hxxps://Roblox[.]com

Analysis

max time kernel
1799s
max time network
1684s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
23-05-2024 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://Roblox.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609812454577242"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

1204 chrome.exe
1204 chrome.exe
3608 chrome.exe
3608 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

1204 chrome.exe
1204 chrome.exe
1204 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe
Token: SeShutdownPrivilege	1204	chrome.exe
Token: SeCreatePagefilePrivilege	1204	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe
1204	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1204 wrote to memory of 3140	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3140	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 4660	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 1440	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 1440	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe
PID 1204 wrote to memory of 3780	1204	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://Roblox.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffac0799758,0x7ffac0799768,0x7ffac0799778
2⤵
PID:3140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1844,i,14595145509482933850,8318955524349689865,131072 /prefetch:2
2⤵
PID:4660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 --field-trial-handle=1844,i,14595145509482933850,8318955524349689865,131072 /prefetch:8
2⤵
PID:1440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1996 --field-trial-handle=1844,i,14595145509482933850,8318955524349689865,131072 /prefetch:8
2⤵
PID:3780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1844,i,14595145509482933850,8318955524349689865,131072 /prefetch:1
2⤵
PID:1736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1844,i,14595145509482933850,8318955524349689865,131072 /prefetch:1
2⤵
PID:3428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3868 --field-trial-handle=1844,i,14595145509482933850,8318955524349689865,131072 /prefetch:1
2⤵
PID:3464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 --field-trial-handle=1844,i,14595145509482933850,8318955524349689865,131072 /prefetch:8
2⤵
PID:5008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 --field-trial-handle=1844,i,14595145509482933850,8318955524349689865,131072 /prefetch:8
2⤵
PID:1996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1844,i,14595145509482933850,8318955524349689865,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3608

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:380

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
3ec661dff4f5ad12c8818c33b94e152d

SHA1
75547c84312129ab1ba75ab107e19f0ff091999a

SHA256
3c97861c0d2f7799a7472eca4f5d82b33fa3ada3ef7de19f4fe047a408996399

SHA512
cc555312429bd2bb3d82b623cea5bc756b49e6dd0b5389e3727aa31a0a9deb932d372c71114d0e4b219e4017df902b1667fd82b3e2c09eaf54c94ef0ac41b340

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
c27bee591280a672623a22e149d22664

SHA1
9cdd285d905feeb85e76e71d6aee11f914493b06

SHA256
bd6621c8a84ad8e84cc3763e4677ddac5c67492a26b8c337b633b8a899ae395b

SHA512
cc68d3e29064272853681d82a08445b74453de126e123c2d634ec0ce9842084ce5344396aca64750ea1a355cca62b3480be9ff40caf4f35803e8b879907f13b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
b805bc243861e3cb7fe098432f724fa1

SHA1
888548be0d7e906bc6a8bcf9d6272e91201e42aa

SHA256
c67a1e304614cb1bda9b483aafb97cc7d35e704fa038e0be3bfd7b38880c28b5

SHA512
a080416cd3a4afb407c3182977f43e9acb92e83c3c90f1ce4103f6d80f63ecd2b8a08ad2b2af8ec2621bdc4c95664c9fe0f756a9993a83beaba07130c0bd53d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
d2d3aa777b2c0fb654d57cd63220ca1e

SHA1
f2a04db8ed95e68f1a7e7b41a385cd6011bc3540

SHA256
8abd502d87db4c146f75c1d4764e815808ae02ca87ab66905c6138e05266332f

SHA512
1f3468a0da9d94de7b37ebea1d914895082b47b395d28c933db328029783aafaf1caca2fb63312e7e4bfdecc775a0613ba9a03853f2837ad269b9b516434a5f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
410b50d24e859abb8e50cbb506d9738f

SHA1
f0346f8cc92769ef306fe2f7a1d9b6aeb1eb4292

SHA256
3f987d2d16e540215a447790d7e060c3530953722574eaa8696268fd97e62579

SHA512
07e554a436fb76ab4432d81c6bdaac8a93cc0049ccf7efed8bb8da767b49296fe7cdcdc4370c8e2a341a90d6b6718a31350416c733b10c9a9303ba8c13280867

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
1df0e9c881e9e1812a300de8b39a6fda

SHA1
2ff770c6cf742b5d4de9b1f39a643ff83dd1d017

SHA256
3bbc286b26760d135b113a18d7633df4e0e718047054b5a2ba4f201da12ec2d2

SHA512
fcbe5649e07759273bb0e041e7fa7a253d7766ee6d4e25bed8aa881d24447ccfebb43bb70f95a44d28546745f4256f107a28720607221888d6099ca1570a9026

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
b8047676ec24614d8a89085da9301d2c

SHA1
4b82f29d99e2101540da1e40805cb4caf67bd128

SHA256
ac3f741c9a7c765edd70a9b499d4b1002848b128df474701704b5db3ea527e10

SHA512
a3724bf8b45dbe8f0b34c9550f40a816f4c479c3b4b6754d44744f3bc33e2bad287991ec7bb8d1e534ac5eb997165a7cc56139f9ed32e8bef253601613a6ea56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
95607330652036f9ebaa5894796c2683

SHA1
1573ca3c6f0cc81868cfd74e51898c37ed9ed0b0

SHA256
f81f1653afa6c84551f1a554ce4ae78ef0bd7c672265b32ff0ae14de429ed2dc

SHA512
48f371386b478dac1c1db3e0df0b6f2307eef8bbd0ca64b99b20ff6be6dae9db3544a8fb0e99c79e53b8fd9a6dc2578fc05cbd0bd89649d67010aa4e1703d655

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
6fe9ae408d90c384572ddec3e9462b08

SHA1
542f3955cc46ae03e5d071894e2fc0ebb36220a9

SHA256
3427455a159c8ac992174fafc6beb6743165920ed5de5422093342c2ceac5143

SHA512
de44d68b29558f4b35571f38d1ad46ec640685f165ec5098994986bcabb6c529e908ecb30406f416409ce7efa35ac42e4b1ff7fc9cfc4da575932bc851641b69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
0aceac8170d41256c10205e227687be9

SHA1
c74d899643248964dc8e35378b5d291e5a03fda5

SHA256
a9d4884b043badef0272d0e19b280eb60d52c40f9fa4588dec6cf0aabf57232c

SHA512
e5cc1171587f80563986ead88f52bd7761a7c311eb0d4827839fe329eead2f469de21cc00b29bc9302c887be220b358f837da8b58f5e651e4b60385b02580027

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
cadfe54b4115b4909442acbce491805c

SHA1
488e70a42614f5a4a0eb9d8f3a5d216f2b459964

SHA256
dff0dc2459ec71d714676f5731f9475dafa03585c5664fad89b65d3620cb2306

SHA512
eb43f64a85f63b9b6302314776e29cc58b31c5d33d75e6eb49f5a2d26e19701b997b96d040e0fb12039fcce33e4bd4b6e6a842b97ba452c6b040002e0c0e7196

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_1204_OJPZGYROLAPDQPED
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit