hxxps://secure[.]ngpvan[.]com/p/eSpMjpg7akynRvfQKWTWlA2?utm_source=ngpvan%3a%2f%2fvan%2fNGP%2fNGP50%2f1%2f103270&utm_medium=email&utm_campaign=35baa705-b5ef-ee11-aaf0-002248223794&utm_term=unsubscribe&unsubscribedata=ju1AS2REiUFnvenPpCD5ZVxvcRnDLwTU3hKV4BcVvLCH8Ta7q5xnPVVz3%2Bf2Oda6xY4XGAWBaFz7jf4kcw1HXP95Dn54b%2Bn4gFQsqd80WbVb7pPq3gYdQJC0GEDfqmRiKBqqXmSVo3TMyt2YTW3Pr0Nt4vgCZsU9bCevg28B6OncUCeqcMdVuN2T03fW%2FvcdH0KbAfkU0NmgvrHBhNdlmHAmGeyFaAejMdu%2FzeOX8Y1WuaHa2Y22XDA1PlAn7KIgLhHwQ5Azaeqa%2BSEbbHQ%2Fs1hMpGbDhiP9TxwWPhe3Cp24%2FuWKPftMKcBRoAHVQNzw6ob1VmF5LEs%2F65gE10uwg4cpxWdGlfk%2B2LjerXSXcUsQJjO8odR1fTW92tNjWqXy6cW6Sgwrm7MrSj9ipSkkR0KTQQudpRPpj6j9Cxo9bR7b3JuRPVSw%2BZi4Kqc67vaI

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://secure.ngpvan.com/p/eSpMjpg7akynRvfQKWTWlA2?utm_source=ngpvan%3a%2f%2fvan%2fNGP%2fNGP50%2f1%2f103270&utm_medium=email&utm_campaign=35baa705-b5ef-ee11-aaf0-002248223794&utm_term=unsubscribe&unsubscribedata=ju1AS2REiUFnvenPpCD5ZVxvcRnDLwTU3hKV4BcVvLCH8Ta7q5xnPVVz3%2Bf2Oda6xY4XGAWBaFz7jf4kcw1HXP95Dn54b%2Bn4gFQsqd80WbVb7pPq3gYdQJC0GEDfqmRiKBqqXmSVo3TMyt2YTW3Pr0Nt4vgCZsU9bCevg28B6OncUCeqcMdVuN2T03fW%2FvcdH0KbAfkU0NmgvrHBhNdlmHAmGeyFaAejMdu%2FzeOX8Y1WuaHa2Y22XDA1PlAn7KIgLhHwQ5Azaeqa%2BSEbbHQ%2Fs1hMpGbDhiP9TxwWPhe3Cp24%2FuWKPftMKcBRoAHVQNzw6ob1VmF5LEs%2F65gE10uwg4cpxWdGlfk%2B2LjerXSXcUsQJjO8odR1fTW92tNjWqXy6cW6Sgwrm7MrSj9ipSkkR0KTQQudpRPpj6j9Cxo9bR7b3JuRPVSw%2BZi4Kqc67vaI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133570550055642526"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
2600	chrome.exe
2600	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2504	1908	chrome.exe	86
PID 1908 wrote to memory of 2504	1908	chrome.exe	86
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 4232	1908	chrome.exe	89
PID 1908 wrote to memory of 2888	1908	chrome.exe	90
PID 1908 wrote to memory of 2888	1908	chrome.exe	90
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91
PID 1908 wrote to memory of 4344	1908	chrome.exe	91

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://secure.ngpvan.com/p/eSpMjpg7akynRvfQKWTWlA2?utm_source=ngpvan%3a%2f%2fvan%2fNGP%2fNGP50%2f1%2f103270&utm_medium=email&utm_campaign=35baa705-b5ef-ee11-aaf0-002248223794&utm_term=unsubscribe&unsubscribedata=ju1AS2REiUFnvenPpCD5ZVxvcRnDLwTU3hKV4BcVvLCH8Ta7q5xnPVVz3%2Bf2Oda6xY4XGAWBaFz7jf4kcw1HXP95Dn54b%2Bn4gFQsqd80WbVb7pPq3gYdQJC0GEDfqmRiKBqqXmSVo3TMyt2YTW3Pr0Nt4vgCZsU9bCevg28B6OncUCeqcMdVuN2T03fW%2FvcdH0KbAfkU0NmgvrHBhNdlmHAmGeyFaAejMdu%2FzeOX8Y1WuaHa2Y22XDA1PlAn7KIgLhHwQ5Azaeqa%2BSEbbHQ%2Fs1hMpGbDhiP9TxwWPhe3Cp24%2FuWKPftMKcBRoAHVQNzw6ob1VmF5LEs%2F65gE10uwg4cpxWdGlfk%2B2LjerXSXcUsQJjO8odR1fTW92tNjWqXy6cW6Sgwrm7MrSj9ipSkkR0KTQQudpRPpj6j9Cxo9bR7b3JuRPVSw%2BZi4Kqc67vaI
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff865049758,0x7ff865049768,0x7ff865049778
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1840,i,11036271677572963742,2952417986198547160,131072 /prefetch:2
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1840,i,11036271677572963742,2952417986198547160,131072 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1840,i,11036271677572963742,2952417986198547160,131072 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1840,i,11036271677572963742,2952417986198547160,131072 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1840,i,11036271677572963742,2952417986198547160,131072 /prefetch:1
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 --field-trial-handle=1840,i,11036271677572963742,2952417986198547160,131072 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1840,i,11036271677572963742,2952417986198547160,131072 /prefetch:8
  2⤵
  PID:384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5196 --field-trial-handle=1840,i,11036271677572963742,2952417986198547160,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2600

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
fbbadcae5ad20a9363563ff2f2a722cf

SHA1
8d928519312b68e73dfb75942cb1313a26753e55

SHA256
82e651427d930062a9346ca6e38ecde62c50bc53c6aabbef406a090a5773b791

SHA512
ed880bdfcb82cca00ea5be4f5c6daa8707d6adcafc62c35956a9e97e323d6d8c5e981173380faeee65d7127a4cf607a3ed63e3a9d357bfa8564828d48b722ebb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
997B

MD5
410cf5650b3323b0ca357d1e49551b76

SHA1
987679308437dfdd3b490a4e62849a4232ca81f4

SHA256
cc8c229e7979d46763348aac471958a4ffc02d4d34c589aee0d239b742ba2563

SHA512
a6fee7ed7fa4a3b292ddd008f0fd34d172ebabad0d2ba44c0aae43f2f8f68b92361bc75b355c2405399f39f27bd367c0b1a72b9016a2076d42a85ad9b3bcf66d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b614052bf034af8b8abeb43839eae2d3

SHA1
d30193a89ea9a56f8a7d5c3d2b6f7ed3144573cd

SHA256
fc121e0095300bf47790f3bb865dea9b1b421bc11f2e1ecc76864072b3a2666d

SHA512
2f2494023ce5523d6ff2380edd324646cda732c78347b765b4b04813116afae453a727ef182605225e025d4d22a976bdb4448a58da845e79de8f82d55ed409d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
707B

MD5
22774acc58ca3909e37d84a16fe1f75d

SHA1
8d5cb45b89ace2247e9e35ca2a351a899caf5b7f

SHA256
2bef0ac04208dfd7a369440ac2a03e6082293cff69b3f47313ae744fa3a0e50d

SHA512
690623e28cb6bd83eb312d1fb4fc4e0115323af394bbceeeb3e0b8120e63eed7bc4a6528a7a9d2304f9eb2a7d8e98201d930a1e0b685eb898c126cea1ca3f6c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
707B

MD5
dbd1f6448b0fb15b0999491cd1d88e5c

SHA1
fdcbab8b10382c0dfd40995b79c826359d5275be

SHA256
e76d26861507828c9f08a98994daa267e85b6eec897cff9aa2af3279cc2d3fc7

SHA512
14b5141c96a9ece1e89be5ff3fc6c9f38080d2075d7dd222681e5481dac7b27b6e7da81f026ff089ea2040d4ac5633cd3ca2d52679a29b70314f3645c7c37581

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
44b78295aeb6284049fbdc6afe1743e1

SHA1
d64027635a61d6b0d9c7d9a88091b0daf8d8b481

SHA256
7e2b7fb8bdc4e5231a446eb044bed99798c60fd4c91316bf1b875ad2be472cb9

SHA512
d0fd033516f40f7a9d845c7e2c8d440ba98a32068dd055de08b89e951e02bd894ce444ab353ffcc99e52364bf0e39de34007afa67884da83b7f7944c0c9235d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
5862a99c23c4eb8b16d24075e8e994e0

SHA1
05dbfeccfee40fec13b22654c1468d3db3ec5005

SHA256
ea7d7fe93dfadb11fda4a204555db9fb37c29b919ce457f302d54ee30e579dc0

SHA512
e4edd35c5e7e8f7349f56f80af2a3617e34539dfb0c92178cdb5c3641ae4cbf11ef2904a98120a297a89219dd79881562bee81116e5cb4488a898c3606fd223e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit