hxxps://url[.]serverdata[.]net/?ah_jEDBmMkE9dIj5QUr6CtK3cZlrvmtTU-0qCgpK-s8k~

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://url.serverdata.net/?ah_jEDBmMkE9dIj5QUr6CtK3cZlrvmtTU-0qCgpK-s8k~

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1576	chrome.exe
1576	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe
Token: SeShutdownPrivilege	1576	chrome.exe
Token: SeCreatePagefilePrivilege	1576	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 3884	1576	chrome.exe	81
PID 1576 wrote to memory of 3884	1576	chrome.exe	81
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 2624	1576	chrome.exe	83
PID 1576 wrote to memory of 4060	1576	chrome.exe	84
PID 1576 wrote to memory of 4060	1576	chrome.exe	84
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85
PID 1576 wrote to memory of 3880	1576	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://url.serverdata.net/?ah_jEDBmMkE9dIj5QUr6CtK3cZlrvmtTU-0qCgpK-s8k~
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa57b7cc40,0x7ffa57b7cc4c,0x7ffa57b7cc58
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2076,i,17026628422845864711,725081457708623441,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1828,i,17026628422845864711,725081457708623441,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2124,i,17026628422845864711,725081457708623441,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,17026628422845864711,725081457708623441,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,17026628422845864711,725081457708623441,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3784,i,17026628422845864711,725081457708623441,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4740,i,17026628422845864711,725081457708623441,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3424,i,17026628422845864711,725081457708623441,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4408,i,17026628422845864711,725081457708623441,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4960,i,17026628422845864711,725081457708623441,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=208,i,17026628422845864711,725081457708623441,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4676

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\207b4d49-3bef-4e3c-8d6b-5bc2e77ef1d5.tmp

Filesize
8KB

MD5
25b2eb9546fff2d63e9867d7dd799d43

SHA1
fd019bea982d9acbfe4de13ce69f9497015a5831

SHA256
cfa5a1f8a7e5c3b53f3cdd1046dcabe3adf69ff2d176c21394e3910c2ddb539d

SHA512
ac9b7f55b1a9c05beef1f7bc1f726358578dd1aadec544dfac946bc62da8fe884f3f6d67777fd33bb3c74829470b88d826b3f3dfd773e58f12cf2a7c4957d37c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
d3b7c39f2e85a986a7a1fb435e852a4c

SHA1
dc6e57b1150e3946e134229ce604b42a88cbff2b

SHA256
2e4163483f4a3e4baace6fe89d5b45fabff203e1bced2895054cda0a8ff1a19a

SHA512
8acd7b794fcbcb95a13bea32af2dba816d27bd26c6815b526cc2a6a89d30a4b1f3078987564e1f5f93c026abb4ff48866286f3c47538be86cc0a91d6ac0afa1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
954594a7df801754db9681ca8f1ad159

SHA1
861f6e31d0f9ce61e887a0d55e92c546c9466f00

SHA256
ecd2b21b90c8b402943aa2fcd66101a0f842908fc0bc052afcd354e2a02065a2

SHA512
e5bd82f9908d46dde8f7e50ed132da6615c6ecd86d78adc151f229482209de50f2ed7d66e631e7792faceb246f724f7c45f90a42fda3b2add61e352205faccdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
16537672f3d6f9da368a35b01432d55b

SHA1
ff611623f9fe03065fd5c7c2793b9e4ef9b10e36

SHA256
da05cb5dce2749e4bce202dea9807b67228df3ca69cbd9156d5fd8a27be33284

SHA512
58f24a0485d3b9e3d796142852f9b83b515248be87d662795fa55691d5e8ad5fa1661e21b97381d49c266326e669cc8e78468e8f1fe98321a56b2cf43dcc40fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
a6f644fd0f767f13a87fa01108886e97

SHA1
d112489b28daaf27dc9ff473b1f9286bbffad7ed

SHA256
ea460599a06cd0e6855faef8c58b41747be5ae31b76c2b1ce959227a52bb7324

SHA512
1c9e9cb1d579b251cd11f0c37edad59d909ed7a0c53cc66541230af5e08e5b94f41943aa7db118ecfe4b3b37d6ba07b795b4fcfff79e43905474a9cc62c5b5f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
794a8b9fa44d8dfa7331a4d1f8447662

SHA1
831b107b4b830de14c5e9ef7e58c163e6c916890

SHA256
f6f5dc6463b63fa81cd47d8e34add9eb9f1ea956fa560a2c50e3c0fca49769a2

SHA512
7779f44dde8923fabfc53c5e96d97f984a3c8efb1acdac05877a166449a963d053518448832e2ea1671d5d6c2f05ce5c0261303d58c7e85aba0d6d477143fc97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
d9fdc2dd1b8bf787e2d36468773c276a

SHA1
729e478c53426eb023b792bb9da0145dbf9d61a2

SHA256
72f07579028538715795e8a5db5bc7dfac8281d27f525f9af1992ac969d16782

SHA512
e5595cc4ca4749f95de4cbed9c2c45b810a9a4d2b7d89e5d62fba3c1c4b25d49a01262fb71df35272b8be3df0d8ec84a4ab57728ca875771ec157d56d71fc36a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c0295018b137327c2e0e867c1be86856

SHA1
bb3dc23118ce3ff9b7debc860fbb5dcfcb464b65

SHA256
825392b7ff30d2533c7b03341b17a9b4191b6fce772f0c4a4648318b240a026e

SHA512
f0870e0a0b31b45081d36e11cfaca7fb5e6a2a2c4bab926bce72110c980ed3de480c8182a523b18a5ca338e575ac2936deed76b2424a122e4a11aac8a34045dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
eef24984225837d2893df9167df80abe

SHA1
96cfb661a7412f116cbd4ca717e35fe3f1ec20b4

SHA256
563cd8921734844afa1722e1d6facd3587e756926ff8203d067e0a53fb3431db

SHA512
4269edd3d7a08dfc043135648c10daa111398129c48f9a2ee0fbdab66446ff495df7efdf64805b82208322931e19477bcf3ab4a853700eb55acf2df5ec048fab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
79a1b21686f7160f4175275c913e83dc

SHA1
67208ebee433daa839ad686ad21ace814ab4db9f

SHA256
ffa3788393dd541f10d62d98231506030a4f6002188861571637427f3fe84415

SHA512
c2b227b13f5ffed920ef9e183a7d6d45a3cac3ec9427c43808adae14c69173aac1732788b329de358dc8b05107bd38679a3caf71ec525d6e5428883f2eebb97b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
f8541383d1153d61ec26cb491a8af3ad

SHA1
a4b6f4b0e6e0a590790b80c2da433df8f34d6afa

SHA256
586f94569627da6936c470eebdd114e00d624dcf7c340356de65d987088b2ef8

SHA512
cf43152fbe38b9befa5bd7a96150a41e8f6e9e8a7f46e77c8c2cb5143723adba1d5d261b3a65727c29323261593a5112ddad194c5ec7542808b78b357654d340

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
64237cbfe1b89ab0f1cdb283a9e3f5bf

SHA1
f90f340c7204efa4cf2910a427760e177e8c6ac8

SHA256
7bc7b09a5afe170862920659de0c6c69da6e9a421a628718baf87dc230de7d4e

SHA512
16b1cc491fa9d5cd734953ea81b21716a9b32a899ced30909b999bcd078a81e814e10c9b735ee8e715cabd8b5effbbabceb2c8d489417484ce994e5f1e49ff30

Download Submit