hxxps://acewritingcenter[.]com/3

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://acewritingcenter.com/3

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133589929779263248"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1868	chrome.exe
1868	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe
Token: SeShutdownPrivilege	1868	chrome.exe
Token: SeCreatePagefilePrivilege	1868	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe
1868	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 3928	1868	chrome.exe	84
PID 1868 wrote to memory of 3928	1868	chrome.exe	84
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 1232	1868	chrome.exe	85
PID 1868 wrote to memory of 4712	1868	chrome.exe	86
PID 1868 wrote to memory of 4712	1868	chrome.exe	86
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87
PID 1868 wrote to memory of 1728	1868	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://acewritingcenter.com/3
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc84facc40,0x7ffc84facc4c,0x7ffc84facc58
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1940,i,11139711391411594078,6849623235982473838,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2112,i,11139711391411594078,6849623235982473838,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,11139711391411594078,6849623235982473838,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,11139711391411594078,6849623235982473838,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,11139711391411594078,6849623235982473838,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4612,i,11139711391411594078,6849623235982473838,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=5072,i,11139711391411594078,6849623235982473838,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3412,i,11139711391411594078,6849623235982473838,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3844,i,11139711391411594078,6849623235982473838,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=728,i,11139711391411594078,6849623235982473838,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5088,i,11139711391411594078,6849623235982473838,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1108,i,11139711391411594078,6849623235982473838,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1448 /prefetch:1
  2⤵
  PID:2244

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:4320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
75be4d059e34552981cfe292c01e39a1

SHA1
27005f044c18562c2d3f6aa19c94cb1c08af7ed1

SHA256
4228fbbccba3818b02d9214653926c3e52e0c73888f81c500348045c2d747034

SHA512
1c33557fb6f05b47960ddeadde5b782f501a3f3f9a4590c9d52bd8b9fe026cb502b332e9f283d518d05d2985fc5426e18e63a257fb7a668978403e44b43fd580

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e93687b597e2f131d7cc9fc70964b5b3

SHA1
9724c60a78375a6e161376149f253669540283e4

SHA256
dec8e921120250f402171f6b599f729d39bcbf949901d3d16c55e0eb88b182d9

SHA512
1bac8a19eb33a1b3a70525364d87635e1c596a00c8b14fb9f798bc7781dea4a7fa0294a4e6f58fd9d0f52c0620cd04c52af6fa037b8533ba083b2cc67d20d94d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
3f689884781b2966bc68e2ed3d77fd51

SHA1
401b5b8a7c454fca763d053469c7ec966f5f2e8c

SHA256
1f1c11d9c85ae42cfc4cf41adae1cded1af2c38e247da44ba3fb3ff9f62e7a15

SHA512
e3d28ad43a41d0f7a4b1f5dba9497ba23ccad6b438da65176b98202c0bbba24c84f629c53984670976957c1190c5de8f8a2145d2984ac074d1ce3b059fdb8856

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e0b00666cad07c34253c95f3d0343c48

SHA1
76f3c991b0fe7db3d151e3c5685ccf013e484ac3

SHA256
75847de4421a5d39f6e8d8f2378ffea2d7d6979ff1a314b54bd00b7ea1470ad0

SHA512
f7269da462732d5cd7e3684b1048a78e548b93be1f6ad2e1085a5bf346614813daae77e3421d8d9a79e1b23c79d93c1edad9a5e4761b50eaeaca791c57c19e05

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
449751685977a119a698ec05411a890d

SHA1
3bacc7ff56aa996fc58a0461799a8f0a20ce47fc

SHA256
082f42fd174312e3ca306c9313e84a67ef437905d24437bf550edb6fe52b51b3

SHA512
55bc4f3e9e79fb879f38eee2698e42ba3a7ec528327b594d64ececf9e9c636ad8fb834b61abdf1adb933dbf657907d0a0a6dd2fb23e7a70d5902bbc6045cc8ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c360499bd52ce6f57bf254d9ac2d378a

SHA1
97294a54b9b5e9b93a2f120854e7673d6c001a36

SHA256
99947800aed6d67a914de7747206cfb333ae43e1f513378fcc44dc0cbde3ddbb

SHA512
9572027b70cd6e1da2257f21f63f26e3ab47e16408ab9f5fc389f29aa1c7cd75d89f2479a57682c0ef0456093e284097489521af15021ae6c31ba462956baf76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e8f6971f04afdee123914e229bffd5be

SHA1
b2fa886f450ff6c92f674c330830095f0ec282d7

SHA256
137b5c5297559167519980d23a24065682d285d8eb94a2b11a3f2e8edb2e0979

SHA512
eae3a12f777af8bf122b9275b017a682766d07a8c793baa4ba4393dd9ecb9217e15efa02a8ff11b67bfc0efecb9d02a3185ff4f985b7de67a0a91136846bd4c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
69135c7341e9144a234932faa53d66d1

SHA1
96101b4e1ee7ea5e1cac26ad8f5bbe57c8830b01

SHA256
7af3157bb2fd4ecce65e97be2532fcdd0e3149aea3810bbd6df90942b2544238

SHA512
f2778895d40cf5c475812e2fa5e28c293b18eacd39eeeecacec7cf48d191cd045e21a34f13797fe4d07e4052873d616690b4c54942f25da3c0396d9ef1bc66b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3057589c3a1e9d284820a6cf0fa36f0a

SHA1
bb7f0fa9703bb0a4c0e2e2cdfe07dec6a80a946b

SHA256
a26e5f57137c6e421c294cc1e66d461f8981353234517e06eccd7f1a5692ddea

SHA512
b9db80c48a212bd030f47d7ef33a7ef2c00414d1f50555adda0b5e8f89c074ee59d167e8ef541b8de19c7330be5d3a7ab23bab0ec866aa3383cfb0a8a9ca7d61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7e0fd28c084f2ee6b63f615f08665056

SHA1
9dc36b01642c74785d094be020c6c4905dc47882

SHA256
c7f13ee4d3017b6520343f619827b2adcdee6193aa33b707a2c9837fbf6a83b2

SHA512
1ace5f6da82ad070e111c6529fa85a05e551613ed74b76c1f22263b5e28658b4e35b404794a0935e56d59087a6d22e23ad21f4e4add526a2e43c2afb042adefa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5780431b8d70523f304c1a5dd27f8ab6

SHA1
631c480395910406bfc499f77e779fc806876437

SHA256
f483b04c1ef0a2639814e20c53c2dc3696ea613f458b1c86e74f03d60fb843c6

SHA512
0717d4a3e404f831ff4f448cf07bc618edc65ca354a248885e0f031ad2e4505b6372c2b1969bb0a98f4ecaf3f4b81b218101ee64d71cc8ad323d461eb66cddd3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
77KB

MD5
bd1002e2ee5c8dd49ce97bdb3b209586

SHA1
7acf0650e8350dfb1f56e5f53c58004e8b907452

SHA256
3c5f339d6df1433428ba7d818fe8936f3be48764214dcf3ce830230bac18d439

SHA512
d97a66bf77dbf68a7c58377fe593497b9cd3cc96d9cd546eb24b2e0a63dd6a5e10301b169125b70d444f934a7cc7ed5b15a978f0b48bfe8467e7107f2ddcfd13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
77KB

MD5
8a0f82f28a280aacc3545b592b66db53

SHA1
4d3dfec5009b3d661786f8ed103c459c248daf70

SHA256
d39d675e7ed4c9bb5ca8745723c3c1df0c2ef795d90b8bd940e1fe9cce0e4ec2

SHA512
de6d900a6749adafbfa759bd62c0e55f9cb0974734152210ad23db623d78453867c9cab6025814ba64adba5892d2506d3a01081ab8731aa74e3a0093de99a040

Download Submit