hxxps://link[.]mail[.]beehiiv[.]com/ss/c/u001[.]MjqciNziQ9SRAWwP9F7s9TLgNcR0e4Ymmvo1s7cavXqkR20yw3fki05wWYL10Cgoi9N9BrPaYxAPYtvDzcJJHPEClIA2wrGHsMhlAOIW0dARUS1bWYe0pVacejiH8tde84a70gZbt6aRxWH7napo0eDb-oFf7a1YOc6Wdk6qdiVqlxO5n4yp5vgu0_tYkPwBUCNNO8N7EoKdz0_QUETt3g/45d/6lG9LWkSTR6HtM2oXFsGKg/h5/h001[.]ymt7XrIKFZFAafrispbDos2NJRgRu0TX-_B8tynm1jU

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://link.mail.beehiiv.com/ss/c/u001.MjqciNziQ9SRAWwP9F7s9TLgNcR0e4Ymmvo1s7cavXqkR20yw3fki05wWYL10Cgoi9N9BrPaYxAPYtvDzcJJHPEClIA2wrGHsMhlAOIW0dARUS1bWYe0pVacejiH8tde84a70gZbt6aRxWH7napo0eDb-oFf7a1YOc6Wdk6qdiVqlxO5n4yp5vgu0_tYkPwBUCNNO8N7EoKdz0_QUETt3g/45d/6lG9LWkSTR6HtM2oXFsGKg/h5/h001.ymt7XrIKFZFAafrispbDos2NJRgRu0TX-_B8tynm1jU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133571423430032053"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
2820	chrome.exe
2820	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2112	5068	chrome.exe	86
PID 5068 wrote to memory of 2112	5068	chrome.exe	86
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1688	5068	chrome.exe	90
PID 5068 wrote to memory of 1012	5068	chrome.exe	91
PID 5068 wrote to memory of 1012	5068	chrome.exe	91
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92
PID 5068 wrote to memory of 856	5068	chrome.exe	92

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://link.mail.beehiiv.com/ss/c/u001.MjqciNziQ9SRAWwP9F7s9TLgNcR0e4Ymmvo1s7cavXqkR20yw3fki05wWYL10Cgoi9N9BrPaYxAPYtvDzcJJHPEClIA2wrGHsMhlAOIW0dARUS1bWYe0pVacejiH8tde84a70gZbt6aRxWH7napo0eDb-oFf7a1YOc6Wdk6qdiVqlxO5n4yp5vgu0_tYkPwBUCNNO8N7EoKdz0_QUETt3g/45d/6lG9LWkSTR6HtM2oXFsGKg/h5/h001.ymt7XrIKFZFAafrispbDos2NJRgRu0TX-_B8tynm1jU
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff882e29758,0x7ff882e29768,0x7ff882e29778
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1860,i,14541556568468238961,17399256844856076898,131072 /prefetch:2
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1860,i,14541556568468238961,17399256844856076898,131072 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1860,i,14541556568468238961,17399256844856076898,131072 /prefetch:8
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1860,i,14541556568468238961,17399256844856076898,131072 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1860,i,14541556568468238961,17399256844856076898,131072 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4576 --field-trial-handle=1860,i,14541556568468238961,17399256844856076898,131072 /prefetch:1
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1860,i,14541556568468238961,17399256844856076898,131072 /prefetch:8
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 --field-trial-handle=1860,i,14541556568468238961,17399256844856076898,131072 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3428 --field-trial-handle=1860,i,14541556568468238961,17399256844856076898,131072 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3412 --field-trial-handle=1860,i,14541556568468238961,17399256844856076898,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0f69107da4fd6b88484f3d1a2ef3e910

SHA1
66e971890c79dc2a09cb1378878869148b1e197b

SHA256
a6c8aebd267f1c43e4e3d7fa07766c29010f6142324fd0e21569edfc54c8da3d

SHA512
793c3e0bffc85c2dd3605b7d107fc84140a06569f8e045c1bc49b6eee2ce5d6dcdfd1d1421e1f3c25b3674276e2c20b416498749648b5ae96c0675b8d5b61846

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
8e71cb317e655f981d7bddefa77f3046

SHA1
f9c373a81407707f5f83ea48eb5fa0c69d051630

SHA256
f2c518cea7434ffa80bce72a0cdbb6ced22c71d9b4f6d96254c3555d26df7255

SHA512
9218f056c2909ce221dd8439d55ffe995f930f23109d3544e0dcb4cfa835996db427f2eceb5f0a5f257fd46c0e252fa950a89573bbf39214eeed66ec524ff0b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
6a6937d4f8709ec3f702a35d5bea485a

