026d3a2ce08da16d69e7da0110f7e205a0043bda286edf6df0609b310aa801c9

Resubmissions

17/08/2024, 04:28

240817-e3s1baxcng 10

17/08/2024, 04:22

240817-ezgg4sxbjd 10

17/08/2024, 04:16

240817-ev7hqszdqq 10

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Guna.UI2.dll
Size

2.1MB
MD5

c19e9e6a4bc1b668d19505a0437e7f7e
SHA1

73be712aef4baa6e9dabfc237b5c039f62a847fa
SHA256

9ac8b65e5c13292a8e564187c1e7446adc4230228b669383bd7b07035ab99a82
SHA512

b6cd0af436459f35a97db2d928120c53d3691533b01e4f0e8b382f2bd81d9a9a2c57e5e2aa6ade9d6a1746d5c4b2ef6c88d3a0cf519424b34445d0d30aab61de
SSDEEP

49152:6QNztBO2+VN7N3HtnPhx70ZO4+CPXOn5PThDH2TBeHjvjiBckYf+Yh/FJ3:6Ahck2z

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133683418662578962"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4672	chrome.exe
4672	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe
Token: SeShutdownPrivilege	4672	chrome.exe
Token: SeCreatePagefilePrivilege	4672	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe
4672	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4208	4672	chrome.exe	98
PID 4672 wrote to memory of 4208	4672	chrome.exe	98
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4508	4672	chrome.exe	99
PID 4672 wrote to memory of 4404	4672	chrome.exe	100
PID 4672 wrote to memory of 4404	4672	chrome.exe	100
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101
PID 4672 wrote to memory of 836	4672	chrome.exe	101

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Guna.UI2.dll,#1
1⤵
PID:4552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffff74bcc40,0x7ffff74bcc4c,0x7ffff74bcc58
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,11687175704479784961,16047026926511087041,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2232,i,11687175704479784961,16047026926511087041,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,11687175704479784961,16047026926511087041,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,11687175704479784961,16047026926511087041,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3324,i,11687175704479784961,16047026926511087041,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4572,i,11687175704479784961,16047026926511087041,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4896,i,11687175704479784961,16047026926511087041,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4932,i,11687175704479784961,16047026926511087041,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5040,i,11687175704479784961,16047026926511087041,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4660

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
ed5e80150e8378b73000085b3474501b

SHA1
9726fd73dbb85c1b91043a0be4afe2b8dce081ed

SHA256
64523b7cace9bfebcd5cf655b2c24ce6621ea9f982f3f97ee8f90b3b5570657a

SHA512
1122a33a3df538ba7957e8bc7bd5dae7f572c5ebc711ac0eba6dd14e65d653190ec3907a3174dee3423f1a8f0576ec10f346b092beba02bf6c0eb518051c3cf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
9417508e1ef4f9886a7a585a38f7f37e

SHA1
55ee6990c31fa5bc8a23fc9c2e75ac429c69e94f

SHA256
9ebf2b130fd55a5b8c6ec53d977784020f23750a03257da4ed949e3f62f05ef9

SHA512
9b9cab72eeaed8885d0ad5123bce6907f75f00ae98f724515dd897f7f618a1fc3c651ff7e281686675179daec3a1633ef1f21d98e380fe464fe0069a0ae4dc33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b9e30f0fe9d1afb96e92b82c49b83a02

SHA1
d51f2bc0542d1966c26ba17f9c9a66cf44954997

SHA256
2aa70efd4f3e00dfe3e331fde4f4efe7cae23134d1a2edc061ba6081804aedb8

SHA512
47dfb2af5ba8ce02505df355f62d70ed3931a994c555faa49a4ceff28ef087be99a5ba689b6575a631f98ac665921f8ca2ab1beb00e439d21110ec5199718502

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
352B

MD5
fd34fb475e8d01c59984a930bcf6e344

SHA1
f6ce60b2f35cd8874572383aa05a15854aeaf58e

SHA256
ae4f69473e6a6b069c1eb732ec01b5cfea36dfbe565ab5d7b48cf16190036a0d

SHA512
03ee3cb9db4a788c614c0d297b6aaa53c523b340e22cee18d07429ed4eb5625a9c960f78d2b5be17becdb4d54168bac99dafa7cc889df63cf6d517c95f00cc29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1ba95014262b13a34f6f583bdfb5fef9

SHA1
c469cf3638aa685a6df5dcbcc57bb972991baf0d

SHA256
43f254fd1b1a9a769badceab2b7ad577765e5706b2a47024e2d8dddeb634748f

SHA512
5bfffd47ac0d8e139986f5f8b07169a9aea29087c6d36202e1b80c23aa5d0834071c10266372eab21af20367316463e22e2f34dc4e9e8c51acd22f044558c43c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8c85fbfa459fe3e9234871ba50cf700e

SHA1
fe7ec10d030eda37ccce1552265f86ce23dd94d6

SHA256
3fc26ad768b4a51a674e43e21431f5e16f662592e529189c08a06effab081a64

SHA512
519e7f8da38790cc8bc3aa17734f9677677649d2506d241fe49fb8c375d5ac5347ffe3275e6328edc67651e07256e3425b34130a7ea6fb251ea157f0d4da0484

