hxxps://www[.]google[.]com/amp/s/jurgec[.]net/hui/swer/auth/mmnbb/luc[.]saint-genies@bcw-global[.]com

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/amp/s/jurgec.net/hui/swer/auth/mmnbb/[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133410151902317242"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
3896	chrome.exe
3896	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 3596	5052	chrome.exe	71
PID 5052 wrote to memory of 3596	5052	chrome.exe	71
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 1420	5052	chrome.exe	85
PID 5052 wrote to memory of 3884	5052	chrome.exe	86
PID 5052 wrote to memory of 3884	5052	chrome.exe	86
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87
PID 5052 wrote to memory of 1976	5052	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/amp/s/jurgec.net/hui/swer/auth/mmnbb/[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8edd9758,0x7ffd8edd9768,0x7ffd8edd9778
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1900,i,5143236190590064185,2606674251466640666,131072 /prefetch:2
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1900,i,5143236190590064185,2606674251466640666,131072 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1900,i,5143236190590064185,2606674251466640666,131072 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=1900,i,5143236190590064185,2606674251466640666,131072 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1900,i,5143236190590064185,2606674251466640666,131072 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4524 --field-trial-handle=1900,i,5143236190590064185,2606674251466640666,131072 /prefetch:1
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3828 --field-trial-handle=1900,i,5143236190590064185,2606674251466640666,131072 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5060 --field-trial-handle=1900,i,5143236190590064185,2606674251466640666,131072 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3400 --field-trial-handle=1900,i,5143236190590064185,2606674251466640666,131072 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 --field-trial-handle=1900,i,5143236190590064185,2606674251466640666,131072 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1900,i,5143236190590064185,2606674251466640666,131072 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3240 --field-trial-handle=1900,i,5143236190590064185,2606674251466640666,131072 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3196 --field-trial-handle=1900,i,5143236190590064185,2606674251466640666,131072 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2800 --field-trial-handle=1900,i,5143236190590064185,2606674251466640666,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3896

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f018577c749e28d58b020655c3b84636

SHA1
c0198d4d0304196762b809bb06c4737af3537c27

SHA256
9f47c823a92774445f8b5d2d8af349f438c58669d0f3783b1d9fa62546ba7f88

SHA512
2dc043208d010da20ee2aeae5ef0490c042afa67259542844a8f0cb037e5003d4adaed52803c4c1af92e8d9fe01e865c52568f1bf6fca0733d000554774caac5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
998028ff7297f2d7b1d9bd61b55f5463

SHA1
f9943a1b82c536545a6e2ddac2cce193f8d90b9d

SHA256
87b593a9fa93d6a7c9fd85d2aeb55a0b37bef26684334df4b4abe42e68575ee3

SHA512
cc7c052cbc4231389e0ed67b3d20fc4873f883c45f36be56007d82cc0ddbd07c7026cfeee6cd580217edbe204b812ce5e81ce0d52dadb10c50992d9ed9a955d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
5370da5f7208f230765287c838e378e1

SHA1
8589d6c7c328a6f873586fe8fb90933b49df900d

SHA256
e8d6a4b0b0fad6f0177db8d0eccdb71ef6e77062b24c56ac9015a7ea28f5930e

SHA512
5732ef413e4d295c11fdb9ba962880e536732ca9ceaca528be7f1e0b2f01dccfcee9161444424830e3b4311075c26a5c237dd979f8c9ad402a14ec7da66ac662

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
984b995e0fdbe1b5d3ed2948f60c1f2e

SHA1
577f0a230c00217a2fcdf7d9202de12b5033e2d8

SHA256
676309a22e5786c7a07865d1505dfa1b9c54689d393a6aa3a3f3e87cfe79844d

SHA512
9eb2d9dfb7a77d745681ce1917cd0de87cecc4d7b2865948cc481025e07496d698ae670c91483305b6216cf3a85d48d46b5f57277d66f2f4401832716fae3495

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f85c8c69d5574bac9d8eeb4ce8fd382f

SHA1
0a6551a393d2075354f13785c0e53289e2c7577b

SHA256
04bf7eeaadac2b99e5c83e42a18eedde94072a03b417c41ea7e7cf026b314e44

SHA512
b4caf081e5ec0e0206807c1c212e3522af9cb29d6cc971ffe25c4b63cf7ee04c8e07675b30587461770694bc9acf14e929dcbe20a67e383a32221abb949ad46e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
82c803fd4dabb34f52f5f83806534abe

SHA1
5ebc9cefffe3eaa657fd194e6f40cf6ddaa0427c

SHA256
e011f0837b947812c3701948373d7c4db786524ac1feb2084737e56693800063

SHA512
18a1a942f586760b38c23f3bf8536433d5d3932fbbc0f978f6d593f3cdb29f60e28cc07b267a766c88ed5feec340a61e9461c83aa3780c51bf81fd2643ddebfc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
005a0d1a707be94668271da689186fd8

SHA1
da280732e3772c3ff09cca0e2f8a4d67643ead40

SHA256
89ff0c0cac8fa6ef931698838008915027226fcf332be14a3a466087ea65194c

SHA512
15a5c97bef2c2656d71098d10b4789514393556be60c9a8f60de51c3bf91d5229430b0287fc326e13d7a9792af04c369824282f8d0ae1700e09dca20bacbf5da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
144KB

MD5
3a576f0b1590a18799092284d29540c0

SHA1
16a629a15c7bb87754b29867fa92df3486fbdbb7

SHA256
ace4232624f13a8526d000a6c1ea0680bb562307f19141f2e0973f8c5c5f67b5

SHA512
42b7672702d694944148f8b4e0d017413d16103cb7c1ad400662788727fc425c9888430cd985aa37ce2c5276662622d6e182a728969da24bcdbd248a92d08cf9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
103KB

MD5
33d1626d305e1c45433b7d72f6be7257

SHA1
5534246514bdd6c2035a3c1eab90d45b813f1eab

SHA256
d6473a2ee32d8584f5dd13709b9b9a235760c485178ed50387ef7e648fa0054f

SHA512
c7d53882244bbe35b98b1ded1ae866b0727beb58f475c55e068619bfce2aa12a9c07fb5e8f6a4c170c6db150b112234d73087e1f09a2934f5e5c3475327d4052

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
103KB

MD5
31df04319817c40c5f948283de241272

SHA1
3bfebce8138cced3afee54bc934aa4b068150de5

SHA256
e10e8f4e17eaf18189df0c6c6a89310c6461f352bc7501cab91b8af1dbb889cd

SHA512
c943558b98b9e2e79acba2d98bfcc8f3e3d8ed1eaca407d4c336e8e3fd5ef8ea4bc721843314664c85341a66b7f3fea729e2d77dc4ae6e572c1cebdb64a5d3f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
104KB

MD5
2f55a20038c121cfc4e3c88f1df2d545

SHA1
3e2c4e8ac076119dd89b1d7651ecbe9324962c66

SHA256
b08f530fd68774ce6d3ccf8368cf77fbaaecb075cce17914381a251cf190f440

SHA512
dd3dd1de8adc00f998a14802c06556a581f8c65349d35d702af11635f297f13e1f5e934bb356537efd9f08c6af47e8112427737c7b77dfd74e61b72c0ad075bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e907387c-25a0-42f2-9fd6-2cea27c7a824.tmp

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit