hxxp://www[.]invicti[.]com

Analysis

max time kernel
149s
max time network
148s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
21-05-2024 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.invicti.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133607824466722761"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

588 chrome.exe
588 chrome.exe
644 chrome.exe
644 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

588 chrome.exe
588 chrome.exe
588 chrome.exe
588 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe
Token: SeShutdownPrivilege	588	chrome.exe
Token: SeCreatePagefilePrivilege	588	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe
588	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 588 wrote to memory of 4868	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4868	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 3036	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 2944	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 2944	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe
PID 588 wrote to memory of 4696	588	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.invicti.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe349d9758,0x7ffe349d9768,0x7ffe349d9778
2⤵
PID:4868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1840,i,8106876626149211638,16056384358679909145,131072 /prefetch:2
2⤵
PID:3036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 --field-trial-handle=1840,i,8106876626149211638,16056384358679909145,131072 /prefetch:8
2⤵
PID:2944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1840,i,8106876626149211638,16056384358679909145,131072 /prefetch:8
2⤵
PID:4696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2612 --field-trial-handle=1840,i,8106876626149211638,16056384358679909145,131072 /prefetch:1
2⤵
PID:4468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2628 --field-trial-handle=1840,i,8106876626149211638,16056384358679909145,131072 /prefetch:1
2⤵
PID:4612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4644 --field-trial-handle=1840,i,8106876626149211638,16056384358679909145,131072 /prefetch:1
2⤵
PID:368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1840,i,8106876626149211638,16056384358679909145,131072 /prefetch:8
2⤵
PID:3768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3008 --field-trial-handle=1840,i,8106876626149211638,16056384358679909145,131072 /prefetch:8
2⤵
PID:2752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5072 --field-trial-handle=1840,i,8106876626149211638,16056384358679909145,131072 /prefetch:1
2⤵
PID:2332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1840,i,8106876626149211638,16056384358679909145,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:644

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1056

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
6fe5721b95c96dbd1e7bd546aab246a9

SHA1
70bc2711893ed6489e5143bfda43eaaaf9486782

SHA256
e21fde4109347395ee705f7af2dff77a1f1af0894bd36b956bab9b20e533fc91

SHA512
12dda5473f64a11e9ab3970669b3a9ec7a9267266cc3fd4e2111c11bbfc2ff66988890fe90a7257ea24f8b425ab79cfc4256cc66b5745d8dbdc4e3cab63583df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
10ffdb637c028cbe88281f2c51990b86

SHA1
4e5961ad5e06469e166662b7112895bb7e3dfff8

SHA256
1d94a693d38cb187f79b5e6f1e2ce6d0ac8b6116eb5c824d4d25dae640be79d8

SHA512
61a50045eb5a536d0aa7566e387911daec134d5ba728d6f022dee107b2f6e7e32d77ccb7a0e14e5752b7d658e026f08a493f4a28fedfa91722dc652d82c4f64f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
4cdd9878bdad6b4d6badc3eab92be2d1

SHA1
e863cbbd1d54288db64e467d53085f5676f51037

SHA256
b40c2fa0c2b4295b4ce493d7467e6fccb147f8d8c629a077112659fe4023b77c

SHA512
239424c47212087f08b122a6a8eba8a00209e5cd0327ac19631ad28ba0fe0428c0732a8da257b3a6f3b424643ef2064008e55b314dce69ef776c8429f51c5550

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
793194de67202ed98377b65d00b7181f

SHA1
f3ebd3542642a07ff8472f8002cf0468ea099e1e

SHA256
49a7fe59165451fe37e57e5b20d2c831018e35de5c32edf206e0b41ec7b731a7

SHA512
e7cf34477b46209a07591f6d4cdb2aaeb88d25449c1adef3894fed1e6627d49532a1753644510051744e2e7cd252ca7b1a62e0ff5ad04d0fa4f3824402350804

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
c4546b73dd01d42c075bbefe969814f1

SHA1
9be4dca131b47fb66b61904e64b89d77d0b82200

SHA256
b22af3af3d3afb19351cb27f301e455b15206f083323d12df8089ddd4a2a1195

SHA512
755590bc5968a911e6c6fc23b46641ba367660a27103f19dbb12f80e3eb8fa98362f0e06ffcc0422a78e08bd81254b72e7d7b2e105a8adb05e525e8a43ea051d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
5d4878ac7a2874c2750ac0c472fc0d05

SHA1
c3c9819a1029a64af24a337dad3879e52accc7c1

SHA256
3f3d3651aa1ef6080a09d15c7134e41d04a05b551e29a618939357637646deab

SHA512
1ed156891cbf6ce387b6f9bc86702a8d91c89aa18cf039323ac474ddd5c4f89be5e763d5bec666d700cc7f560b85b42dfe3095548610cd8e35e90c5bf8ad849e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
2aeff7b38c9414a73c4eb1c1958ff664

SHA1
5fad967648ebd60f75d1101e252486596706297c

SHA256
bee96225dd0474fe68f56c45f24f820e10ed331d999f6919bb2b144bddce5902

SHA512
0ed5505ba61552ade969afabc07beaf9fcf29ee7bf2f26f1bf2b33543724d2c1e820858641516d1fd626def1689f7f6735b7283bdab201818cdcd950d833a970

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
543ce8b99048b15ffea39a24d0e8b9d6

SHA1
d55255511a979af185862c44893a743dd7f8dfde

SHA256
f4e4e3b23057f7cfa9589173059d48b9d09608e817efc7d7434f60bdc5d6b101

SHA512
a6d0e4f804c2f7fea4cc960836bd22f5a7c294b74115fff19d637850001eb659a9eaeab9863f7789db4f5c2574eabdb90c7d9580d9e69f674d305e40a89b90b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
c5aa3059ee0e0ba44641a40dfb7a1d12

SHA1
d63b85987d58f90fc1cf5511668fe2a6d9f515b0

SHA256
72001298c08fdd89aeb362d697f7cd5045f79f3375c542ddec4d995d6e4d9bda

SHA512
a539e59240b4e8cd393eec04403e4315440cf323542e4e426a62da20f1addca13fe301d3d9f6fb99a039a2cf5086fbd73bd1cdc95f64fcc71d80f14be7acbf07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
185ab4a87f54cc62c739f4ce8bc71de8

SHA1
6546599040221a59ecf2d46230c696f729a2417e

SHA256
8a1406881a7eefaf7cb0b5b0bfeaa545318a0f7d63c6b83a533ca2c7a740462a

SHA512
88b98d3fe1590faac4e01173de60a704321a14ea5ed333876b9a06c13600c0045d70ece35749273ed90d802e42368a69f82178f0df27d603b42dfde0616b0ca5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_588_CTXKXDNANOKXWWDU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit