4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

Analysis

max time kernel
149s
max time network
138s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
10-11-2024 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Size

1KB
MD5

bf8d5a737e70dd3493a475b8672f14df
SHA1

01d35be1b65293f7ca43ee1045424599923ab54a
SHA256

6b73c0a42d138d1f05b527c7b936e79af9f44a55d52e35f912da15c0dea43d30
SHA512

ecc23ef88b80944ed135233118db167bf5dc161b0392af25ae846010f9993673bbdb62f88bf6de24dc060a48a0cfe96be261d30f5dac2705ed0f01d987fe24b8

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133757304481971205"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3992	chrome.exe
3992	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3992	chrome.exe
3992	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 4136	3992	chrome.exe	81
PID 3992 wrote to memory of 4136	3992	chrome.exe	81
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 3420	3992	chrome.exe	82
PID 3992 wrote to memory of 852	3992	chrome.exe	83
PID 3992 wrote to memory of 852	3992	chrome.exe	83
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84
PID 3992 wrote to memory of 2572	3992	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\3rdPartyLicenses\BouncyCastle_license.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffc6dc1cc40,0x7ffc6dc1cc4c,0x7ffc6dc1cc58
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,7786848681491589573,5858059143598691182,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1768,i,7786848681491589573,5858059143598691182,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1980 /prefetch:3
  2⤵
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,7786848681491589573,5858059143598691182,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2276 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,7786848681491589573,5858059143598691182,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,7786848681491589573,5858059143598691182,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3904,i,7786848681491589573,5858059143598691182,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4796,i,7786848681491589573,5858059143598691182,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\888058e6-27e8-4a9d-978b-5cf13eddc217.tmp

Filesize
8KB

MD5
26ecf3545edf714ebbb827142cd1cac3

SHA1
eef5a8b0f0be04c51957cfe742d9a970598fb85d

SHA256
955280943a7ad15cd5a131c8bb9b980373faa88192af1523d88b7fd25236adbd

SHA512
46cd0dae490e6596c9a355da72a340e38fbd9f26eec30bdfefed38b465f26f8cd8662c29f081bd76961911e1b22de07973faf41b573ecdd175eb2970dd7ac884

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
46c0ed69547ccba1e5bd93ea34ba21e4

SHA1
ca92ddfca4c5fa58e1219224f3ba905927039baa

SHA256
e098653f7d10ea79663dfa82d7bd19e9d19c622ac7dc2e7aa4c5a34cbef182ba

SHA512
bb623ce6418ae41fa773f0aaa26894db317d364c40c2cb13f63e3e98c8a3c69e998f81537e513f37040c35b832b4b4d22f13ee6df368783182e4d0a5b69cb675

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\75406ab3-ccc1-41a3-8f43-690d95b1d76f.tmp

Filesize
2KB

MD5
b3bc461c413dfc4970cd5afae2ed3c93

SHA1
947e1c4cf9a8e8cc2af88ae8739484ebecd55e03

SHA256
5cb618c2e42c79fe83e9a7e53a2eccad3fd76f79d22b3bca5ed0d4d49d302e26

SHA512
920ed2342925ddc72d9cf713d44729b08cf1c812d8f392c375dcb7ef3abf192e9b3b5c121e7f8d33efa09693715f26efd07e6f6dcb9f7ffaf3e8b88e8a5afea6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cba9ca5ed22954e5848e5981967ebed4

SHA1
9a3b6d2e6b480659ede7cfed26380571eaf12753

SHA256
9cd1cf5d34ec74fd087de3323f6158880200348d7c51a754ed7b698d36ec3764

SHA512
3ecdf79b5fb1fcf7694111c5ea7cad35f729f5abb89a05f75ec6d8036ce7bcb5ab2b1875c5e780a3185abecfe7a651a698eaf0b5a0d8d33a0ae01a9a5f6c81e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7ce8966baeff65f20f9367b3c3bbd098

SHA1
8fb3b84d6e23e13ecc49eced5ad008fe66a87055

SHA256
113341ccfe82d425d0c0d7d9beba7000b78fd9df64dfb195b07c6bb08c7daa26

SHA512
6c39ffb0737c777bd3e3c413c2e386ad01d68d9d49c3ec7ff0fb84ff5e9a14c22023a4a4a8c87a53341a27f226f30ebc8b5ca2a65d178fbd5fe81be2cc1e0276

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
950bc2638d126a888ec1bc25ce3e8361

SHA1
803c217cb0dc3b18663568ebeaf0951bc9d6309f

SHA256
10d52f71ff54dae2b210f26e44cc236bd10b4bd9f3aeb414e5628e1967e1edfb

SHA512
8c936f4fbf0178950b9a9991b4197f93f97e78b7c268e7f90fdabdcde5b82bb4ed0b0365bf51ef50d894c85d45172c9fdf5dfb3c88b7de83442e1d660aefdcaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6885e01b9c8e2b951c106dbaccf5c389

SHA1
5476aa9bd68d5f8a0a82272b8fe520e68119d28b

SHA256
677579cd3d63c6969a47368a6df66a9a0849c67329e7d14d010b17c5508b4b27

SHA512
d40bb7897926244ba10b749b72952755c2f8627e59a0a5e7d7bdd3411a695bf33e4c50cdf3474a587df3cec0e6e1ef25ba3a1f42c4490b6ac3f119197bf9edf8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1343ac02ee1d11185f1e00b03a120bc2

SHA1
587adb3a4d554d505df29dc317a352616c3981a4

SHA256
8670247e7bed1b7189b07258b024a33885d0ca0176238d203abd67e96d0c766c

SHA512
896658df4c728dc0cb4703f3399f95da0de4771e4a17b978777b229a3b65a88c903eacd6d994beb6c83fe3fdced925bd425d6ce46863230d07d2f7d0881691c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9be6809d916cd684e7c1b1191ec36c49

SHA1
29b06814a208ce56478737f100655a731a29d39b

SHA256
bdf581dfb04a48b343d3a5bbc56b7580d7fb39078dd321a14434c3fd10be80aa

SHA512
3558fb22bd256caed6b223aa690abcff78dc6d4240d1cd54adf9c142e243156531b52393c701fba9ed3a734d41b99e1ac765513df4e0214fc1864decc90d3456

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b5ae7f3312dfb9af8ec1540b10a0430a

SHA1
79cb0c421a0f1cdd801625ad3285cfd8b391c3da

SHA256
ed4308e1b2caed06e5e231757eeb1a5e35011940fccad674c649b037ac3bfeaa

SHA512
755e2e13d42899b930ade722228d2025a8686706eececfad2e4802ab94d91b2b08e877eeb9a6bf36a3a1cdcfac2c270921f34e56e7db07010da6ff0cc005b12c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
118KB

MD5
08fe62cd1e479f0c37bf676b4917f31c

SHA1
e169cf74db13691d8ea13fe6bc76fb3700d769ca

SHA256
fc690a969fb26b8abcb62176538cd9d2d2a6424913143541f5ab802298c86d43

SHA512
a10edad4c3d33eb8a35d3e51f5ec45de78b13dd18a4314074562e6256c3b2043b7711733c53410814afa50e2f16ec5a36bc15bb400c2f55b4fed86f0ac9efa55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
118KB

MD5
6b37a249894d1f69fd0e46f94d49fb75

SHA1
d48dc9f1e5749efe76502ec103534e4585eb7aba

SHA256
256f60ffbeaf097261af7fcfd2708d6a038fafedc088816def1aac7470b426bd

SHA512
4d64ae167ce8c8e9c3d7f65d06ca13ff40f30ca1a4430d7f6aba418f6bf50bc1393e6603cca256b7e8029b37c2d4e95fe7a2d7051d46d076123b68925d77628b

Download Submit