hxxps://db0000000dh7ueae[.]my[.]salesforce[.]com/?c=Wdc1JzVUf645U2oDSyg98UqKHcw7NU8zff[.]tCForzsNqy6iSWE[.]zW[.]GNps0tEBBfnLqqeWX32rzI8CPcsXc06xXMcqW4n3Egk3ZiUrWpNYGmVcLUO7KfIl4[.]xJljDMqbsMhV0SbIcKVaahto_p6fxFzMQ0w56XkCrtl8TaRDbs[.]Y2LOHr45MJvy3YamdQbOQ3Wl0EjEtf5f4BAXOrHVQlQD2tAZSrQ%3D%3D

Analysis

max time kernel
600s
max time network
525s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
23-05-2024 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://db0000000dh7ueae.my.salesforce.com/?c=Wdc1JzVUf645U2oDSyg98UqKHcw7NU8zff.tCForzsNqy6iSWE.zW.GNps0tEBBfnLqqeWX32rzI8CPcsXc06xXMcqW4n3Egk3ZiUrWpNYGmVcLUO7KfIl4.xJljDMqbsMhV0SbIcKVaahto_p6fxFzMQ0w56XkCrtl8TaRDbs.Y2LOHr45MJvy3YamdQbOQ3Wl0EjEtf5f4BAXOrHVQlQD2tAZSrQ%3D%3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608996748985279"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

3032 chrome.exe
3032 chrome.exe
4320 chrome.exe
4320 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

3032 chrome.exe
3032 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3032 wrote to memory of 2128	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 2128	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1176	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 3096	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 3096	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe
PID 3032 wrote to memory of 1464	3032	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://db0000000dh7ueae.my.salesforce.com/?c=Wdc1JzVUf645U2oDSyg98UqKHcw7NU8zff.tCForzsNqy6iSWE.zW.GNps0tEBBfnLqqeWX32rzI8CPcsXc06xXMcqW4n3Egk3ZiUrWpNYGmVcLUO7KfIl4.xJljDMqbsMhV0SbIcKVaahto_p6fxFzMQ0w56XkCrtl8TaRDbs.Y2LOHr45MJvy3YamdQbOQ3Wl0EjEtf5f4BAXOrHVQlQD2tAZSrQ%3D%3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffcca029758,0x7ffcca029768,0x7ffcca029778
2⤵
PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=252 --field-trial-handle=1836,i,8847273533509972993,16745147430665267357,131072 /prefetch:2
2⤵
PID:1176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1836,i,8847273533509972993,16745147430665267357,131072 /prefetch:8
2⤵
PID:3096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1692 --field-trial-handle=1836,i,8847273533509972993,16745147430665267357,131072 /prefetch:8
2⤵
PID:1464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1836,i,8847273533509972993,16745147430665267357,131072 /prefetch:1
2⤵
PID:1508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2876 --field-trial-handle=1836,i,8847273533509972993,16745147430665267357,131072 /prefetch:1
2⤵
PID:536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 --field-trial-handle=1836,i,8847273533509972993,16745147430665267357,131072 /prefetch:8
2⤵
PID:1280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4268 --field-trial-handle=1836,i,8847273533509972993,16745147430665267357,131072 /prefetch:8
2⤵
PID:3536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3676 --field-trial-handle=1836,i,8847273533509972993,16745147430665267357,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
db6a9468b75c184aa3910c4048d30779

SHA1
2af9eed9f866de8dc9b0fee5d5c3e7220bf2ed6f

SHA256
331747184b17d187db4c0f6fa398208b8e234acfd36ab4afbb20d2b656748b5f

SHA512
7f2293781a95e67b9bd3073faea31d3270162b22c7ff7b0436fff0e26e8d3e96fae0eea79e45ef60c4e037ad981c9638f1039bf23f5ddec2425dc7490dede8a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
ee40cb5f54615b4def46ab7df5c4a546

SHA1
a657305474348f15d9faf3421613dc772f851f23

SHA256
74922442f0016041219495534e53ff24acc653c21c236245f3b80b311f70b514

SHA512
c632d19f9d6ea7b148f90d3665b788de2baeedcdb5498e96abe9d1cdf426d572a420ae769c5ca51308846830ab889ac69dbfd217a8472308f2a355a6ede8d631

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
420317258862c220e21daa1e38227c86

SHA1
febb74e5cc17a1a8661ebad60cbd08f83be3ae93

SHA256
a5dd64d46aac9e0d4d1cae755286863a8e145827b71f139d7598883404619e72

SHA512
8d16c73a146056e1dc87fcaf15acbc0ed26098015df6c2927b0aa897f6382f7a8d5aa44273b1e3aa4af446b7662df8152ec5442a0aef0f923d58303c747dc3a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
845cbab9999b579f470f5256aa5e01f0

SHA1
e4edc476d6c9f0c4f2d2d11eb71fe112729c9172

SHA256
b285e7395a336c5593a59425d6b3cff7e0a8a8a98e2f841bc3e20034f36df567

SHA512
fc885ca4fc779c762a5c41da0851a2a606e30517f3ff422a0f8717c210d592cf091669ee615b6111065c642257244ed5903d419ad988353e681f1c566edb57b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ed34a5a377f913bcea8849cdeb714f22

SHA1
067985feb16b4a5292a51aa85e5aece41a442b5a

SHA256
dca41df41735bc5586a759cec09eb840e3b397f68531e3e01d35a823304ad27e

SHA512
0bd13e6e066c3db44855cb9cbcbb984e2d4e9800c1edef2180d4dd8ed3a37b32508a66ae6a8a815e31c137e4394c7706bc10a3c2ab6127325a2e775a552520f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
58735078e4b4ee22ce97ec442e38f8ad

SHA1
36a3f91b8f2c2439e021573083ac4f908efee940

SHA256
a9105f7ac6f43d899b8cdcb5e1d249cd392d3e970d501800682c66d54591a9ad

SHA512
001e24a32635f09a71943993e9f845a9d21f1c4b2a4b344fa0967d481addc2465d0855e830e076e270f5d9681ab251064160dcf13b5cef7bac211a2b6fff5ee3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
132988f57dc2d3a268b1a04c426a2f6e

SHA1
d416cf030f50fa947769431822cca517651f5c84

SHA256
6f841118fb6395ebbe7d2da7ce19ee9aebc17eae7cbcdd3555523bd24c4d1adc

SHA512
6dcaef53571b39bf572c34520302b840fd3105ac5eb6dfd07a0232ed3d37e724ae3a744dadc3a63935d926f2889c42fa2eccb9601ce1034cd8529222b702677a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_3032_ENOCEOVYNKCYMSWS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit