hxxps://x-1678960365414626[.]link[.]sendsay[.]ru/x_1678960365414626/1128,=0XjiEn8FePf9IulP17uXgxg/12268,4769009,228806,?aHR0cHM6Ly9vdHZlYmluYXJhLnJ1L3ZlYmluYXI0MDUyNA==

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://x-1678960365414626.link.sendsay.ru/x_1678960365414626/1128,=0XjiEn8FePf9IulP17uXgxg/12268,4769009,228806,?aHR0cHM6Ly9vdHZlYmluYXJhLnJ1L3ZlYmluYXI0MDUyNA==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609159624429313"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{28E9067B-D244-41AB-82AF-4661CC6FBAD6}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3812	chrome.exe
3812	chrome.exe
5284	chrome.exe
5284	chrome.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 2116	3812	chrome.exe	91
PID 3812 wrote to memory of 2116	3812	chrome.exe	91
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 620	3812	chrome.exe	93
PID 3812 wrote to memory of 872	3812	chrome.exe	94
PID 3812 wrote to memory of 872	3812	chrome.exe	94
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95
PID 3812 wrote to memory of 4956	3812	chrome.exe	95

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://x-1678960365414626.link.sendsay.ru/x_1678960365414626/1128,=0XjiEn8FePf9IulP17uXgxg/12268,4769009,228806,?aHR0cHM6Ly9vdHZlYmluYXJhLnJ1L3ZlYmluYXI0MDUyNA==
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff5f9ab58,0x7ffff5f9ab68,0x7ffff5f9ab78
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1972,i,5167835887929628273,6822326415787050942,131072 /prefetch:2
  2⤵
  PID:620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1768 --field-trial-handle=1972,i,5167835887929628273,6822326415787050942,131072 /prefetch:8
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2092 --field-trial-handle=1972,i,5167835887929628273,6822326415787050942,131072 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1972,i,5167835887929628273,6822326415787050942,131072 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1972,i,5167835887929628273,6822326415787050942,131072 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4236 --field-trial-handle=1972,i,5167835887929628273,6822326415787050942,131072 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4452 --field-trial-handle=1972,i,5167835887929628273,6822326415787050942,131072 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 --field-trial-handle=1972,i,5167835887929628273,6822326415787050942,131072 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4740 --field-trial-handle=1972,i,5167835887929628273,6822326415787050942,131072 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1972,i,5167835887929628273,6822326415787050942,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 --field-trial-handle=1972,i,5167835887929628273,6822326415787050942,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5284

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4004,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
1⤵
PID:5236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
1351b785d1885714a5ff80e1a3d5f8b0

SHA1
4744759806e6b2c93633ab0ce369d1a59fc88a5e

SHA256
dfcb6e1f7d16d4cbe6196128e5b0177e2b160ce351c3a1c3a091ab088218aef9

SHA512
da7c17c82b4478e65ee9b1f470d2d429eb62e9e7e526ad53c95c7ef70ca7468f07f444bbdd12190c7c200c77acaa9454de47f34ef6e89ebaedb46a1acaa6ffea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
48eb28bd70fc545c1588f7ea438e43b4

SHA1
b3df33b8e02e3f750eae571b48aff8fbe2d473fc

SHA256
89d7329af5560468f7f771122ed21f8f23c8ca03f6861d606aac08cf85c30893

SHA512
d0b03451ad0d306b3d3e29cbc0398476a18f173455c69a540170eb2cbc745017225efadde070a84536b2ced00dd2ba590161f64584db0c9314f3edf96184381b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
b28ef7018e998d929e885450f79b3742

SHA1
71dcc05f6838133fe982cbf762a57bca9d1542e2

SHA256
7617eb894c0343f1e1bc436056d8b9bdb2a08aae469df8381d633571579a9379

SHA512
34748275da1f393ad5bbaade7d301d40eaf434270439c1a7380897f5b9c5fde1314f716f4b1f28b0dfe1526bd4a2a67c1d61567045f9b81fca541fe1f0fd5f48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
364b2d6240519ed1ba5f55827227f92b

SHA1
770ca2712c57e6efe2818ed315a8887bbba74f21

SHA256
66121542c536fd293deee02381e6f65d542e394ce82ff6f6cc4657679f03236f

SHA512
44ff5313ad64a6d7e5eec2cbf20f51f373ac81857e4192beb5e1d843261a8dd280564b2eb2a0abeb1b05489a63cd856c4cba3636d8998c0b4f17507206084505

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
105f4daa25fc5d4991d100a277feb84b

SHA1
780db4fc501b3c3da16578a22110d728ba705988

SHA256
47ca7be566c427766ce5f4bd70afffbe2894214240834b1ce798418002259b1a

SHA512
0b11eb11902c5484915e7b5e53557c950f509a26edd07fd879079f149b6a9add830568a77896d0d8ac9772b564dc1fc33d814b7c7fdb36346d68e9d4c84e16ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6e95695a1afd9bd381211d6db2b9a4f2

SHA1
d3395da742a56827b846187839a51e54cc391077

SHA256
30698da34f003400e49b1a0e3bf1dd2da29bb8abe35a7791d4bac52c59086f3c

SHA512
2293dbc7a574eeb2ce496933fb365b889949b23888cd2511d766d697a99a81b3dd94a1fb5268735baba0ce48da606cc22bfdbcf4ce0753071e94efc548165fa3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
07c689baf9e7d4daefd616b3225e7b9c

SHA1
1166c77480ba93975d3dff20da562a2253d07dfb

SHA256
7246e5c1e17fc22b1e2678f11fe321913c98002e8962b6c81d586b2125e686c1

SHA512
fe08573ca5afbcbdc37b62d93e5b912f4b9b343eb6811d8b2999e9160c65375450c692c0eddd4ace4c22f4380b85517735ca31313ed7c293f3fd4806383ad627

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b6c3549bca53219e7f0181d6fa3f3d44

SHA1
337eb3ad2640759bf323411038f107415ef0e2f0

SHA256
cc5ac2eeed485af2fff92d938bfdd97ca405ad2d3d2c8566b9ba968dfd8dd367

SHA512
cb996ab85142e04b1da9c1d302d152d76ed9c52666741c5fc4ee7ce70b3c07308627aa674a0bae85468500e89d69dcc089f26c16c1f0fc40795c3639ae3f2eb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
255KB

MD5
88bd83fd2b7ead0c4ba4f981849b5a31

SHA1
509f95627794fb1639c4e9405d58a6e06eeab1c8

SHA256
a9464729780f89d140b063ccb34f6a89e7bba23c4c14899fd4aeb0162e0fef0a

SHA512
df0cc4e7db0ade0572d383f5856c3c2054fa576dd39118d33e0f7dec141497b3977e4c4bb8232f3b4b24c351c49310361a78a5ffe6d5a697c15c418251d43748

Download Submit