hxxps://u20363463[.]ct[.]sendgrid[.]net/ls/click?upn=u001[.]dA58jYMMxWFSw8-2B63X-2FzktyLp7w7TAYy1iPXUMqQvTMH0zgYtMl6r9d4lS4eNb-2BGqzDFvmnRAbsQNyMCq5ImrxyHnHvtu3PS3bcYdrIEMmt6nCPpntbXYTZrDvtvQb9Yv0TJn96xggmgELD1QECVbg-3D-3Dfk8p_bf4JG6rVotaFp8XsYJMcbL2FX6thHEzgdMU55PkCfj4zE8lEBcUnNUKGqQqFEDbPKYpT9qLf4XPi7RFHRyg7-2Bdz09ZDYorl05S

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://u20363463.ct.sendgrid.net/ls/click?upn=u001.dA58jYMMxWFSw8-2B63X-2FzktyLp7w7TAYy1iPXUMqQvTMH0zgYtMl6r9d4lS4eNb-2BGqzDFvmnRAbsQNyMCq5ImrxyHnHvtu3PS3bcYdrIEMmt6nCPpntbXYTZrDvtvQb9Yv0TJn96xggmgELD1QECVbg-3D-3Dfk8p_bf4JG6rVotaFp8XsYJMcbL2FX6thHEzgdMU55PkCfj4zE8lEBcUnNUKGqQqFEDbPKYpT9qLf4XPi7RFHRyg7-2Bdz09ZDYorl05S

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133675560610670847"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3180	chrome.exe
3180	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe
2512	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3180	chrome.exe
3180	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe
Token: SeShutdownPrivilege	3180	chrome.exe
Token: SeCreatePagefilePrivilege	3180	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe
3180	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 4100	3180	chrome.exe	83
PID 3180 wrote to memory of 4100	3180	chrome.exe	83
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 5064	3180	chrome.exe	84
PID 3180 wrote to memory of 2972	3180	chrome.exe	85
PID 3180 wrote to memory of 2972	3180	chrome.exe	85
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86
PID 3180 wrote to memory of 3288	3180	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://u20363463.ct.sendgrid.net/ls/click?upn=u001.dA58jYMMxWFSw8-2B63X-2FzktyLp7w7TAYy1iPXUMqQvTMH0zgYtMl6r9d4lS4eNb-2BGqzDFvmnRAbsQNyMCq5ImrxyHnHvtu3PS3bcYdrIEMmt6nCPpntbXYTZrDvtvQb9Yv0TJn96xggmgELD1QECVbg-3D-3Dfk8p_bf4JG6rVotaFp8XsYJMcbL2FX6thHEzgdMU55PkCfj4zE8lEBcUnNUKGqQqFEDbPKYpT9qLf4XPi7RFHRyg7-2Bdz09ZDYorl05S
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffce499cc40,0x7ffce499cc4c,0x7ffce499cc58
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,14615426278858792420,4401374872721628798,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,14615426278858792420,4401374872721628798,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,14615426278858792420,4401374872721628798,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2168 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,14615426278858792420,4401374872721628798,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,14615426278858792420,4401374872721628798,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4580,i,14615426278858792420,4401374872721628798,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4768,i,14615426278858792420,4401374872721628798,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2512

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
666c0dde4407fcd06af5ea79caad33d0

SHA1
3a589f0141a1f8fd66e6f0cd7eb01a3c2c539f97

SHA256
a5a05a6a285a5f0f3477f421b959ab59343079d3a61ddecaf3a35bed3b4d5c79

SHA512
3d9f87190a52239702b61bad79b4069a686ee62afc56ff135f48a481d0b2a69122e5e4b8d4317b34b8d9d72fc3e5c29996128c45012eeaa369c69dbed459bd5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
2163ca0f751b1a56187417a52ae9a3c2

SHA1
fd300f8adb5585956dbd9f9e6b9f7cf6ab6f306e

SHA256
258f3043669cdb79abde4b11f026e2135dbc4a9903616563a49116a1c13de5c1

SHA512
4b195337de8de0add6d6189dbe0c62c8397f1b87a1dd839354cae7df0ccbbebe9da75c44a4686c5d475ac6514605f3c96eb8473ac74a0ce4655dc581d12b8fc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9097f89f0409bb94bf5277d26137d296

SHA1
628e9fc75a25eaa69ccb02d157c307cca4dbcb90

SHA256
9ad73da4beedfde35aa149fc733d351e30689ba23e4fce75ffbec085e84b19a0

SHA512
c9d799414b03d96ded1c8ae695fd099c1a80e3be0bf5f3ed68ab502d9f6658f454777086532fcd58ef58f2b663247af29dd655d1b6578b57e7d2357671dba42d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
e1f283beeb04bbccf3887230dd7b64f0

SHA1
63f1cdc6bca069de6b5e0ee4190c961910843c6e

SHA256
213080fa5e1edb23df2b474bb8c38d8555f3f7798167270846f5187f7bf56698

SHA512
b915f6874cf82f730d3f6be7f21ba843ce592d4b31723c5ed6c5602f011578f9b1ca0997ebb73c9265933f4878d14084b77cf5c60053c16157f34b284f4fc693

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1cab465dbdb9dd0010e5a9d1dc9180ac

SHA1
96ca38e85483c31f9278983ef5aa2cfe90b62956

SHA256
5cb772a352e22d25222e4876c44e0f3af40baf9c94ed421afb94f78bf2b331fe

SHA512
d6bc185abcf4bf5657796e2e7593f47e3809d708326c8bf2494f0ffd06b9732b386dc52336975eb4045f60e36a8e1d6d675e0926e1777497572b38e437808be2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
55129226c2d58a3fe0185dd91425dfc4

SHA1
4ba9d0f96c7d74f002da009226852868b1ea76a6

SHA256
da94af661fa523b2183d2753bb58497d315037815f7bbcfe07151ea9da30c172

SHA512
4d0a839a1320a24c11cd7fe69b4731053c82296624278504f8f9b3374759ad16e10a40d7ae113c66aac05d9b675bcd85a265096aef268e6be50d39433e483ead

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
68ea21062bd452e42fcb1f1e2186f503

SHA1
30c9f58003401bdb2cc0927f7b0256053291bb33

SHA256
38df8caf4d6c51073c2524cd09171bc790c70470744ade9c9075fa2a7d49bbee

SHA512
8605418e2425f80792dbc8375fa27190a0ecae7dc18ce7ce2145c3389375184aa15219487c488001119be27a496e60514007fd5764ddcd6c2a516acc8c763780

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
d93353818fe23379da62134eda9b0ee2

SHA1
c05b0a99b833194a7ad339b717bc4f7590a6e727

SHA256
ae4d3d9ee39526136708f4a6ed966a57b72f741170fc034f471d9cd02dfd520a

SHA512
9e294d8959e655679119a601a7a0321e650e849ddc1fb39cdc18bedea71382e6cfd52720b55f36a0cc143c634ef92a96b2f97760e6226fe3996605af42b706de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\de097dcb-8c25-4d3b-9049-0b66ebe0663c.tmp

Filesize
99KB

MD5
59cd0e85197a2059d2de9bbc22d890b7

SHA1
00785414178bcd5014813d74e4a41519c86cda4e

SHA256
7968897ab2e4b673ac0a83d9a225fa997b85baea51105053277c8ac34d29ef6e

SHA512
6af91c53a3df9b287c1e2317cae90a19c636538d53c72f50b56dbd00f0fe2f8ce25b09b73c91e392386c21459c6b707c6b582bd013ee42d66807f692b391bbaf

Download Submit