fc9da0643ec0f4b03a8d10349e2c243c2daa65ae749b6a960edf34da59453cac

Analysis

max time kernel
135s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
20-07-2024 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ransomware_notes-main/suncrypt/suncrypt.html
Size

10KB
MD5

3a5dde15d6f0ca648b44810fbfc35736
SHA1

6541c6d7f61e1b7fd809ee34ffdb86d6f3ee3a6c
SHA256

0cb04884ca0fce43da755c3da08d943194dcfae11ed695de887ab03d45cb4e0c
SHA512

6970431563c625af252e93f3263d12892428ca0ff236f19554ca6bc1752ad35d5ccaad857183c9aea7f32db6cf27d5ba9071220cdfc3f2336b267a0c3da019d2
SSDEEP

192:Dnzcyc1zLuntm2petn2knAk/Hn5G/bYkczLGUxumD6bASsReVu01TJ:D+5wY3LGwDsvs00O

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133659822403120930"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1224	chrome.exe
1224	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1224	chrome.exe
1224	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe
Token: SeShutdownPrivilege	1224	chrome.exe
Token: SeCreatePagefilePrivilege	1224	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe
1224	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2020	1224	chrome.exe	81
PID 1224 wrote to memory of 2020	1224	chrome.exe	81
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 1172	1224	chrome.exe	83
PID 1224 wrote to memory of 3992	1224	chrome.exe	84
PID 1224 wrote to memory of 3992	1224	chrome.exe	84
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85
PID 1224 wrote to memory of 5048	1224	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ransomware_notes-main\suncrypt\suncrypt.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb8fb2cc40,0x7ffb8fb2cc4c,0x7ffb8fb2cc58
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,4088283890734652094,12534517436100646049,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1760,i,4088283890734652094,12534517436100646049,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2032 /prefetch:3
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2180,i,4088283890734652094,12534517436100646049,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3056,i,4088283890734652094,12534517436100646049,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3096,i,4088283890734652094,12534517436100646049,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4496,i,4088283890734652094,12534517436100646049,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1040,i,4088283890734652094,12534517436100646049,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=736 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2812

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:2928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
c4692cb8ed4b06ed230491181056b84a

SHA1
03ad9609277c9e0d867a63cd121d4fddf659e39c

SHA256
a7c329c9cb7c56716ba24d6f6d67bfd0d7d29255a4b403a1301fc62aad74e2f5

SHA512
11516030b4ce1179e751222b1004428bab9205cf6d96e573130c05e5d6e54ab4a743c64de131318f9dce4eb43254c301c14bd64a739c437c7c508f02082e8bf1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
121481076205e94003c8312e1e6aa6f6

SHA1
981146933b96cd91e680b35620fc1852581b5b3a

SHA256
132afc0f630b423bcc8d7962c1810abec0b13b017dea2afb84cf063769fd185d

SHA512
c0138a7dceb26e839335aa1a60bf0fb951d0423ccca6bfa203e4af7927b1644596a7aa3a0bfb6302af3f9a9e8438da72654d335bec738daa1e0ab4121a97794c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
be122fe67f4078413f52b15a0126dc8c

SHA1
c2dc38084ed74e39555891c33ef7cb400627b2b0

SHA256
b92c69b4aa19adecc32e1dbd12f0d65aeaf8fbb9ee19a9a8e8ec38400e98a481

SHA512
47154ad3ac9890a1d917205963ab2b08ffcc9bf7d4252864b586a7a601ad3626bc89ffa26d9fcc2e67fc6490b5c58a08222f3d768d48c1416ae05c3d5a459e51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2fb94180d087b6452fdb3883b897fbe3

SHA1
cdc331598ceb8a88b038b3225756e3a790539121

SHA256
fa86b654a06249285c97ce5905f1de8dbafcae401bab434fd422d2d7270e7b4c

SHA512
9fce9e54fb874675e82a7e8e042fe2b46883613841b004c06c0309aa277c213cfed98a37eaf84d0474abec70a8fedbbb09316d3f607f77bf635912b9e94ecfc9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9d29b1ba6f6f86f3a9618e90009ac6bf

SHA1
bef1eec527dcf8523e67f6ce93087db154b25b44

SHA256
40e1e7e739cd14e8da7762913d790a8a2b5d53e16f54f1d6c75636d9e33c9e77

SHA512
ed687489bd92f9bd95dea3f46bbe709e8af5edb63406895200c306324ebf352402f4b6f5bee8b4742cc94d3a29bfe99b71f26f06d65fd2124cf6b19b9818032b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
ada655e2851c756101e5e52cd804c139

SHA1
69871fd7aebd75a4da01cca1fc25e9d2a6ea4405

SHA256
658839730f0d9995b230e05a885a4fffc430ddd7c05e0f42bc15506137631767

SHA512
5852eb3f747d676170ab0c165cf720a026aac10740f382f7cafb42ca61d0700311727f8c340f4bac223a43c271f2dfe942f7d2c24072d62e47b69f92bc7f079b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
92KB

MD5
64c6e18d04a8d39f132f615d5460bbb5

SHA1
436290bab02ab9ac75f42da4d00dfbc2c20403b1

SHA256
006563a525f8c85bf1b3a82b935d8c3c66297787a91094d6cacacd564807ce8e

SHA512
96a6ecd2cd7b8f6cbc3b1655eef3319dc15e20cc94ac66a6a4a12591774278cbed8146226c5181b340a40ca54d41c7e8b4c556f4a9a17c9c7f4985ed6e91391f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
92KB

MD5
0e03ce186fab19490ed1e13ee6b761d9

SHA1
55bc9bb17eab38456215084a0e54b53221c79b4b

SHA256
5c410193e026b86b7d4c0bd5ddd7f5fc14c49c84c687e7ae313897a0ae236a71

SHA512
866b514e344a8606f796f36719790890b31cad632bc7d0c04a8d26ee22bf76026afd91f78e439bd6cd483f0719f990a8b4e8b6d53bf3ad1ff2570b590b876a3f

Download Submit