hxxps://bloxecutor[.]com/es/delta-executor/

Resubmissions

15/10/2024, 01:05

241015-bfrbeszckn 1

15/10/2024, 01:03

241015-betedszbpm 3

Analysis

max time kernel
64s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 01:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bloxecutor.com/es/delta-executor/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133734278621568560"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
728	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2576	chrome.exe
2576	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2832	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2576	chrome.exe
2576	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe
Token: SeShutdownPrivilege	2576	chrome.exe
Token: SeCreatePagefilePrivilege	2576	chrome.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe
2832	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 524	2576	chrome.exe	84
PID 2576 wrote to memory of 524	2576	chrome.exe	84
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 1696	2576	chrome.exe	85
PID 2576 wrote to memory of 3188	2576	chrome.exe	86
PID 2576 wrote to memory of 3188	2576	chrome.exe	86
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87
PID 2576 wrote to memory of 4404	2576	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bloxecutor.com/es/delta-executor/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffad862cc40,0x7ffad862cc4c,0x7ffad862cc58
  2⤵
  PID:524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,11152258545167174788,16724537895128256569,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2044,i,11152258545167174788,16724537895128256569,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,11152258545167174788,16724537895128256569,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,11152258545167174788,16724537895128256569,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,11152258545167174788,16724537895128256569,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4612,i,11152258545167174788,16724537895128256569,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4888,i,11152258545167174788,16724537895128256569,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:1716

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2832
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\DeltaExecutor.V2.644_Bloxecutor.com.apk.apk
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
3139abeac9bb4db73d340901354038ed

SHA1
1039b55a3e773968dc113abbe15f69025f149300

SHA256
84ec43facf71d35d66c4271c57f7c101a9f1e94572a75fde1dcf67eae95b79e0

SHA512
d4f07aa4c6e630333d6c069c3614548eca8ae7218f3ce0eaab033f2be945bdc6c1d0e2ae5b59db30ff6c8f1c9e90e9474c5c9ec3cc162590fc6977af2178ce02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
8ab28a6dace612a6c4abddcd8190a353

SHA1
a865b2e4d125e7c533d12b461c9f20294de4ba08

SHA256
4e108b5716b75ea72d16c35f3361e0c32536a2cdf44de2cf9a9536eb700a1ae7

SHA512
f6cc8c169acc090a603be873fa84cee7980dea2ef303b9f7386e3ce97b8bc0cabf44e5e42ff84a45de39da705cb5d30bb70111163a45de2016da2f0c8e5ba7fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
6513298767d9e3299a3988e21d2864e5

SHA1
a426acaeba8e9727d545553b33a50f45eb04ed98

SHA256
6da1e49d2bdcec6492195863d02c81804e36740e815d2b1cb58434eacf9f7588

SHA512
724dbf9d72a591aa69b7e67dbbfea41de3fa061390f39ccfaec15a1672bf405db1bc2af887454cab1b04c6eb86588e204a588a4743bb93e28bc22b2a132d0c26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6ca2a388f6fa7d9f0ab8712f90dc10e3

SHA1
6d4736b76099f4431c7a5a4a954c1a7d32d99bcb

SHA256
ebef886c9b31d68d9468ff7922b35a2e1d409e9655d8aec44ba49665cc58136e

SHA512
34f4bfc4a459ebf1aa6052436588a70a11f133af062dc7e7779e87621e228ef70f8c553747e9f180ce0d4f8e11bcebc34c7f0a78a9fd7f8dbfd2c5ab9d8488af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
55071b2e1a921c8bd137e6c7749e0ecc

SHA1
5fb7a5b7f73ceace4f01d8c76af8ce2859f7de7c

SHA256
7bf553ca6efc96af7a556cd61346f06032ef61602c5a4a68bb7741e1f584398c

SHA512
310fdc2670400c69dc2ef8e16af34fd07711e0417d23cf0ad161243191e03e1817f5c7f86dce069d847951d1004e6d0e004beaaf82f1f4f70bdbf61c7d4382b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e87d30d4ee9c42166c33bbebcf6dc53b

SHA1
35f7357b9e057a5ab3e99c5ef100bbd88f852250

SHA256
bad0ae2a9ac9ad702e5ba962ac6d1fa57b3dbdc04561014402824342e1e71c31

SHA512
bc9ec4da17f6bbce7c9b1e9573b2144f5b4dedf86520ff61afba1fdaccee098b061f4154b942bb0ab792356fafc101104e533c4fd250ee8a72933fadc47ac97a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d4adb634bac9c996739185f53d10b658

SHA1
3a8285a6ac1f51bb92d30620cd8d98b00e19b3a6

SHA256
2cdd07f0a205ed8d0ad0049ff70cdd0d32f7da94d87a0e3fd0d64887f07f32fe

SHA512
a129e8ef35a26f072c3950c72c2391583a46194bfb9527fb0336d5047077464d3b5938dee388d0bb98336aca9462571c8e34df76f15ab493f7d420e0a781cab4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
2a81122a89128e2bf095961f3cfed4f2

SHA1
4350b038ed1fc42ee9a2bc8379e1d6431ddc7e97

SHA256
027dcb1f5d01ab507d1f57930c2fbc2569404371f3c51203b98b50b0504235d4

SHA512
9e3bed9dee37b85b727496c336ff4e652b6cd3f5107802a4e7df9437829aab878ba769b11c3f848ea02e784213e6a5a2a4c1986622dea55e047caa2c14f9d903

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
4ca605c138fbbf406ae22ec10da51b96

SHA1
23fb3b05774d9b9727481401106f1cee17b73c81

SHA256
530ef11c3b41f314c27fed91e770db604b361f4bd5d2e1df649eae3f1a2240d9

SHA512
f3ad6eac21e25da609cd954dc968383eb78d8801ea84a1c6092a9c82d4efb614e380d371447f250e6f1448fa0036d6ecb82f1d153aa36deb1d37ac39c7b61d42

Download Submit