hxxps://u3088939[.]ct[.]sendgrid[.]net/wf/open?upn=u001[.]Lbw-2FBxhdadA3ioORRjDNr96ZwVQsDZq-2B1HH9NxcviDxKdN6Tr1BFAmohABea-2F6rgCGJAGs3WtOtwGMRs75YvlPcNZqU2HJwqwFOA-2FeNJOlwnYQEh-2FULSl7PeXHwX7BsHP4O1SuLfoNl8YI5C5iFlkHtqv8YTxlANlt89Nz1kNmYd0wdFsdeR4c9ta6qrkfW6DsZzkNC3er1RqhZquGWz8adxjMJnWUQe3lhC5HVJ1SHMrY-2BZRZwnb3EHb5UG-2BHVm04JjjobOM00as-2FJW36XjGQkREClsACrdWz0RmZhHBJmMIE-2F51oGHa66nNtINoVkkGj6N-2BLAQaS1L8OdSzO4R2A-3D-3D

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://u3088939.ct.sendgrid.net/wf/open?upn=u001.Lbw-2FBxhdadA3ioORRjDNr96ZwVQsDZq-2B1HH9NxcviDxKdN6Tr1BFAmohABea-2F6rgCGJAGs3WtOtwGMRs75YvlPcNZqU2HJwqwFOA-2FeNJOlwnYQEh-2FULSl7PeXHwX7BsHP4O1SuLfoNl8YI5C5iFlkHtqv8YTxlANlt89Nz1kNmYd0wdFsdeR4c9ta6qrkfW6DsZzkNC3er1RqhZquGWz8adxjMJnWUQe3lhC5HVJ1SHMrY-2BZRZwnb3EHb5UG-2BHVm04JjjobOM00as-2FJW36XjGQkREClsACrdWz0RmZhHBJmMIE-2F51oGHa66nNtINoVkkGj6N-2BLAQaS1L8OdSzO4R2A-3D-3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133567750647671221"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
5908	chrome.exe
5908	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe
Token: SeShutdownPrivilege	4472	chrome.exe
Token: SeCreatePagefilePrivilege	4472	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe
4472	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 1664	4472	chrome.exe	95
PID 4472 wrote to memory of 1664	4472	chrome.exe	95
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 552	4472	chrome.exe	97
PID 4472 wrote to memory of 3712	4472	chrome.exe	98
PID 4472 wrote to memory of 3712	4472	chrome.exe	98
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99
PID 4472 wrote to memory of 4656	4472	chrome.exe	99

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u3088939.ct.sendgrid.net/wf/open?upn=u001.Lbw-2FBxhdadA3ioORRjDNr96ZwVQsDZq-2B1HH9NxcviDxKdN6Tr1BFAmohABea-2F6rgCGJAGs3WtOtwGMRs75YvlPcNZqU2HJwqwFOA-2FeNJOlwnYQEh-2FULSl7PeXHwX7BsHP4O1SuLfoNl8YI5C5iFlkHtqv8YTxlANlt89Nz1kNmYd0wdFsdeR4c9ta6qrkfW6DsZzkNC3er1RqhZquGWz8adxjMJnWUQe3lhC5HVJ1SHMrY-2BZRZwnb3EHb5UG-2BHVm04JjjobOM00as-2FJW36XjGQkREClsACrdWz0RmZhHBJmMIE-2F51oGHa66nNtINoVkkGj6N-2BLAQaS1L8OdSzO4R2A-3D-3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa609c9758,0x7ffa609c9768,0x7ffa609c9778
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1880,i,9453142452817354219,12334411234401700608,131072 /prefetch:2
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1880,i,9453142452817354219,12334411234401700608,131072 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1880,i,9453142452817354219,12334411234401700608,131072 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1880,i,9453142452817354219,12334411234401700608,131072 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2952 --field-trial-handle=1880,i,9453142452817354219,12334411234401700608,131072 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1880,i,9453142452817354219,12334411234401700608,131072 /prefetch:8
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 --field-trial-handle=1880,i,9453142452817354219,12334411234401700608,131072 /prefetch:8
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1880,i,9453142452817354219,12334411234401700608,131072 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1880,i,9453142452817354219,12334411234401700608,131072 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3448 --field-trial-handle=1880,i,9453142452817354219,12334411234401700608,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5908

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1308 --field-trial-handle=2252,i,11231798169170618717,17890004712654885282,262144 --variations-seed-version /prefetch:8
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
29c71cad19c434ac14d462bad67a2696

SHA1
bcdc1eff67a320e08cb86aea38ad18dc061a7f18

SHA256
b986332313d5680839cb962c2693aee9f105c29862b8dd8c0563d32fe1fb7db7

SHA512
02da3e3e8cf6189bb7cb41130a59775d53836921139c3d7149cb9f4863fc5640dcc944995e525fa59a445acd5c701a04b4b1cbeba78d91220c8c927d3665fd47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2aa699e73f3abd107002ce361d9f4d73

SHA1
b66ee91e4a47a44e394b89f43bcce0bdd8b0389d

SHA256
98d3a4f1e37470f8ed66fe87ee0f167c065c663cd308dc83aca38f6976e276f7

SHA512
6514b81cbce7368dbd7ed5f43a67f12f3eb8a43cc2d377031343af87e303325ed2180ab4011e18836e3368323862557f7ecf5961ad0d56a112981ecfaa66ba9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
122051ab992065192812719deb0f4090

SHA1
cb15dc816e3deb846a6fc97085c58c62f2c36040

SHA256
2a4b92941c950bc04a20cd28152da266fea92e9a752bc5ac4b38b336d4ea023c

SHA512
1210544e969aec96d49215f31e29c760821ca30d8541645d6205d196c7660a2b8cb64ffff8499a8b913b39305986d2922f608ac9055cc795f7f6b3fdb21dbc4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
b4e143ec26145d8df88e8d87c67dfa44

SHA1
fc9964be69c5cfa2a8ee4a943349f94e1e300210

SHA256
2be3ae07e14b2d7427fd6e53bb40216b3fea32f26d36035a8b6b87adf33ec480

SHA512
9858bedc11c1ad11df8602a93b3ed3b9fdcaf06686aea6ebb09f72b4b57c91ff3db8a04739392f2d6ea2ea444e69085a825e8231d1bf98b2dc9bf31457ac6d5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
9a9e94f09ddab0d468c2dd9a91273f63

SHA1
b1f57399e7dba66bd4a28708cef66366b2e9aa7e

SHA256
917bc1ab27e063b3141f33517011f1225d84db4f16d61ef16d8fbaf487398d34

SHA512
45dd10bf168ce0b1f9b12ae2365e378ce787124b8e47625d5faa07a09565c8750192c5a1470d092cd83f0f44e7d028ab03136521257833664e55a7dddbdf4e5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
159KB

MD5
bcd0edcb225e8686e8a2ddce39a4bb63

SHA1
a4a3d556a89f1acbe008c190007e6183a79465a5

SHA256
108af30888079caa552cc6e63199b1c1f8693b912586a692ef25ed85506f515b

SHA512
443fad24e04acb71d452137f1eb147e6c723283acc30abd4f5435ad84a62ca07bbb83d9846a6fbb294b5c5443a9a7838692f762f832b0158195e51f1071b4206

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit