fc9da0643ec0f4b03a8d10349e2c243c2daa65ae749b6a960edf34da59453cac

Analysis

max time kernel
290s
max time network
245s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
20-07-2024 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ransomware_notes-main/relic/UNLOCK_FILES.[hex_chars].html
Size

4KB
MD5

abf59c57469059e2872201077407692c
SHA1

e1cc65fad127fc7d043a41f15820a986cae12514
SHA256

66160952b84a6d3b1d8306d3030afc10394647ea6cbcef5ef7257cad7e4a5dba
SHA512

9330ee9f3e21470263ca35f07c2090070976ee70f26bc52c4102051c839dd27a03f53f62c020c5f72a664b9387e32f20d21bdfd4ca9ebdaf65526c48a9dba94a
SSDEEP

96:pyPghP1AL25f5yxKHkdsKm6656TiXW1LoElrMT:p5hP8GfYKHcpmDY2GpoUMT

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133659820961964114"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 3052	3932	chrome.exe	82
PID 3932 wrote to memory of 3052	3932	chrome.exe	82
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4808	3932	chrome.exe	83
PID 3932 wrote to memory of 4396	3932	chrome.exe	84
PID 3932 wrote to memory of 4396	3932	chrome.exe	84
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85
PID 3932 wrote to memory of 4064	3932	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ransomware_notes-main\relic\UNLOCK_FILES.[hex_chars].html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2636cc40,0x7ffa2636cc4c,0x7ffa2636cc58
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1732,i,8911192483370733283,12246718367086221822,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1728 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2028,i,8911192483370733283,12246718367086221822,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2056,i,8911192483370733283,12246718367086221822,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,8911192483370733283,12246718367086221822,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,8911192483370733283,12246718367086221822,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4552,i,8911192483370733283,12246718367086221822,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4112 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4672,i,8911192483370733283,12246718367086221822,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4032

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:2800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\97cb2fe7-9687-49fd-87db-29991ca0c1c7.tmp

Filesize
9KB

MD5
0e0483438d6b26ad53d9ab1c5c7637b9

SHA1
1a59e385524d48c4788e1765785d5647d7cc9a07

SHA256
c6792f2688484981bdfc5169323f5551024c1ab39fe7dba67ebcf1da92595d75

SHA512
6773fefd26d08eeb4834d847c0ad49f45afc8aa2351d82dbd6978f8410b58bb36c05fd369d540b57f82d3d76ee2ebf6ffb68da9e7a40d6d331442a0d89a539c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
15305def7de05371b6cfd6f657c9831a

SHA1
c269089cd553a8b20c4454772a4367fad9b50cd1

SHA256
4fa56b0369f26ddc99cc6911735b25b149b38b2e18b94d7f0eaea1d5ded14b5c

SHA512
55d38bf01a8e760cc5ba4f568c740bafc56a4002d6e6b64adc2d923adcbd3638bed4e87b4b226387f8b8ac04cd710ef2f6246e571b192db08bb2c5484ec58d2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
54564adec400514309832647131555e5

SHA1
737216b9b6ec1afa63d1f71f73582e68e2e0d569

SHA256
428ff28039a67d2b8389fdd470ce9d821a6f619f3b39e6515423abd8a16f40ca

SHA512
bfba3f22bc903f2f7856c725d8b8c877dea6028f8bf0cc5445f56908d077e55e773f389d7d331d9addadbab9102342301dfe4318165da7b12e3162ec109361da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
1ba7a495e0cbc9e95fd464a8e45ce181

SHA1
4b6cf9da3264cf935a06ab812ae79e5c88b6d718

SHA256
daaf36775cfb03bc8f358ac9e83bf3e41acc678111f0d23e0d0cc132dbefa8b9

SHA512
2f98956528b2bc017cb936ec27cd68a3f727672a14daf779d81001988a2db8ee60dd69438c56f961a9f4cd33232d9ff3f243766c5a1ed522f6e6a1f830b460d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c72f767a0c566a97000b6c0abf36d9d6

SHA1
5e825c66bcb1647e03c811e217c857f8a2cea102

SHA256
93ed9de7eb423387185c983e7da4273acc065a054b5757b6afb44a6a9fd40de2

SHA512
4249e2ae139f04b7817dc697851fc29bb51b13f7e2f1a4e01c546d61cf9fcd742db5b9e5ac3dda95062bca6ce7e6c6092eeff1813ed9464273b2224504c6362f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ba8a9c94309308a74bfdfadbe4da03f2

SHA1
24386db5242e3f89d168b86d35ab85352798411e

SHA256
652d76a94f6aadb51aabeff4ac35fc42a12ca8e42ba1f9e6b5c5ffb8c025d154

SHA512
20752a1e41ec564b50f7a87fafbc11d51f436aecd65a073981ece6bd4ab69bb802fc5d51e0a2bbd22f8b90f3ccb7826871aeca18c886e1c6a93d5f74f7f33d25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7263892112a2076068d284f9bbedc371

SHA1
ce37ea04f43f6aa421ef79ae4927d9caa446ea65

SHA256
aa96bfa7852ec2ee3c30b208964aea86e56489f503dfe8dabe7a2cecdf1d2fe4

SHA512
b26cc5b8fd344cb44accacb5c73fdbf2ec4b02c2b8dccabe436ee1f6bd04d90398c507db7fde5e90dd430a57b3026856e149285f38c708daf7213a6ba9921190

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b4abf7e90eee0c6b2e7dcdf2ea4992eb

SHA1
1cf7efe25fba0eec55af49ad926b95e780d243b0

SHA256
f6c4b3a756b7c0af136d50dbf5fcd5eba8d5849c9a50fae2ef0af3f06841c15a

SHA512
94e203c7ebcc7a6fb7dda22c1ac6a0777e1469e6d3de69a2e7943c320348ca08da0d6f009b8ee63a287d9fc215161769c995ce82cb1cbaa5ec25d672dd69a8da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bd7fe5e6b24b48dd6fd8b9cdea164d46

SHA1
2908167496c70f3fd91ef3dc2300d0f6497f978b

SHA256
34907d6b518c286f5e15d294f7bef7279dfddc9528305fab6faa7f7729a4d467

SHA512
495bc578755da6deb9d6f0727ca54535b9cb0ba05cbdec57db9eb62068702d550fd107b828bb1191f220a1cec2ade581ee9fd5b2151facf59add53204b083e67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
92KB

MD5
42369d7e14bb395fa16680fda656f27a

SHA1
543ebb697ff9c33596a13549439f5fb042485ab6

SHA256
b3778bc2fd09c31d51364b3aea5b20dfc0904268b483efb80d84efaeb39fa6c1

SHA512
d29a761afafd6aa007f433d94eabdd4c4f4a0ed378b8993e84f717f2303eaea05a601d16fb738e43a702e9de1b752d99bd6f5789ffc35762b7e301ac4d9a66ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
92KB

MD5
e0c96f23237bc4d6096c6b1e6e005dee

SHA1
6ecf9693ac1c93f20fe79351499cb31d4f775e47

SHA256
1f906fd6bc8f7378af0adf5909b676d3e3d4fc4b7ad24dbcd80b9e9cb6cad3e3

SHA512
154b9aa461a7860ec7e48eef3fbffd1f9c16787606dd25b206b663900542ba054355926a7012bc22a35ebcc5b964576d053079c66cd6f86c480990a7de835f24

Download Submit