Analysis
-
max time kernel
329s -
max time network
330s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
29-06-2024 00:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://click.pstmrk.it/3s/borderlesstracking.com%2F.db%2F/gRC2/sE22AQ/AQ/ab5ba37c-11c5-49ef-b93d-c2cbdc001ce6/1/NM7-HQ5qfW
Resource
win10-20240404-en
General
-
Target
https://click.pstmrk.it/3s/borderlesstracking.com%2F.db%2F/gRC2/sE22AQ/AQ/ab5ba37c-11c5-49ef-b93d-c2cbdc001ce6/1/NM7-HQ5qfW
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133640944056626945" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 3984 chrome.exe 3984 chrome.exe 4648 chrome.exe 4648 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
Processes:
chrome.exepid process 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe Token: SeShutdownPrivilege 3984 chrome.exe Token: SeCreatePagefilePrivilege 3984 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe 3984 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3984 wrote to memory of 3812 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3812 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3972 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3912 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 3912 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe PID 3984 wrote to memory of 2068 3984 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click.pstmrk.it/3s/borderlesstracking.com%2F.db%2F/gRC2/sE22AQ/AQ/ab5ba37c-11c5-49ef-b93d-c2cbdc001ce6/1/NM7-HQ5qfW1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffec93f9758,0x7ffec93f9768,0x7ffec93f97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2876 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2884 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5108 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3044 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5112 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5888 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4484 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2044 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4980 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2016 --field-trial-handle=1692,i,13199748763252788676,17239243815202470536,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
557B
MD5757fb4220ec4173fe49f80aeef5c31b1
SHA15c46e56a7c829b21e18d228280716010640f76ed
SHA256c72d4320dcf0276e2e4893838713a9800cdce041c87b2cb3f9bc44ae856fe8cf
SHA51203acf01be07d9d6843974face9d4320d597ecd6dba06bca02355bd59eb9210d8e222f03ba1ec41d2055b34fed0605db878c81b6141fe488d99f50fdffb0a5369
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD53c5722a18f82ccc9811c948c2f4e8df9
SHA172e694c8d89ce595bb20c2244e9f5ec97c6731d1
SHA256c7ddb63d12bf8745d854623186b1062e14ef619e557323f2f6dda78e0da1be9a
SHA5121c3e8372360f1c7fadc41d584ac9d9428d1114204fee68906633f4ade2d1cc9e45e0f2f482fbf253725214ec2b99237e51484657ae7cd287aa1b9debc35b20c3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD57f1e32690c3c4ab49d1ff78170aed992
SHA18e08cfb59f3f0ea52abcb253adf1855ffc16706a
SHA256b46e5ec13b27c9d06d07ea216fbb3bc7beb9a6f5d66cf042bcb88e683b113d68
SHA5126c107daba5c8267b6d89a7eb9fd942db830adead836cc8b693e1c6c46bd0106395110df58dd68c7ad1e97d85cf2c5d8fc7e5eb2308263cda33ec35dcdc410780
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD52f0962d6da3fbb96f1df309aba12b273
SHA10d346a2b3d9e51e3587e9090e89236ac33e96cb4
SHA25693d73379b5719e21892c8b63bcd1135e6542b399e190666775c637976840c6df
SHA5121b7c57c85271076de7e11492be3b101eb41c56a594acef13986073393b6e84f81b35848c7990ec1ae35bc8a0716fccc56a634317e3a11197b8ac536ed1781c9a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
136KB
MD5c372e7cdeb78955fb19b57e509cc08be
SHA12cf58d8a11700229c02f29563484c356b85853bc
SHA256f4d16b484632343315f1bc8a8693bcadf5ddd9533a56c727ac51fdd2c3ae1784
SHA5124f7a2804c546781ee1c93f2c9fb3ceee50315662c0ba7ca9dfdff27661f3968989e9592e881ecfa2c36bd17f3ddde592df8fbaa6b2f504fa84b65b037eeed6be
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_3984_URLXIWKECASXTFVQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e