163c0f74e38e1fa79a2f54f01ac0bd08c409932264a80129f0f9cdf7e628d0f0

Analysis

max time kernel
129s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

spel64.dll
Size

30KB
MD5

e3c10a08862ecedd23a0e956763b5b05
SHA1

a019ca8fba2ddd43917404c0e1c125530d73a7e6
SHA256

33d32f4ca9091f7b3fe459a747a072605f8aaf54bb37346850fae479772ed40b
SHA512

949d99c449918e003e85c3b98a1b09d9401788d0accbd496f70eedf417d9539049804f636259e0bb709d708281db15cc7242eba4d8c26930910e96069e5387f8
SSDEEP

384:y1G47DC9Ycghw6ivv0hGNBK9R0P0vx4oKPStPlvyxFNwuY9is:ykSu916gMwiRI0vx4nPStP9yVY9is

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2592	chrome.exe
2592	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe
Token: SeShutdownPrivilege	2592	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2244	2592	chrome.exe	32
PID 2592 wrote to memory of 2244	2592	chrome.exe	32
PID 2592 wrote to memory of 2244	2592	chrome.exe	32
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 2524	2592	chrome.exe	34
PID 2592 wrote to memory of 1736	2592	chrome.exe	35
PID 2592 wrote to memory of 1736	2592	chrome.exe	35
PID 2592 wrote to memory of 1736	2592	chrome.exe	35
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36
PID 2592 wrote to memory of 1232	2592	chrome.exe	36

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\spel64.dll,#1
1⤵
PID:2792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7449758,0x7fef7449768,0x7fef7449778
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1232,i,15958703217541071538,7699902001462838145,131072 /prefetch:2
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1232,i,15958703217541071538,7699902001462838145,131072 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1232,i,15958703217541071538,7699902001462838145,131072 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2284 --field-trial-handle=1232,i,15958703217541071538,7699902001462838145,131072 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1232,i,15958703217541071538,7699902001462838145,131072 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1020 --field-trial-handle=1232,i,15958703217541071538,7699902001462838145,131072 /prefetch:2
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1288 --field-trial-handle=1232,i,15958703217541071538,7699902001462838145,131072 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 --field-trial-handle=1232,i,15958703217541071538,7699902001462838145,131072 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3772 --field-trial-handle=1232,i,15958703217541071538,7699902001462838145,131072 /prefetch:1
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=744 --field-trial-handle=1232,i,15958703217541071538,7699902001462838145,131072 /prefetch:1
  2⤵
  PID:2664

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1580

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x7c
1⤵
PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
51ba450bd9fa308f3938e0a10803542e

SHA1
9bd883a091f2314c76f8277957b18caf1ab0262d

SHA256
eabea4e871522154c6b470ebb3d45c16219618c407d8b482a285452af351aea8

SHA512
c853ca44c12472380e0cdc3bed60ec680b336cfed026b40e886a74ec4b740d640d59c63956c297b41cf1d5142ac8c71ae21de627bed9bb775facd53372fb5545

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
2cd5fc8126aa00552017a101f74b6608

SHA1
639eebeb5b50da0b8e6156a0066af9531e10d1cc

SHA256
28a2e7667f52289e27a4b793622ba9fa7fd6de11c1af344ac69953ac66240b7c

SHA512
baa20c70223d2f8475f36d417d309105f1eaa93bd46cf50597d5d5ba1b7e64dab98fe88498372e68e6978c1b6be4efed4cac08230aca58ae5cbf9ef215c3abba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
425fa9225e844dec248684f36ecd07ff

SHA1
d6dbea7ebdeac759f3da523b89cb758d760dab8c

SHA256
52117ff2571251af7c9e316d15fca22d4514fa027d66de650e08a5cb368f7c81

SHA512
eddd68dbc600a63af694b4f4babf3f3ce9ed9096f339d80c869174a718ffb98f081671946cf0572edcef5051350e317f637419fdc179486f784a2b89e3abc64d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
b75f70efb75045eaa8fe855f1d858a5f

SHA1
c31cbaf12316f167e4fbdf9d06a25384911363d2

SHA256
6aa32f205de4a8ab7c9f3e4d868de65f7f73261cfc2c43797d10474ac172e707

SHA512
d9ba7717e0f6824d032b90a70cc96f5d8536b181a4994d5f6313d95800f4d9bd6d1c08cc47a0ce7d5942d827ab4e24c1e9d328dcbe3016ab6ccee37b75804fdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
9bfefeee2b8f842e38aece0e6ffb3274

SHA1
84efc8b0a0138eda91c24d68a95e6667a0a58d53

SHA256
d43571482ace7e52bf0f6d5e0ae1207d00367a5961057c77876604048ceec374

SHA512
47282e526c03b7c12e1c1c899fa1ffd6b972b321c96361df14c045ecf47d786c9ae4468652ad5a502786524df6b690aafda04fa7ada09a0100271b156e754066

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
338KB

MD5
b64b02898d3fa42f00cc21658ca39ba8

SHA1
4637705cc47d43ce99a1d329fa6103ad15526e05

SHA256
fb735a48503c65c74f5d15beb9befeb7be56187ee276b509338301f87f2048dc

SHA512
81e75a18f216f6166f1e8247e163e95023df2b363f5ad1df6f47fe16f8b9b0f4a289c7d3f88a499c4a38f1db75f0f4116ea3b9287069ce9e0ddbe0849b5e54cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ee409ef5-d63e-431c-a726-3e4ab9b3eb04.tmp

Filesize
338KB

MD5
0804e568fcfe4d2a3164d1cf73e6830a

SHA1
4d87951432847d5d7318abd1cd618c3ec4e75f14

SHA256
2f0f88724c831f331df48457914392eeaba08ba7fb475e9c8fa7eed372766842

SHA512
af5c292d3c16eb2b62640f2a9246d71ca2f8f26477b0e938adbc5172382f8cea004d66b0ba90cce2b0b877f044224747d5a59164069b30e8228a2b11c1ba4552

Download Submit