hxxp://cf[.]nearpod[.]com/neareducation/new/Webpage/1206577660/iconoriginal[.]pdf?AWSAccessKeyId=AKIA5LQSO4AXIHKV2NEC&Expires=2147483647&Signature=EHztrGgvNa5yeu1nQYdU3LjYQOY=

Analysis

max time kernel
149s
max time network
155s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
21/05/2024, 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://cf.nearpod.com/neareducation/new/Webpage/1206577660/iconoriginal.pdf?AWSAccessKeyId=AKIA5LQSO4AXIHKV2NEC&Expires=2147483647&Signature=EHztrGgvNa5yeu1nQYdU3LjYQOY=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133607638602806273"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
1000	chrome.exe
1000	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2188	2364	chrome.exe	71
PID 2364 wrote to memory of 2188	2364	chrome.exe	71
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3656	2364	chrome.exe	73
PID 2364 wrote to memory of 3936	2364	chrome.exe	74
PID 2364 wrote to memory of 3936	2364	chrome.exe	74
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75
PID 2364 wrote to memory of 4200	2364	chrome.exe	75

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cf.nearpod.com/neareducation/new/Webpage/1206577660/iconoriginal.pdf?AWSAccessKeyId=AKIA5LQSO4AXIHKV2NEC&Expires=2147483647&Signature=EHztrGgvNa5yeu1nQYdU3LjYQOY=
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe434c9758,0x7ffe434c9768,0x7ffe434c9778
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1544 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:2
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2064 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2644 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2652 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3916 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3768 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4488 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3652 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4164 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5292 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5508 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2928 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3952 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3828 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1844,i,16885841553081271411,17540693225007783471,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1000

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
42KB

MD5
93b6f18ec99bcb7c3fa7ea570a75e240

SHA1
60b9e3062fe532cbc18b897fac542c56a03544c7

SHA256
43693f7bdd6146e783fab3f75ba0a51aa3cf9530adbf790dbd686fc8a17aa3db

SHA512
ac1a9398b74eb75ac4d52b9a9054a1add5a836f2572b99307851a0bb6d93288a13199e06e5df4f1391209403bf775c9235a679bd081ca7f62b7752ed0fa691c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
141717b829fa919bbfb71fbd4e4c8933

SHA1
f9a67d5f83fbef398f8fa8043b6d37df33d3f206

SHA256
89f6faf9d72b78bf72cca673461932b0e6b1ef2926557ea317a30e641f9a5b2a

SHA512
1a184199ba3ea87350a62e67ef3b35339896938e7885be79eb1c9272f0d996d8e8f173474c2338073e79cde3196f46cbb643c63a0f7baf5e171b8ac73ebde3d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
65618a64bfdb995dc836364a0aaf3a9c

SHA1
320351972ff718cdb6deb0ed4a189a63501d6be2

SHA256
f869fce9c3a19150598ecef1179c02889d533f4986eb9e990a2a99417bfa2986

SHA512
05d5176839f4a866a623b468142540a10630ea3dc2c846ac34650cad24077966a35fdfa6c0278426bf184737bdfe0c8cf2d2bcf7d3ba8eba68c18b1116f25fe8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
47c38a39e8b16a2385c5d56cf8ab4183

SHA1
11e2d3bbcbae6e584fbd788206ae340d4b51c69a

SHA256
a3f689f107108684fc173f1874be98b871902d56b772313a50751b5ed1e38a86

SHA512
ef4b34a4b4cbbd7a89d8f54eaecb005de495fb7368b768dea0950d1de1d71799f42a8b2f51ee3414e18b8a8088cd6e9b9f7da3557b2295277ecbc9b895aff8a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5b7fbcd318456c652bd6114154fc521f

SHA1
d740d9f49e9cb36a089ed5c8d7fe85dc184a0613

SHA256
5258ffae513daf1abd41fbd4bad1bffb1b12ffa97f5fd1ea489c5f81ccf1830e

SHA512
a0b01942f30887d7c9f03c092707185943bbf797918586f8f42a239043be2241e5a3fbb39a539e2d980d1c67569c4452964af109f4f3e2a4f4176d59aad71c9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
cfeb3ad2cfcc031b30b086fffb86a49a

SHA1
ef2418065383a43400287d79605ccd82be7b75cd

SHA256
da6f39a8828c9a68f6bb33378b934143d2adba8a7089adb479a0a41405859d90

SHA512
02c79c704cbd33fa0bd38ab092431e987e2998a2b0e5c1f803274857e4cf68d2f1de50ea3e07dcccbeba14cb302cb51640acea364de971cdb1a7e0af43c29a9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c09439667496d736a3e537c4d2500578

SHA1
00bb4c6978167ab8565386e41f591200758b46da

SHA256
c8492a950e174a34936c98560f37bf557d5bbdcb05b55097a691de3f22d25193

SHA512
8f7e5c1dc12228274eb0fe0c2415ca4e5993d614beaeb38f690a042421655d895037ca4ca5eb75fe4f67b8dff70269d3552ede322b8f5ef22dc5a8ffcfb3edb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
f9901dafece9c02ac61b8e3d54ee8863

SHA1
8f2e84342b19adc73b0174a90b32e20c50bf19be

SHA256
774c1f638b9c7efc91908afdbc5b3e707377910cac303c0fb8839e0b183ba3e4

SHA512
d842cf7d8eb92db9c353d873072fb8e44e90ea6d4a1481cd28714fac5883acd47291bb4081acbeb717a0bb0ae8bb3735784d54cce4fb171ea5a756f6a064fa43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit