hxxps://sexualviolation[.]formstack[.]com/forms/report

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 04:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sexualviolation.formstack.com/forms/report

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133636759116559100"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2468	chrome.exe
2468	chrome.exe
4028	chrome.exe
4028	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 3484	2468	chrome.exe	91
PID 2468 wrote to memory of 3484	2468	chrome.exe	91
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 4924	2468	chrome.exe	93
PID 2468 wrote to memory of 2224	2468	chrome.exe	94
PID 2468 wrote to memory of 2224	2468	chrome.exe	94
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95
PID 2468 wrote to memory of 2104	2468	chrome.exe	95

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sexualviolation.formstack.com/forms/report
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb2a39758,0x7ffcb2a39768,0x7ffcb2a39778
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1848,i,6388512198039347772,17339847392204685652,131072 /prefetch:2
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1848,i,6388512198039347772,17339847392204685652,131072 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1848,i,6388512198039347772,17339847392204685652,131072 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3152 --field-trial-handle=1848,i,6388512198039347772,17339847392204685652,131072 /prefetch:1
  2⤵
  PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1848,i,6388512198039347772,17339847392204685652,131072 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3920 --field-trial-handle=1848,i,6388512198039347772,17339847392204685652,131072 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5032 --field-trial-handle=1848,i,6388512198039347772,17339847392204685652,131072 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 --field-trial-handle=1848,i,6388512198039347772,17339847392204685652,131072 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 --field-trial-handle=1848,i,6388512198039347772,17339847392204685652,131072 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4992 --field-trial-handle=1848,i,6388512198039347772,17339847392204685652,131072 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1848,i,6388512198039347772,17339847392204685652,131072 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4632 --field-trial-handle=1848,i,6388512198039347772,17339847392204685652,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
565a7c51872ac561398e0039977ded7f

SHA1
03cdc3a3b776fbc3e0254c4ff1bbef4ca30412da

SHA256
cc07baa1acbbfc720f30ddf81faa763733e6ae18e0d007cfcce5eb760b400da5

SHA512
2bd59a506aec07e7ddbe069c31206b7e114f5392ebfe860c261b447b6ab694ceaad5f7870b1e4d6e658761f7f0ee4918192383b074138ed5d82ca2877731981b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
807733dbe430baeb37f645c4e27afd82

SHA1
14d6674f85918b60662f0b1b7a267b93a0f4db49

SHA256
4d13637d2356f5a3a1ad12c507749174ebc1700811011f488452df98a7ff1cb2

SHA512
115a878ef71c9a43fc7c9a12667907995fcc9246bb421081f4cb3d2c3003f6c3f47671e0f4a7bcbc213adcba03ce9ba5a0433a5c0a70ca128fb0067d85a40e5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
3e9e4c25640f07f8242fd4cff70e18b8

SHA1
b530d7fcd116f1daf4ae236c519a1c9e8d282035

SHA256
9b1dfcb24ce1598b3654ae6249e5e20cd0d381c07de5cc568ac7aab5d496da12

SHA512
6a5f67951c296b2d9ea3888ddb826386409573183557a15295fb8bb331172fa62fc1d2080e0dd4106a9bf065be63932897523124b0f0e412eaedf5858a919bb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
986B

MD5
e9d3a39f581789101daea33364fcfc83

SHA1
ae4dc8b06a33c268b2ea1832f77f272b6bb84cce

SHA256
d733955c4be16a6dbed9662c90c8408d584e22b74ea1c042ad6e5ed341d89c36

SHA512
c416613f3bd84be87978e8ed3f7d21a019952fd210422e26004b731506d268e86532f61166335fa540024dea6c965ffbffe3d7fbf09832dd41e48f025ee685ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
0797682d743ea5c8c04c03972edccf78

SHA1
3d9b97668b4c1a4d74d7b6f9f91624b2c7619317

SHA256
8721988d7c55ccd5707e9a6b4a12b7285a05b326a43ce68d1664a407896d733f

SHA512
ff2d87f2920cef126c3d7ad5b23b8f972651ce105fa39e13b5abf3b8288222a73b1bb75f64a8f7788ba28e8df6c0282eabeb6b114f01195665f30305e876b414

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4802899069aa0fe524b78f9d2d496d12

SHA1
7e717cb381f15f547bc137b33283c9a5dba2a757

SHA256
556eb29139592286a3dc44abd75568c8ce01ea586852c15e0838f541c2811da3

SHA512
8330e1a6073a54a50e06f5d8a821c03729b5ed295f066114f04e00025c2d31704694e88db173d4972f6220c52483f1f128f45d09f4d70def36ae1fb84b30af95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8362fc9a74371dcdfd5e9ffc7bf0338e

SHA1
f03ca465f2374084273de5f9941dd0c448051ce8

SHA256
e470e80cc488b29dcee65a4fa95b1ebeab98ffd139b99a742fa4316867413f91

SHA512
5fdec50a0f091c8a86b00acd932a846f88a35c4c8ffbc584a1032d00f0517cfb0e2b4c3cb1a5d89f71323fab70fb9de5570cb3399b93dd44d4188b6bc48259d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e151a88ce5f7f3bd88854c8ff1ad1ef6

SHA1
eba7aa3c1757b7909dbf9528cf7fbcdabec1b6ed

SHA256
a385ac3e760c475aa21ae930c758fb98452e1f46d4d7cd3f89c20e3a047ef588

SHA512
2cd7cb50b077b39339ece702a580666f7991503346fd9a73b3115f7239b4113ec1dec0807efc35d028196ac8b3710e21e548f5217eaa081fa8eba7f64c069daa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
4b3181a6c1ebd5266d8e68a70c5463c3

SHA1
224dad75c03577b85651a9c62053bb039bacf7ce

SHA256
32814937fa80f35fef85751d8adc111d62d5d52bf9f76f2596ccee87e4289197

SHA512
59511009a4623893a0d1e8a55863284c7433afb53b99a4839f7c64f6e378da48556882170083db847524787c1b64ee207400e7f1eae12dd437b8316e312c4407

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
a6c6d29b6f7e02b9bc430977f9e33485

SHA1
0b57b8dbf71266f4f23027f1d0663783fea6a108

SHA256
e824372d8fb41cbe8e3a274dd795b4fcc7a374aff346f8f6fee7b550f55a750a

SHA512
b923b0d34961434b1c0e2fb6be94d68dc18f5314aea56e9015d907ab5dcc9bc49648fb265b4ef24991562566059db9253f331d5c94b27a95cac27928c05be4a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
61c9d8ad91d91a796811fa785c80b9bd

SHA1
e00cf4de31fc7664d0fafe94800c40c7af6b6978

SHA256
cdb8cffccc2dfe24f53310ba2da7fd6646aa22e027a2941fdfe705a049ea5231

SHA512
81e1e4f2c16c153af0021e6d70b94294cdb865b6daf6411ad80db41b22681d51ab4b10073246ef3d0275cb3541d450aab455432cca0dab6612d491b98aae8a4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58e356.TMP

Filesize
104KB

MD5
bc07356ff696d64f87291787a039cd73

SHA1
982196d178ac2b335d81a8471523f7f6bcfd5428

SHA256
200271896abc13eaeef611094946a6fd6b9c35c52dd78468fcfc9351c955dbc8

SHA512
7597cbdddebb72b110b6240c8d1c441791b4880ffb8483c804a7e8fff183035f0a6cda38d03047eed4e7897ede0343cae3064d446521a6d6625ea9dec8e8ad98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit