hxxps://codienlanhdhl[.]com/sources/Sun-corp/login[.]htm

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://codienlanhdhl.com/sources/Sun-corp/login.htm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133600446387049231"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{B5C3BD27-9419-40AB-B3A3-F4D9ABCC3787}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
536	chrome.exe
536	chrome.exe
5352	chrome.exe
5352	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe
Token: SeShutdownPrivilege	536	chrome.exe
Token: SeCreatePagefilePrivilege	536	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe
536	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1420	536	chrome.exe	91
PID 536 wrote to memory of 1420	536	chrome.exe	91
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 2472	536	chrome.exe	93
PID 536 wrote to memory of 3080	536	chrome.exe	94
PID 536 wrote to memory of 3080	536	chrome.exe	94
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95
PID 536 wrote to memory of 3612	536	chrome.exe	95

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://codienlanhdhl.com/sources/Sun-corp/login.htm
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82e889758,0x7ff82e889768,0x7ff82e889778
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1880,i,9443453719116669688,14265106536726196938,131072 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1880,i,9443453719116669688,14265106536726196938,131072 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1880,i,9443453719116669688,14265106536726196938,131072 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3200 --field-trial-handle=1880,i,9443453719116669688,14265106536726196938,131072 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1880,i,9443453719116669688,14265106536726196938,131072 /prefetch:1
  2⤵
  PID:372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4544 --field-trial-handle=1880,i,9443453719116669688,14265106536726196938,131072 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 --field-trial-handle=1880,i,9443453719116669688,14265106536726196938,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5356 --field-trial-handle=1880,i,9443453719116669688,14265106536726196938,131072 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5380 --field-trial-handle=1880,i,9443453719116669688,14265106536726196938,131072 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5460 --field-trial-handle=1880,i,9443453719116669688,14265106536726196938,131072 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5792 --field-trial-handle=1880,i,9443453719116669688,14265106536726196938,131072 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 --field-trial-handle=1880,i,9443453719116669688,14265106536726196938,131072 /prefetch:8
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 --field-trial-handle=1880,i,9443453719116669688,14265106536726196938,131072 /prefetch:8
  2⤵
  PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5236 --field-trial-handle=1880,i,9443453719116669688,14265106536726196938,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5352

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2340

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x44c 0x150
1⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:5932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
ad4927e9b2995639b2b7d691169eeca7

SHA1
c7a98bd00285b3734970e472cb3133ad118f71de

SHA256
4944e94b25783fe1a60a7efa4526e5024a555568bdfb520b27306b246a0029fe

SHA512
4ce093100c3ee0319b064f9bd5992c5467245921daf45e90553f1282dd17f8a611aaf67f9726f3fc19de3590579f2770e273a6cb643b2c8810d18cf167c7dc8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
9eeba03e2985e5cc170c52173b124a55

SHA1
57298c081faaf6019fb9efc27ab627b24f8cd2a5

SHA256
07951c5e04f2bef5d44a80fb882b531c74172c87f47541ea3fe448d7248c2af2

SHA512
b1bb701dba3989bd1da3827b32e13d43cecd2995ccbb426ec93978382b315d1b346b78a55158195e41bf7a762cbed8e79ae1b7921aef819b99a78cbfc2f8fe22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
986B

MD5
92c87a26ea9c63826bee4ba339770cfb

SHA1
8d7425b4cc1ee790c0c0cd8037646641daf4f7db

SHA256
68278ecfe9e7c427669c7e31049b8ac35756ea97f9c25d36354f1d5bde309140

SHA512
586325f25ccc0553f8202e6f0713131b033f4de71150105419dd1affce9db049d15b123b76501e74918cf34bbb963ef9d9bdf1950ce1e19c02f6dc1f46a090b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
870B

MD5
b654d4107aadc241f816ae07f68aa61a

SHA1
13febd5e7a265ea4da0aa7c8e4f270d9830015c6

SHA256
114876440b4704f3439e8174e4fe64ce22c1a45ab9fce31a8cac8a37cf04d50f

SHA512
9f8b25ad1f9fe6e20d512f3b368566416a27800f7c2064f1c9572486b95f4d7435dc4cde7281a604a4e70c40b30dbedcdf0d2f2b1c87ebbd188fe7bc9cb1a6d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b55dbd15510ec764e6ddb25ca433a2a8

SHA1
e34ca0fe281d2c147397e3caf33827fc9fd06ae8

SHA256
c9c6c4c3a5fc47fba91b48900c85012af0079b3279b69e4c3fe7762f9d41292d

SHA512
468c2cc609ea446d20d4ba943699034e022cd5b4324a471467425a824642876c93cc38bb98a21cf5de3bb6ca9c03097c90f09c4cb7040238ca2858f7d50d926c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1d4b5487586f4a0258504bd51442a4d9

SHA1
66372da1d3011c2cb9305d86e5d02a61d90388be

SHA256
a24fbdc26d2b38c37d4d7807aefb00d193003d4f6f554eebceb8f10baaac48ff

SHA512
3873ca78cae8288010ebf89524fb37d7ffe709b204af06149fe491ca4846d6ac4493960e52b7c583cfa301ac3b55dd8828fad4a7e881a2d117a667e6ee1e3821

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
03a432740c680b404217a63b2f363ad7

SHA1
799e931212b8445643d1fdc315ae12ab208e0b76

SHA256
7b01b43fa09906486625cb70aaf63dfe5a806879702a2a48079d54daeda8587a

SHA512
68c9683bffad8b852b73b2f607dd5e7a7245545212ef877aff7c482e1b40a334037ba5b92e11be695df4707f6774cc7fa439cb02fd0b602abf415f92abd46610

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6559615909a1336c651accaa9bdbb570

SHA1
2d5d9f312400a44d021f797d512141ce0dfe6a69

SHA256
924d2a50b9d11f0f1908fc455dee6255ddb9710769c5737f15de0212c49f0c40

SHA512
08b8088c4ef3e33b736120bad1524274d5e1520eed00e12548649afd5db1dfa2d0e7b7f12ef9f15fa2c5a06050465173031739bf5d70ea880b6e047441044622

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
b689a53d2c44f60b9642166041e144b8

SHA1
ee6add7b71fec1f794bd3c5cf3bb950b25370293

SHA256
034f8ec5311c416abd1bfe2fc18afb3631d787d8bdc0d2edcd8f924712ef70e6

SHA512
615170db30700d550c8dc2d14daf0cdfcbf6ad37f14d89db57d702a06e0f8966a173e9f22db5421175f64d60ecd08acd0c3fc7cdcaba3b5ea8f4afe385501c6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit