hxxp://"hxxps://covid19[.]protected-forms[.]com/XSDJrUUx5S2tCaUw3ZTBpN0tsNXc0akJjanJ0YWlaRXNacitIa2k2Z1U5d2JQeDAxY0dTcjZ0ZXdYVTZLQzRTaldzQ3JkZDBPSTRsemFwVnJ5MVpGZXV5bjhxWnRCN1RSUXF1cUZhNm9HU2lKalZBakpwN08zUT09LS1CMWs2bFlwa0NFajhzTm8xLS00Tk5jUTBiVDczYVY2Z2JESjVlZ3Z3PT0=?cid=2196429275") and ContentType[:]("1"

Resubmissions

19/09/2024, 05:48

240919-ghq2bstdnd 3

19/09/2024, 05:48

19/09/2024, 05:47

19/09/2024, 05:46

19/09/2024, 05:33

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://"https://covid19.protected-forms.com/XSDJrUUx5S2tCaUw3ZTBpN0tsNXc0akJjanJ0YWlaRXNacitIa2k2Z1U5d2JQeDAxY0dTcjZ0ZXdYVTZLQzRTaldzQ3JkZDBPSTRsemFwVnJ5MVpGZXV5bjhxWnRCN1RSUXF1cUZhNm9HU2lKalZBakpwN08zUT09LS1CMWs2bFlwa0NFajhzTm8xLS00Tk5jUTBiVDczYVY2Z2JESjVlZ3Z3PT0=?cid=2196429275") and ContentType:("1"

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133711975934420956"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
960	chrome.exe
960	chrome.exe
1944	chrome.exe
1944	chrome.exe
1944	chrome.exe
1944	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe
Token: SeShutdownPrivilege	960	chrome.exe
Token: SeCreatePagefilePrivilege	960	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe
960	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 4196	960	chrome.exe	83
PID 960 wrote to memory of 4196	960	chrome.exe	83
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 1300	960	chrome.exe	84
PID 960 wrote to memory of 3248	960	chrome.exe	85
PID 960 wrote to memory of 3248	960	chrome.exe	85
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86
PID 960 wrote to memory of 2292	960	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://"https://covid19.protected-forms.com/XSDJrUUx5S2tCaUw3ZTBpN0tsNXc0akJjanJ0YWlaRXNacitIa2k2Z1U5d2JQeDAxY0dTcjZ0ZXdYVTZLQzRTaldzQ3JkZDBPSTRsemFwVnJ5MVpGZXV5bjhxWnRCN1RSUXF1cUZhNm9HU2lKalZBakpwN08zUT09LS1CMWs2bFlwa0NFajhzTm8xLS00Tk5jUTBiVDczYVY2Z2JESjVlZ3Z3PT0=?cid=2196429275") and ContentType:("1"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9fec9cc40,0x7ff9fec9cc4c,0x7ff9fec9cc58
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,13129184805344264998,2086878750243372097,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,13129184805344264998,2086878750243372097,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2276,i,13129184805344264998,2086878750243372097,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2232 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3020,i,13129184805344264998,2086878750243372097,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3044 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3036,i,13129184805344264998,2086878750243372097,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4424,i,13129184805344264998,2086878750243372097,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3324,i,13129184805344264998,2086878750243372097,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4756,i,13129184805344264998,2086878750243372097,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4744,i,13129184805344264998,2086878750243372097,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3372,i,13129184805344264998,2086878750243372097,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4456,i,13129184805344264998,2086878750243372097,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3412,i,13129184805344264998,2086878750243372097,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
d64bb0d9ff47d7630dbc27a899a58f7e

SHA1
5aa0184cf9be6ab7928d1ebc74fa092c29becfc3

SHA256
d7f9ec4870545fcbe1270fc9032c9021b6fe0bdfb39909194ae768f27d28f4bd

SHA512
54722daba2670d13abc8762bce6f0a05a214fe33cf3d712a70a1eaf79811d5d146f8dfd9c1fd1a3ce9620b5ebc49c0dc897517c87e7a88f0bbb39dc3f81c5f5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
961B

MD5
c2d3a6c770ba1a045797e09d350122dd

SHA1
a0b34f43f298ddc302d8fb7c14d63b9c6f3cdf0b

SHA256
d6558846d8d5cff4baa659e254349a3fbb4d448b4fa9da404b2ca35a067ffed2

SHA512
192f1f595b2db6596e71a88b2fcfb3fca67991014bd883ab54643162816df070a3b5cb53131f4d58745033b5bb516ab1a2d7ba799c85d04f44137eca30f5365e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6b84d70c4f4bd63d90a633864046b619

SHA1
1d20418266439d74bc7bd16a36761e81ea317cdd

SHA256
acab963d5ad82cfd89b3dcab270c95a133764569d3f880d03cb956b1e4cb911a

SHA512
35641f311ba9942647bb0c1f2f77fb2fef145e27df6d3e27a894c40e49e3fc565cf2d0c82285b20a8b77db867e8f683b8879b73d0d3e3c1376f4d21c4bde36c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
21a2be356266075f9a828fe21f8912e6

SHA1
2411b4dac65abec27d64fa0fd1f8fa22a4ab341c

SHA256
cc105cd564c3231b5176ed25ab3bdf6161e68a90d7aee859ae5b0ec83a11fe9f

SHA512
6e5de8a5c5df6537c652a4699b13e25525f0ae01b5ca7ad0cb7ab86f669999e75eec556e990aa3872f526fbba42e3989553ebcc9a6ae520cf1b83598232ff28d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f8dacb30b94cf3b08314aba104c26bc0

SHA1
ec89a8d07fa635f7e585fab98bdff498cc6fff05

SHA256
08c627d47afa6c01c8dc80612c839d3f4ffbc2791131e7f2769cbc093c094fbc

SHA512
1dec65ac490fe3a62e72cba3c4ff4454df9538733d63593df34485137e8d9f760c95fe3c4ac9055b4e3380b8b45e66ae3bc446e01960e84de0c5917ffbb40f6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3048f868eeaf88b46735b6af0181c806

SHA1
267b5b995eb0b5a06486ec7ef5663a66ed3f85bf

SHA256
2dcf9b414076fe4686b3f14e8832f18ac125ab14c63f6dfc98a280e68d1fcf95

SHA512
3e778af6bb3f272e3e3ce662738c26aaa01efc9f0c486338421c64c97f874aa67559d511c6b26f39414b232136138f22109b400c998233122ea68ab4b4d26e08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b038113cf3b2e3751104bedef3802acd

SHA1
0b2ed3cac74a53c66bcfeb75be0c2c78250faeed

SHA256
3dcfbcb0d4258ed7e15b680b8f26e2540b353aab9fb0936887662ede9111d9d1

SHA512
13a7d1e184f09fda5457439049f5428aa014afed45b1ccd8cb0cd433b8c401f9314bfe107a158c15e0a4ad8c1c46612b2b856f4cb0b5f4d3a1040aa8e82968d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
fa24b3f61224cb4a253d43be1c93b4ec

SHA1
681822ef68951ff5b2cdddb31790234831320472

SHA256
2b3ccc71c27e58ce4c305bd2497381224784f38df13c701474e2c590a94a04d4

SHA512
ef3d2e9976303fd016de6f87d313b06b70d4cd27c2aab1bb7c3a9d373cf2445811b216ad98235a6d454e0d18868e52e2cdf6284b4eeb45a42632afb35cb7ba23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
4859a180e28ee242191becf4c4c2e33f

SHA1
e374b5c73e7ca39f7b192337b992b53c225ba053

SHA256
ed283d115a22fb092ec44791bbcd0eba61de560174d96de10ff5183d0ff4920f

SHA512
c1e44ea34fac2a8b8a68e6823694d9caee182a9845bbd5c71a2515fae53ee2ba6d87414c2313a614e8ad0bc4a82cc665c15725fb84cb03908fa17fd5e0e2ede8

Download Submit