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
994d8e38f3f7ff235e0dd2b008a5e6c3

SHA1
eb53428a4ef7b155f1db12913c285f28e2502287

SHA256
882ee434595583bfac288959bb826bba20d183a969ca0a1241f8737b8e91a973

SHA512
428dc4186b4fa924625ebb13673ebf6f37ac215ff3056c05d8745a4bc4021cf14f7cabe7f19df3b6b52f77eca694f0fa7cc89af097fcba2aae4fbc05797cf10d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
21533217edbd0213241d5551d69f6712

SHA1
388cf58b6854596fae79741e607089560169057b

SHA256
29950748771e30c48409133bac0f73fc26e5608596ef13e96cf4addb79a6e305

SHA512
157a4a7c83b5e8229fb1254426caa6ca68f86706fae67ca559ecb074e003745b1372047a5dd26b3259568ae8e11508a445f22b6740f1d99ff2d8010527fb35f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
02567c7cf189b18b401e39400c02edf0

SHA1
d6088ef72a75f593dcff2dcc2425960dcf877909

SHA256
7b83c6f93821d23a6cc146bf74dd7549c1f136cd2ab888ce35e7c7ef40c53c33

SHA512
e6c587e1ce3a23e5998937f450ce05560a8a8c06d941d6646807afc73f03329232ef91c872e8c8d36cb07505b2cd4d71a7071d99e542c3398e43b81adfdc0c04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
542916afaed2c8834122748a420fb583

SHA1
c908cd8bc59f1176a08f6c0321d1f67c19d6c8f3

SHA256
09448f94aff69366c0e4f57f33ea61d44d1d0916da36cf837dab4592cf9ac985

SHA512
6b29b9673f21dfa75db8fbd51b4836abfeefb4b742963a32df3ac5b7bfb1c631233b94dec57c8442ea618b400285022cb940cf7ff9c911cc70af258912b629a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
063c04b5c9fc73ac418866e979f4fc1e

SHA1
5788a115bfbd08e859d41c5206818d8789eeeed9

SHA256
ca3b9c79f616dfb57826f98284943913f95f523ff665b13cf44e279820754b0c

SHA512
02c8cc76f1af4bf4510fc5889149a8f81ac2ae0196eaf1f27982640c61e5cc822f83526813ca50b96d9f246b2c371012e823a9854c2f099205e8264f91e15970

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bc2b635365d3cfcdea699b9b14383444

SHA1
230f373587c319167fbe89cab6e52017d7cbe80d

SHA256
7cbb1fb737f88f4b92670bc0920374061a547a4f47fa2b53277ca17d50140836

SHA512
476d64a048b34794fad32836b30db25d5207e97a23c81bcd583a0344ee807c600f3ded6328ebe33bfa36437486ff5ccbfab6393eead3ac8a5c89b64d562f7a84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
f02adde58601b05dc0ad5c5527e9714a

SHA1
e75bcd2d8362857355c459d88aa52909c45911dc

SHA256
fddb271190a9018bdddeac935b82d9e599d447f9fa77f36951fa941a5f187b01

SHA512
d743f2b978f41a1ed78df1e47585c2c814d78b9e5689c2a2a43c2329799dd25defa2569aae697450e29c2ff0fee4be5ee699ab67a4ba53e43be10e7055bce71d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
7914b039ca58a0020247cf9e677bbb0f

SHA1
5a52ba66a46c9b1d55aa019900e5e5cd09861f38

SHA256
5ef5b94007ad5a16bdf41d27dec9414cdb103a4133b46481792d4259cd762280

SHA512
fd53ffb72b107c8fccfe056483440c2b7ba9b98b7a98b1efe2f66b303ed03c360deb2b69f983623d6ef10593e7ce035949b6e7ee6e0ba25526c8a9495b5a8758

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
196KB

MD5
bc06e2f9739715ce53f350c4e4648b99

SHA1
af13c593ae78ac3e8d0aba1dd544ea66dc1d3b4c

SHA256
7cc554b8df4b887bcb33dc5d8ab8b509a0d6d984531fefaac4b0765ac672f1b1

SHA512
a5a27cb45dc563f25fc21d9a9d2627afdeb66bb6ddf302480a08d9b9795566f27f3ed2a6afd0b8a3bf3779d955f7908311fc6503be13c97bba14976846101608

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
196KB

MD5
872a72e7cd5e712b49e310ca2cacd143

SHA1
fa270b490c820f9a4bf9a0e86642f18c9af120f9

SHA256
0ebddb3c06b9f5304bc01ac4b5c8135aac74d27591f93822e90d48e4c587948f

SHA512
14061125f7968f85a7c9290a8d45feeaf5176bf0d07b023c1b5b6561b8feeea5b5214cc72a3cd219f2da5daae65385d625310b8cb11bcbf968a91606ccaa43dd

Download Submit