hxxps://2fa[.]com-token-auth[.]com/XVmErSFRJN3orZjRsSERYUWg5Z215T3IxR3psT2hiN2RabDRMc0w0T2w3NTFRQWg2L1VPN1l1T0Q0T2FkbVFsakVoaVdORnBtM2IrVzhtanN5M0FReStscGVDQTltMHNBdWl5V0gwYzNQc2dYcEFSVjE2ZWdLQUZpRkNVTHJlK1N5STZYcUNhbGdNQ045QTI0Si9IWE5adGFvK3MreVk0ckg4ZzVuMUc3YWJWaFlXd2FrT0gvZVdLVy0tYzlScWEzWDFxTUtCRStOMy0tVDNjYTdGbFo4a1I1SzNSbVF3RExhUT09?cid=1953465668

Analysis

max time kernel
164s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
19/03/2024, 17:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://2fa.com-token-auth.com/XVmErSFRJN3orZjRsSERYUWg5Z215T3IxR3psT2hiN2RabDRMc0w0T2w3NTFRQWg2L1VPN1l1T0Q0T2FkbVFsakVoaVdORnBtM2IrVzhtanN5M0FReStscGVDQTltMHNBdWl5V0gwYzNQc2dYcEFSVjE2ZWdLQUZpRkNVTHJlK1N5STZYcUNhbGdNQ045QTI0Si9IWE5adGFvK3MreVk0ckg4ZzVuMUc3YWJWaFlXd2FrT0gvZVdLVy0tYzlScWEzWDFxTUtCRStOMy0tVDNjYTdGbFo4a1I1SzNSbVF3RExhUT09?cid=1953465668

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133553445633647429"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3348	chrome.exe
3348	chrome.exe
1464	chrome.exe
1464	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 1988	3348	chrome.exe	86
PID 3348 wrote to memory of 1988	3348	chrome.exe	86
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 3084	3348	chrome.exe	90
PID 3348 wrote to memory of 1368	3348	chrome.exe	91
PID 3348 wrote to memory of 1368	3348	chrome.exe	91
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92
PID 3348 wrote to memory of 4724	3348	chrome.exe	92

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://2fa.com-token-auth.com/XVmErSFRJN3orZjRsSERYUWg5Z215T3IxR3psT2hiN2RabDRMc0w0T2w3NTFRQWg2L1VPN1l1T0Q0T2FkbVFsakVoaVdORnBtM2IrVzhtanN5M0FReStscGVDQTltMHNBdWl5V0gwYzNQc2dYcEFSVjE2ZWdLQUZpRkNVTHJlK1N5STZYcUNhbGdNQ045QTI0Si9IWE5adGFvK3MreVk0ckg4ZzVuMUc3YWJWaFlXd2FrT0gvZVdLVy0tYzlScWEzWDFxTUtCRStOMy0tVDNjYTdGbFo4a1I1SzNSbVF3RExhUT09?cid=1953465668
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffd18069758,0x7ffd18069768,0x7ffd18069778
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1852,i,12731563514289519244,12916005343911014631,131072 /prefetch:2
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1852,i,12731563514289519244,12916005343911014631,131072 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1852,i,12731563514289519244,12916005343911014631,131072 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1852,i,12731563514289519244,12916005343911014631,131072 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1852,i,12731563514289519244,12916005343911014631,131072 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1852,i,12731563514289519244,12916005343911014631,131072 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1852,i,12731563514289519244,12916005343911014631,131072 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5088 --field-trial-handle=1852,i,12731563514289519244,12916005343911014631,131072 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4744 --field-trial-handle=1852,i,12731563514289519244,12916005343911014631,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
2cddc02968fddf08681c3bf3073482c2

SHA1
923e643152b454759c39124ce46431dfd4fde2e0

SHA256
9908e92a120f94ce20833b727eca835c3e9be3a1748112c73bdb8a1e854974b5

SHA512
679769a4a40222b9eb2e2406252e6e980dc1bf99422ca313f1cd8e96f7501d18d2e4e9ae2eec572781fb5c1669ae7653d8227e2e58f05cef278dff717f0e36ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
5ac8f085c041cc0605e0e2463a4087c6

SHA1
03dd974d1b054242dc221ca760b3f37126069faa

SHA256
30c7442d10581849506f0854ef025c98df0fb3dda86ee9ad4ebe24bb604ecce2

SHA512
41cb306c365baf66048180bf5600423b7633be9542884303b5ac39daa065197e31849efd941a225cb9a4d3386a8422dad946ec4ca6016af500ba04f233403989

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
65507ff9a179ec6dd38fb79ea14b1a43

SHA1
8ecd0e5bf9abfb7f9323c8c1cbe86cde88d8b705

SHA256
b6139bcfdecee41514f8b9a1fb8927522c641ca40d679f24629daaf724985195

SHA512
12e65299ee95cb08ea8692c0736e0477d6eff7966c1effc74512d5496ea987ef1e37a40174b1478bf9e99c48fe1aa6b1fa18482b2b32f46fa43a65a604108e98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
20d402328653bddaf97e9ef23442dd7d

SHA1
d0973a7195d12948d943be576af30baf9bf46bf3

SHA256
01fe52d220eef1f4d86f450f053beb35508eaa660af0ed1046a661fee47c06c7

SHA512
eee403852e4a46441409360ea648736a4b48e4945201162b3e3a173494c095a622d74312818079cce85529aebb85324aaa0d9af40c04705e54eeee2bb860db27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
dde9113318510fbd9ce2c103738efb68

SHA1
2fe2ed6046a0f72728a4171d33c6f00aeeca6121

SHA256
fe2266da438129694ca806177650a8bfc5d540b26bcd0cae3c3cd9130c6456e2

SHA512
3bd3966fe4e93eac74021649a2f1ec34debb0fa54311c4e0f98d4c3d0f7b4b8d20bbf432cf373a20575a41bd9ad9f25d5fb8814bbf4068f93514409bc078d275

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
873B

MD5
7e83dc1f953046c37388f344b2f549ad

SHA1
b01956a0e9ed25feb083c83bf61e21672157523f

SHA256
d98a885f3122e4f9bed99cda625918e6423881a35a18f085f300532ba2cac2b1

SHA512
bfae8ce1c250d5056ee860e84b72637726586d3f365b575111a7c64b2c30b2a63e7ecaa1e0bb670c5b1bfba299cc55cab16cc2d2ac96a6b1bcb311c072b9b770

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
07a82591328a25d549a9ff9ba3c2cda4

SHA1
acd7267db7364ce2b8281c076d8cf494aed67b4a

SHA256
0680d7dee12224a03052d2d4a5e550dc8711c8618b265f89b29f47008ae54cba

SHA512
116028be28bf4c7bd0779803eecb6fd2ad4357d89a04bd4d4f4f332c897d215d700f99dfc4636fcd73f4a77c6ae1efc9bc837bb765b4cd3c6e732c1cd32d6b1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4b293de02602582c06f4d9c3067e67ed

SHA1
66d5ddbe777ed535bff972438f332a5276cf0c04

SHA256
a1d8672cd384ca3f086d3907bf242a040503f633f78e929a774498be264654b9

SHA512
082ff784ca746094627da4248bd3f142ac683204114fd3fd2b144e4e175dfdb8b8eb5790bb54dfc1bcbff4d3922fc92d1d8a815999ba80195ddcb4d90ff5f379

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
739cebdce6f3775fcd34d3c3a9222ae2

SHA1
6245e67e016dc03e192351057fd30dc551ec4811

SHA256
e9092478d4f4931b2f6dd972d13792efb3fa091913f7bc765991ade566f04f23

SHA512
d6abe07a51d2e45d9829b7f04bd1ea1a00a778a7dba7ceb9fb36210cd3166b2e7aed4d5ea7f58d1e27f777968e42d26105e3bda7498d506669f33e13072bfa91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit