hxxps://google[.]com

Resubmissions

14-05-2024 01:41

240514-b4dp8seg23 1

14-05-2024 01:41

240514-b35gkaea8t 4

14-05-2024 01:40

240514-b3hb2aef42 1

Analysis

max time kernel
1799s
max time network
1688s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
14-05-2024 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601301118367417"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

4920 chrome.exe
4920 chrome.exe
4464 chrome.exe
4464 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

4920 chrome.exe
4920 chrome.exe
4920 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4920 wrote to memory of 2516	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2516	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 1856	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 4912	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 4912	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe
PID 4920 wrote to memory of 2476	4920	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa4be19758,0x7ffa4be19768,0x7ffa4be19778
2⤵
PID:2516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1756,i,2572933856295939162,17182626971163285826,131072 /prefetch:2
2⤵
PID:1856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=1756,i,2572933856295939162,17182626971163285826,131072 /prefetch:8
2⤵
PID:4912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1756,i,2572933856295939162,17182626971163285826,131072 /prefetch:8
2⤵
PID:2476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1756,i,2572933856295939162,17182626971163285826,131072 /prefetch:1
2⤵
PID:1676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2892 --field-trial-handle=1756,i,2572933856295939162,17182626971163285826,131072 /prefetch:1
2⤵
PID:4392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4388 --field-trial-handle=1756,i,2572933856295939162,17182626971163285826,131072 /prefetch:1
2⤵
PID:4552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4352 --field-trial-handle=1756,i,2572933856295939162,17182626971163285826,131072 /prefetch:8
2⤵
PID:2184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3144 --field-trial-handle=1756,i,2572933856295939162,17182626971163285826,131072 /prefetch:8
2⤵
PID:3312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2340 --field-trial-handle=1756,i,2572933856295939162,17182626971163285826,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4464

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
d165e972bd45c80afd2c72faca98e94d

SHA1
cc5f3c357aa0c0cba24de44ba1ca2e800ae35ff2

SHA256
284ad37aa948d458215af2242ab73da8daefbccc6752cf0edd60b9a2de9857de

SHA512
17ce2f77f39644ceb86065056f2ce13f4538bf0c442bc90022936d97b35703c4b476836a3c46966f52f6ba812f9c60a21d97044489768d3429485bf14352b84a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
859e6ae8907a481a913bbd48560b447d

SHA1
ba2c7c75d5a8a6ee88031ae0f60fa411088ef6c7

SHA256
d64001353a2cfacc32ae86b6dd7dc4d2a3018b6ebcc1f30a6a4791762a18ef8b

SHA512
b12229f476b1d0138d23620ce250f877062b4f75a8d90f11fe5bb83972068b3e71a77b59920ef862f2b4c71025cea4becf9fc974fd77b6beed5dc4bf901c32e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
aa0844971bb24f659c8629dcc22cd10b

SHA1
f097b94e6452d0929c2620a4b6258ffecedda934

SHA256
abfc2ef4f2660bf019f5d287897e32100fed7cbd23efdf212c440f0f0c9a70e7

SHA512
4a612df61179bcaeda1c789a2dafbf918e3abcb9ad5185dd9e747650b71ec57176fae0fdd3cc500d92943905c6b96a41be4f0b44f1239753da8144e6d1c8b44c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
53dfb9078a7fff71aa0715fc67e29e91

SHA1
f95d76252793e9a64a410dad5f9715cad65d8e6f

SHA256
7a981c0b624dd24f61d00f7447fcce886bff90e5e4bd1e1780351dec30181f9d

SHA512
dbb50a6a783e3f791c72393673df9d569b14d2666f99bed3786c45eb7309df7ee437a098f57d84f1ff5dd39f32ef5d48afbe2aae49978a96ba0d44bffcca4e59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1018B

MD5
518b649fff3599baaf249a7ceb968782

SHA1
f94dffcddab10da1bdc8b4cec46b353b32c03b90

SHA256
0c4a041dcb8e45aa13658913baca6ba2dcbee54051037d55821ae431ac69850b

SHA512
889fd2ae9bed04c9231eaa69d1ef62493aa6025160bd08a545a079116abf7a83b95db522bd315a6553e933785028df2cfbfb681bc09d8d4fa70f24f4de450708

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
371B

MD5
0e1c9f6cc5421a3927be3666a3241609

SHA1
98d179562c753fe24ec89fbe5a61709b8bcbd72b

SHA256
9b140d53b446192db294a2a754540fb9ef6c8b3b861e0584676838ebff9aced6

SHA512
6d6a1a4fb0dd18965d22b61d9f627342b6608920c39d65157c0c7946a1d48d2ac00618cc4b5dbb1fae350e60bc47702671ff8abe67ed73c596aa65e2b8b01689

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
202782f05bdac038ae35464a00a10731

SHA1
a7ccaa0309892d84bdf3cf4ab0c74decc9c651e3

SHA256
ddece184a5d4cdd5a62b3882b0b83ebfaf83af963f7b749f2df1640e45efae85

SHA512
26166c499a8ef79e577efdb96d4410523fd6e9585002c14d1db9a563373b14493bb41180cd57020dab02fe5e76b9db797a648fd911e9cdbe34030e708343c6dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
0638c530ef5b01a30f5e9f3fb087ef12

SHA1
d0832da0c793a6dc5f860742bf015add9d2e632d

SHA256
921ba57989b50c1ef90c74f42ab2057c31b09b6d14f717372dd3ed0164233bb8

SHA512
3079f345b03098610a7fe9ba5398f51853c927229cb47ddf425bac176ccbc98f225bbb8102b21449b3a4113deb3f64cb773a620043a9c5578bc1ee60255349f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
1d31c7d11abd96a623803eed19cfab76

SHA1
ba9b1b794432f5ffa5bf38f77c478344cf6a425d

SHA256
f8192afe24a1935073bd36a228c9e00d08d0520b8afa8b3b0440064bf05efeca

SHA512
d552b648b1361769560e3a200805aa5318d7fbd71f4aa2029471b94d39cbbfd1948c943096b0abf6e8fd559456df0cb7bb4daa3e88d40bf89fec83f9ab159284

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
23d7acf235ce5434cc2bc4c98c54c742

SHA1
42c1feebff9ecc3f52951afee15fad3ff7268d0e

SHA256
e383a4797b608d8dc419989ef1a8abcf0f89551a262e6ef3d5b049388fad2bf7

SHA512
d776874a3c8e8b99c6cad285906a6111bf8f21b0264ce7ed9f0b32dab87ddf5bcebee31a82ec50f3aaa954876dbd8f17d38998a79edfb4257637d920e55d77bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_4920_DTOGKBXLKSIVNZQT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit