ea0d309eecb1051b872996db5b8bd1e38b199bac5425b75b5c33

SHA512
73b093815987f8830b2ebbd374caac90a0cd82655298e8121c0364610f7ae56998cde989bc843dda14395eb191649d63517218ef902ea60f10184143ae9da6f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
598234c3945ff24c30cbc4fd1b1f262c

SHA1
49b6a56e42306b595c3c38086110a052b21f7a9d

SHA256
02d4c16927c6e43f1a7c822ff72c916901363f7105f6f54bd821df7690675eb5

SHA512
4a79f0e60184f7b74bb99afef8979efc34f29a8e1b92dec35e3d79421a60b8b69cd631764a8fa16aa0fb420a0492bcb526a679d6004b7f20a74afdbb637af39f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
93KB

MD5
dacbf4667f752b72db206d54d063bdd9

SHA1
fe592749f0d619749edca854defb1a9f97b0aa92

SHA256
b5163284297d8e772c272a3427b3f8b19d85086dc10e8da9ce15c702b0aa6f3c

SHA512
45ce9c2721add36dfec11369f187827152271a2e83de61460667830b077ace4372814e034057b43795ef34bbcecfdee603e1fcc075a84f8842565ec4876ef377

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5858f8.TMP

Filesize
92KB

MD5
73fe6f98d4aeb98efb4cbd8650c77498

SHA1
e9db2286d92bb16f49b5513dc20eb39613b40310

SHA256
be8cb6dbf7478c878bc78c89472005c81ac780fa76a510786445e1c1be578e7e

SHA512
19f75707b6a6fccabb483e92d9032620b58e97bdf7cb7269e97d55e65fb27f3b45236a9130a2a78644d47411b32839a396ca2803228cb8ba521260633b6440aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit