hxxps://public-usa[.]mkt[.]dynamics[.]com/api/orgs/969b0850-6ae8-ee11-9048-6045bd00330f/r/WDnAEds1zUKHSK_VPC0_cgMAAAA

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://public-usa.mkt.dynamics.com/api/orgs/969b0850-6ae8-ee11-9048-6045bd00330f/r/WDnAEds1zUKHSK_VPC0_cgMAAAA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133558432386123446"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5624	chrome.exe
5624	chrome.exe
2584	chrome.exe
2584	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe
Token: SeShutdownPrivilege	5624	chrome.exe
Token: SeCreatePagefilePrivilege	5624	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe
5624	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5624 wrote to memory of 4088	5624	chrome.exe	88
PID 5624 wrote to memory of 4088	5624	chrome.exe	88
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 3272	5624	chrome.exe	90
PID 5624 wrote to memory of 4856	5624	chrome.exe	91
PID 5624 wrote to memory of 4856	5624	chrome.exe	91
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92
PID 5624 wrote to memory of 4864	5624	chrome.exe	92

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://public-usa.mkt.dynamics.com/api/orgs/969b0850-6ae8-ee11-9048-6045bd00330f/r/WDnAEds1zUKHSK_VPC0_cgMAAAA
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe08db9758,0x7ffe08db9768,0x7ffe08db9778
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1792,i,4330357774472336245,776220711206472462,131072 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1792,i,4330357774472336245,776220711206472462,131072 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1792,i,4330357774472336245,776220711206472462,131072 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1792,i,4330357774472336245,776220711206472462,131072 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1792,i,4330357774472336245,776220711206472462,131072 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4804 --field-trial-handle=1792,i,4330357774472336245,776220711206472462,131072 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3412 --field-trial-handle=1792,i,4330357774472336245,776220711206472462,131072 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5144 --field-trial-handle=1792,i,4330357774472336245,776220711206472462,131072 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 --field-trial-handle=1792,i,4330357774472336245,776220711206472462,131072 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 --field-trial-handle=1792,i,4330357774472336245,776220711206472462,131072 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4020 --field-trial-handle=1792,i,4330357774472336245,776220711206472462,131072 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5028 --field-trial-handle=1792,i,4330357774472336245,776220711206472462,131072 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5388 --field-trial-handle=1792,i,4330357774472336245,776220711206472462,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
e1325a06818fdc77e99b931d1c643f27

SHA1
9fef4ea7df754e361dbdfa7c2d7f2d97388dae6d

SHA256
67d2c227824705e425fe6bd1e9d5b0f9fdf1d3deec1460dd6eb2415dc3e0c774

SHA512
9095eac53c39eff39621cd422a4ea6a5989231e46bbef59ba53eb425224d01a9982b3aaeed1e960f5aed41f9295026b73b2675402a1b26b686db043eda734357

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
2e016f2eb2a5c8d4275bc5d1a6d569d0

SHA1
39fd84c2bde7f2d5029309e18c7000f5bd5b82ee

SHA256
729cc6b2181640f9ec75ff91d234156d2f7976b02a45e678dbaf933de14a9b0d

SHA512
1d8c5e3dbbaa112b679be673658c39fac27e0832b2199553ebb1bdf454231e076a1aaf56b3075acf34cc1421d0ed4ee6e5e2f0ba3e5bfe0f29680880ed763df9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9bfe379300a3348c1d13eba76115f224

SHA1
3b26b1ee8dfc2dfa366d3a8102a33cc088de6e79

SHA256
33d891fe06b9f098b874f7163b8d08254620cca3b810850a76e66c5fa7d11ee9

SHA512
45c3a97f19313125f16a2ff80f7bf3a7167458699892c9528f0aaf79a5eacdeaed6f2fe3e23fa52d2dcf8bc79a23d087731c14307c376b1a748500030f2fa3bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
874B

MD5
5770d052ce822ecde566d274a85cd230

SHA1
d70a8797b918956e041993399a3c6aae01fb3cd5

SHA256
59e1c9827320dfb74e5120a232cb81a02d65bd16f9b39dc7075b932839f4b5a7

SHA512
d860551b5c31f850b3d055b494a43b0489adaca332ffebf1210c2c9e91d89c4008033050c47e83ef2c0a2ee35a9666854140f812f0982cdced4e16c9d41b9f74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
707B

MD5
fb79d1989e443d0827697ad7e3fd788e

SHA1
cea050d38c70919e0df32f3a31bf400800d175ee

SHA256
0776f3af483aaccbb8a53573d531b9090d0090f702899a4850abf1c19e403b2c

SHA512
2d743c2bd7f865ccf45402dc82685af574237bb71dfe0bb6b67c5b77de853a27752769f4ceaf65de6d959f54d136b8388c8a2136274785985e9bc618b2a5f3a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5da38784a14af34c72df1199168d8d6e

SHA1
d4840eab321768a9a3c64cd6ddb8a80e51e02471

SHA256
c0634128a69b5297314956420324dfda1719c64a24b71e75510c7e253f36bf4e

SHA512
aa37a1dbe2ebb2ba69f9d95a54927835fd54ca4bd2d8feb3156bac3a08bad88e408d0e5ab08ea9d3cce3ef96f3fcfc8a4b363ff9377331125834a52a374708e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
dd7eac268428f7ff0b66d9cbf03b4c4c

SHA1
7feb6d4effdeac364bf57ece92c05dfd04dd87ee

SHA256
d1e513b5f2e4a3641126c57ae5c80a21cba8b6cc7a3b2a636b28a6696d814953

SHA512
1b116e5346812addf49265382e598d87d56e79c564a61f964b3826dab18993f6d14b8326908866822081ecd28a87966239bcd23402475721d3462a7e065b3404

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
92e468ca3b124f7df62448ef1abb9f59

SHA1
f3f7fbf030bc67d72097f3b3aef5c0d1302c567d

SHA256
a64300c4184b7b5e4538cb855a8320f4af78022390a2c969d05039eb09f6c25a

SHA512
9a3fbb45405c0f54aa1b498031df9058c9dd36b5a7bde2f6908c53da2a79d0b1f20721bf1a281d4070419d5ec9e44e9b87c881ef7e63d51ded358b0cb8e7312f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0719ea111a48fdb72e4e24fb85d5889d

SHA1
a48e568536823ed383e604aff9ac865f2926b284

SHA256
8fab0fae546236599e85ea4779770a05c34080bfeeffac9324e6dbc392602f6d

SHA512
3acad3e8b594a484f576db67873317788ef4a85e7abba4e5c4bc87a136ecb0bdb7f55170b2ef293dc1f6c5f02a43dc9af2476b847b4df26aaa310b66132fa774

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
07934e808d330c0711766effca4b183e

SHA1
d6b5fb8f83803a31296ba5be111545469201ed08

SHA256
5c0b37d890ff76aa01e0356363a042f7f32026579808d5095578fdb5067127dd

SHA512
7413ad1fb5189e6a82b8e7033b6e54c0298afba8c3244edf945d7bcba3508306f596d644cc84d836df04d5acb366a22fc64d68d3aa0983a3f18b15f3f8aa4f71

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit