hxxp://rsukg[.]proxy[.]rubrik[.]com/

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://rsukg.proxy.rubrik.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601569501938940"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3652	chrome.exe
3652	chrome.exe
2860	chrome.exe
2860	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe
Token: SeShutdownPrivilege	3652	chrome.exe
Token: SeCreatePagefilePrivilege	3652	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe
3652	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 2780	3652	chrome.exe	91
PID 3652 wrote to memory of 2780	3652	chrome.exe	91
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2952	3652	chrome.exe	93
PID 3652 wrote to memory of 2324	3652	chrome.exe	94
PID 3652 wrote to memory of 2324	3652	chrome.exe	94
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95
PID 3652 wrote to memory of 1812	3652	chrome.exe	95

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://rsukg.proxy.rubrik.com/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa5d29758,0x7fffa5d29768,0x7fffa5d29778
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1684,i,13980345209928555449,7399483292436293852,131072 /prefetch:2
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1684,i,13980345209928555449,7399483292436293852,131072 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1684,i,13980345209928555449,7399483292436293852,131072 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1684,i,13980345209928555449,7399483292436293852,131072 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1684,i,13980345209928555449,7399483292436293852,131072 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3920 --field-trial-handle=1684,i,13980345209928555449,7399483292436293852,131072 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4292 --field-trial-handle=1684,i,13980345209928555449,7399483292436293852,131072 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4496 --field-trial-handle=1684,i,13980345209928555449,7399483292436293852,131072 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1684,i,13980345209928555449,7399483292436293852,131072 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3988 --field-trial-handle=1684,i,13980345209928555449,7399483292436293852,131072 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4844 --field-trial-handle=1684,i,13980345209928555449,7399483292436293852,131072 /prefetch:1
  2⤵
  PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5188 --field-trial-handle=1684,i,13980345209928555449,7399483292436293852,131072 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3708 --field-trial-handle=1684,i,13980345209928555449,7399483292436293852,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3956 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
448a0297ea877d8aa35a598079d923e7

SHA1
3987a0fa2ad27c8a80ac6ce5f350bcc6b5ec62eb

SHA256
ced6d42984fe3e2387ccef97220290487445cc49d84dc09d8388db90a3ce6fc6

SHA512
1b36ff7820d6562cf8dff6bfb22a0225e4d914eec14c220bb9c4b9d571cfba63381398c1b62787e51085ba345a5c47c6ea58efae60b5f99472e00304231b8ef3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
914d8ac262c682414e66a47645c946c8

SHA1
f9f45b31bae54378f2d2536e4d2634d3d2c2fb7e

SHA256
f8c74e9235c0d206d6a5c03b6ab8f260cc7b824dfbdb4ef6427674a5b3136c20

SHA512
dc56d99e84f28e30b06821a5bb899c101c196f4cb245eb72269f4e0f27fcf9e531409bec6332ab1fd4f5fed5800c793921f89033771ba9f39ba9ebfda3d296be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
0b5931fee59626ea34edbf94dcb5de9e

SHA1
f8b02bf89bdffd848abf0fd44dc8db7ff27782e9

SHA256
bd9d65428dc6e1a1dae544b6946068cf1652963fa47d88e70f876703d397fff0

SHA512
330ed3ec2d1246a4de70c7aaa500d3e64ef18e33a6e1fa48d1bf320a5e5ec5c707c1aa074eea947341777bf96ea1bf0aa4c28e80ee44bada049ad1a99aa31174

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e935fecab70a343b2bba9b178a8f1268

SHA1
bb1fcaeb3fd8973a4eca6dcf9defa9eee57e3e76

SHA256
ea719a6df3972da2c8b63d46abf05b6d83651d99c772efc54e33a2a8e9cddb47

SHA512
966de71dc005aae66b4e664a7d43e2dc56864cfc1fd5609e64db606592b9879296f3832f6e1579a7707037c3b71ed1f4b33f447c4e13432c45bdcd7be23117cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
60f26eabd508e9ae18a12e0d8eadc9c8

SHA1
0e0f774edec8745a0c7f97365b03018e74bfa77f

SHA256
b4e67ea3c6f0a6509f5ac2d2452f278d6c3dc7433d50abbe978a45e03ffaf25a

SHA512
ec2fed52dd25f38f285bf00022df5a990bc7a4d561cfd51dfba7956b6984da6288df14355b78c6b283891ef9374b7f9a0ba7854f40a0ea968df0961e37dfff4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
31892c449d7cc26ddeb604382090cfe4

SHA1
d03717372d1eb9c3ee4522e9df45f238dc7996bc

SHA256
6477532963e145a85beb8ee8240454dccd92eb04499f37b165efe5d2a2d47b32

SHA512
0b727e3b9982d3c5a65408bd2fe45f3ccd3c69bd6fa11ef0a3fcf292824142b3d6a274cd2fa8f41f71235b4ff333795edec73a56a0816a303e5dc21a6f2a018e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
bc847f0b23a818ff7a61c2bf556fb8c8

SHA1
bce6ffdc8d34331190a55898da315726b488627c

SHA256
af1df08c5db93b32076826a1f576de670a98bd3510c8e4c1e0b7079d7f83ff37

SHA512
ae11f83add6d0ca13c0d224b63e0a509ff2f33bbd9e73ae202ef23ea23e11c51b0dadc721eb996fac0b62dab8abd3358535d16da8df90b3418e8c2748c0c7972

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
2941a391455aca595d92ade5e435e1aa

SHA1
1c53bd282026424eaec135791316a0c01dc064ae

SHA256
db479264e0f6b2768dccb85f562396055a3a71d3d12f0dfd654954b5e6ef88eb

SHA512
f93659a3a532ff5e35e268ff49d81c31944a2772723d4f17183cf0c0d33a74d5f7ee6fb3ea24848f4ddb5c03d445016d2abb361985affcb8b48f38caee33ed06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
b146a75aefd2a9122cdb75bd36c707ae

SHA1
7c3dd6ac9b22e922f82ea4cae3bb5c7e5c3de949

SHA256
302d5ed0f851676b767ccde944a7304c3f7d66ce125fea2b0c43936dab2bf13c

SHA512
c5b2c8d7569e0f22396a1a601f5cd6684da853eabcebdb9d983a85e76e87d2564f30992e39de2ecacfec5eb3407f1a28494da9dff5b70745bc9fd3458232dc3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
8371644f7912fc4a9b0c3effc8027615

SHA1
f88fb25f0cf6a76b5253ac2ed05ff37e0f1bb9d7

SHA256
c938895de40e0724b293f2ad011947b05ef9809c7f3bc6ff661945a4d349ea44

SHA512
8d33551d1f2e7ff282018904d0dac9fbe6814ff6b8a1cdea768ad0de03193f0d90ae85b61c244d563e0b374bb7e5f46c39cd124b2b80901faec612b079af4785

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit