4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

Resubmissions

14-12-2024 20:40

241214-zftzbatmds 10

14-12-2024 20:38

241214-zezs6svpgq 10

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-12-2024 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Size

1KB
MD5

bf8d5a737e70dd3493a475b8672f14df
SHA1

01d35be1b65293f7ca43ee1045424599923ab54a
SHA256

6b73c0a42d138d1f05b527c7b936e79af9f44a55d52e35f912da15c0dea43d30
SHA512

ecc23ef88b80944ed135233118db167bf5dc161b0392af25ae846010f9993673bbdb62f88bf6de24dc060a48a0cfe96be261d30f5dac2705ed0f01d987fe24b8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133786823483947821"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4768	chrome.exe
4768	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4768	chrome.exe
4768	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 3564	4768	chrome.exe	83
PID 4768 wrote to memory of 3564	4768	chrome.exe	83
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 452	4768	chrome.exe	84
PID 4768 wrote to memory of 964	4768	chrome.exe	85
PID 4768 wrote to memory of 964	4768	chrome.exe	85
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86
PID 4768 wrote to memory of 3428	4768	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\3rdPartyLicenses\BouncyCastle_license.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8df5fcc40,0x7ff8df5fcc4c,0x7ff8df5fcc58
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,1277371983853446605,3541036284826528746,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,1277371983853446605,3541036284826528746,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,1277371983853446605,3541036284826528746,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2356 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,1277371983853446605,3541036284826528746,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,1277371983853446605,3541036284826528746,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4360,i,1277371983853446605,3541036284826528746,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4712,i,1277371983853446605,3541036284826528746,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
16a8d4e01dbc796d89e254916f9e31ed

SHA1
a98a5726b28c4225126d040edda0ae4ce2b1b91a

SHA256
0adffc67592ec7bccfd12d6c29f52cb8a46dfcb66f14c7cd97c62c823681acee

SHA512
92660b2539109d0faa93a58caa3b5f1a4e271754b9cfd88a4c710169e675bc09094de74a5bd654b833ecac20167498eb4d0ceeacc00256ef140aa80a2c26e478

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
7ed57b70058b9673d6bd3de90f43f740

SHA1
9bbff1a37d9415a0982992e147abeb8a254263d4

SHA256
3e70f6d7725543d50ba3d7dd0721edd232700ce9bc3f3256973b46d037e9629d

SHA512
567f50aec3656cca6d4a5008b35b22e38b079a6681fe70d9a3c07f3c1e5882f3b6345d3782806757ae02aef7a9aec38412f69a53d66de4bbef616a51c20ad2fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
51978ffbdafd165e283f9456a5ad7a5a

SHA1
167b71e362efdfe3ae271022cdf9198995a2d5e5

SHA256
c427237ad911ff747147313663d4e0886c7de242a24992bf96bd6e95a9c10506

SHA512
8f19952c5753dfc1932708a389e2b5f8d6d2d17a15a328a886e80b9b8c5a30ab0401b2c54741a7881149c1ac62372de3f4ac01e119431571f902368647410da6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ec1991aaf08d708499d5976e7fa5bb9a

SHA1
24cc0b67289ee8cbb01bf65ee51b808f430ed68e

SHA256
4c1fb5c82ade2c1d8818352459a6df8f9794b16c55cdca79278d11437ed7dd27

SHA512
108b313fb682f2371bbfa827d3c5f57b887b99cffef59c2084955e6e5b077fa9cfdf3c5154581af2c31b895548c679c5e1f4a84c984268dd7f597e261c7f447f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9b168faec9a3af5a3bd830e34d456105

SHA1
e51624092d65e929a46af96d42325a4464612f53

SHA256
c0b5b1e87220219b0d554fa44795bd0a0eb7933c0b2d21842f0c7248777f6945

SHA512
8779ecb36093f0e0686bd5a9dec375b2812ce66afa6c93a035d80550f938f74dec13280456f2fe6fe14cf0aab3a0f8792c6b4d3866ac9b89b3922b071606910d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
843bf6f405e236c3366d79fb8e824c02

SHA1
cbd2597e3286517c3a23ea1b3a7001a3c517fc2d

SHA256
dc33528f1f98b3f2841d0c62fc8235d368a9f48a0d10facb9743c9c164bf667b

SHA512
37b59f6f8df613873dd4869dc6dd8b3ba1aca4f5b46ccc67b0410f54536afad03af06513a2b9d5b518d7d5222999a5ebed51bc2a3ee34ba7ab90c05afc273841

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3bed1473f08cc957f32e8734f9aa633d

SHA1
26bc49736dd6c98bfbb954a75f9ca12451429d7e

SHA256
87887de7e0b8f10006fbd6067009b92c087482c46b2ccc072e2fdd73a79a19a8

SHA512
0e120be5352550b19985837b6d7fe73dba4b6b6a1ff779514b8e00c34186abf0753b575f5076766f9075903a09af46ce76a92c9d0b58dd081c2a5dd2af7b3ec3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3b1ed0fb2b43a82f32f49d32f7bbfe90

SHA1
42e3215855631f18b11827db614efa7e05aa60e2

SHA256
7b47bfa08251951a98fc4744942a833d5a3689bbf1f54d4a109ea3cf64661f99

SHA512
47353629ed5d5eecaf087f5955babd108eb430800f5cf40c236281c16674f41c542f445a51b30b6e9569d4a0581c26091b2e1c25ec75a9e28588d4996384ae16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
66baf07d4893fb7c3bf000f0bbbae212

SHA1
c7f06f3376f5bfa825fdda0c681b0f561c256f5e

SHA256
9df82b03dde087c453a4612d124eabb67474996b70e5dd8c990abb7239bdf3e7

SHA512
461fe951e91a553594fc924cb2db2ceb7c8784026efe3d8fb504fda353212c78d7ca598c789e53b56cbb210f4ad052698d78e4e45b6855ee276562e1de3338af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8b1a843ab8e606005f3f3c838f50c22d

SHA1
8daff4b3b4c77f5e51ad2b4018b9ee8fcb64dd77

SHA256
40c62f2a3f946104cec83b9c9c9685e04627a23cd1d5abf54392da9b87984184

SHA512
4b522ce109234e918408767912bd533ccf4a1d451f3d14f34d9fc3d2c1afe54823132c7342d536e200044ce27a599c118469bcdbd9270007402416c112b1840e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
9c9e177283bd9875f3875d717a494e85

SHA1
4983bc2876d752ec680597fb811b91a45790aa84

SHA256
922759569aa052f73fb224b19784d6b3fe9c9055c6fee539048083fed9fcb782

SHA512
36586b78f38f740269a93133e03df038d74bf0fa2dae67a6892e32f1983705f1004bd19adf1e1c2e2a46585afc3a0d57af9ae35b49953655cd765f12fc6b8ed4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
a5556704421deec272dd8cd792689599

SHA1
251da06773feb742d3db4e4be7bbb607e675bf06

SHA256
7361af600d24055b9cdef30f1739135f21ec0df8175064776926b2db4371940e

SHA512
f5183e15c7b7789b4cde0ec2a0b3ed3996b754ef1a11ce899151337761f7716b859beb775a360f729afad3f54a1e3fb46a0e7ad0f01b38797bb0d5a6d8ba7f9a

Download Submit