SHA1
7afa3e26b5a14d75bc682de7267bc1e83c6ec85a

SHA256
a993b6afb97ecc350179028f7622064f1454c43c4c29cca223a25e928d8cf5a0

SHA512
ac6c354a396550502e9972464e4ff5e7cc7cbfc194ae790a14b75731450001f80e82c5e7706b7d16f5407c7b632039eefb68639ff2334d3db2467859feb62967

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
cdbdf15a93b3d1024b99e2c9fa53d58a

SHA1
8d096cdff190a96726b7885ca3f440e05844852e

SHA256
6f8a5331e66cd3dd0ac1513c4d1a8d49db1806bbf52c6b4666c828987b69315f

SHA512
06b2da7221a7e665e527f84933e952f92437606314e31eb6f1f486e8fb5b8a90b2c4344242aecec19cc6695c4b18d12b3c3df611c9326f5512cc407c3cc369cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
164c251126b90ee92be8f6f1d41bc060

SHA1
fb81f98286b855c57a089ea8097b39b47dc495b6

SHA256
96dbd430a1fdb2bd4f9392c3986bb89a702408df9113f7c5f9ce476c4501166d

SHA512
740a288d8022f28762a39ea86e62d9c6f33a8c3b5f12d752a0ac7f2030f28c880642a560e9b78d1d3d562c507fed1beff4d74452dfede59f9e90ad2d7585dc8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
5dcd6ff1b1e7617c61c08b295232e7c4

SHA1
544e6934d26b5b83576db5f434776b975e7ba234

SHA256
7cee7c1b389224d729556aeb7b6a5f60657bade50a4e0e1c960e5af4db90921f

SHA512
6f297237fe5413ec47090faf876bb2e342c4e6efb58492af5ed8044e62b88ee5f255d2f4bebf16259ef80f6a7f1f04b9a477cd5acce3ec8a9c723717f8fca6b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
874B

MD5
f51d57322fc495b5b0ca6f0a1761f8d3

SHA1
18f36ae458a9c5736b0559c9197207c43b162973

SHA256
78aa54c6b12cc3349e2a5282398a8c5b2cbc907b3b335a7381a2d45140141d72

SHA512
60fb2901121975324cf4f9f04928f7c8f5c446307d6cad072d4c5269f3ee011a3aaee18c2c5a3e282a6760c19de565979aeaa9f413fbe0e76e31148abe21340a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
b7f2e3dd4a651feb1d71a5b9bd971270

SHA1
da0065184c5cf329bc287c21113d6ba974614a19

SHA256
9d37f62759ba4fb5e5454b72d4f37fba7ce841166ad0878ef730819f623f59fc

SHA512
b37048693f30cf2a8c09b3588c1471ca31db39679b8641ad2c3cfd2d7efcf4f6ac336852bf9c4b2c2c7b12bd89d838763306a5d9461c68b1a9e2abc67dc0831d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
596381f977941dbbe70b174a035f1971

SHA1
5815b6747e7986ac4b6c850dec93d92a59c15cdf

SHA256
0580787c141c716b0557c86f21decc4357ffcda2888c5e123ed6f5596096df21

SHA512
5a5054fca14fe170bd08bd654cb35a033e49ade15d573c59131d91244a2f9f52fdc7ae409ac04c63b7fd8f269867022bd9e16e9d5ae1335c75a1be16b00f72e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5a7a49e9d28006d13cb8c0a4ae6b4b8a

SHA1
26533888fe0c48c9c07371e4e13459e420a709a3

SHA256
de472a21af6c367f8cfbc5b6cbb4adc25f7464d9ae577b4d0bbe1e291ca0583b

SHA512
1f95de195b694a5f5b227530d0d426a66ae708caacc6210b65059beb02c4ad3e675e02cc1b5a24d18d3e53635a27f5dd8dfded9fd6a8c327a2b28122021a89aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
b1347b28077b5968661c8c28b29efaa6

SHA1
2d413685648ab8b31c5cd695c24a52e416c80404

SHA256
960a2f2dff87f0dab9cc6ececaba666cfdc196c473945b521d8b112190cec421

SHA512
3cad7defe2358db3f37b228500651df7ea7390f4d34fb2e0962413f97441e67a16e52c7add7ad70faaba004bf26774ed9beccad730e9cffac284ce7af9b7ff60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit