hxxps://nts[.]embluemail[.]com/p/cl?data=%2F7yOuYbl6neimxty%2F9pwlUGT75ApLRnz8BYMHKHo%2B%2BZfCrK9L67avPWpPRQ3suZzEsz0zqe0G%2BFWjwwFZkYUQw%3D%3D!-!8j[:]fl6*-*8c3go6,!-!https%3A%2F%2Fwww[.]experta[.]com[.]ar%2Fart%2F%3Futm_source=emBlue%26utm_medium=email%26utm_campaign=Sistemas-Mail-Triggers%26utm_content=142_RECORDATORIO_VE_SINIESTROS--Novedades+P%C3%B3liza+460748+-+An%C3%A1lisis+de+Siniestro+%26utm_term=none--2--none--90-100--TRIGGER%26embtrk%3Daf1-R-40303422-R-8j[:]fl6-R-5f4bma%2C

Analysis

max time kernel
122s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://nts.embluemail.com/p/cl?data=%2F7yOuYbl6neimxty%2F9pwlUGT75ApLRnz8BYMHKHo%2B%2BZfCrK9L67avPWpPRQ3suZzEsz0zqe0G%2BFWjwwFZkYUQw%3D%3D!-!8j:fl6*-*8c3go6,!-!https%3A%2F%2Fwww.experta.com.ar%2Fart%2F%3Futm_source=emBlue%26utm_medium=email%26utm_campaign=Sistemas-Mail-Triggers%26utm_content=142_RECORDATORIO_VE_SINIESTROS--Novedades+P%C3%B3liza+460748+-+An%C3%A1lisis+de+Siniestro+%26utm_term=none--2--none--90-100--TRIGGER%26embtrk%3Daf1-R-40303422-R-8j:fl6-R-5f4bma%2C

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133494713808023360"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2536	chrome.exe
2536	chrome.exe
6112	chrome.exe
6112	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe
Token: SeShutdownPrivilege	2536	chrome.exe
Token: SeCreatePagefilePrivilege	2536	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe
2536	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 3832	2536	chrome.exe	42
PID 2536 wrote to memory of 3832	2536	chrome.exe	42
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 3192	2536	chrome.exe	93
PID 2536 wrote to memory of 4124	2536	chrome.exe	95
PID 2536 wrote to memory of 4124	2536	chrome.exe	95
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94
PID 2536 wrote to memory of 4692	2536	chrome.exe	94

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nts.embluemail.com/p/cl?data=%2F7yOuYbl6neimxty%2F9pwlUGT75ApLRnz8BYMHKHo%2B%2BZfCrK9L67avPWpPRQ3suZzEsz0zqe0G%2BFWjwwFZkYUQw%3D%3D!-!8j:fl6*-*8c3go6,!-!https%3A%2F%2Fwww.experta.com.ar%2Fart%2F%3Futm_source=emBlue%26utm_medium=email%26utm_campaign=Sistemas-Mail-Triggers%26utm_content=142_RECORDATORIO_VE_SINIESTROS--Novedades+P%C3%B3liza+460748+-+An%C3%A1lisis+de+Siniestro+%26utm_term=none--2--none--90-100--TRIGGER%26embtrk%3Daf1-R-40303422-R-8j:fl6-R-5f4bma%2C
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffa315d9758,0x7ffa315d9768,0x7ffa315d9778
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1812,i,17293400996511864179,11957663093916803015,131072 /prefetch:2
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1812,i,17293400996511864179,11957663093916803015,131072 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1812,i,17293400996511864179,11957663093916803015,131072 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2840 --field-trial-handle=1812,i,17293400996511864179,11957663093916803015,131072 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2832 --field-trial-handle=1812,i,17293400996511864179,11957663093916803015,131072 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 --field-trial-handle=1812,i,17293400996511864179,11957663093916803015,131072 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4012 --field-trial-handle=1812,i,17293400996511864179,11957663093916803015,131072 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4572 --field-trial-handle=1812,i,17293400996511864179,11957663093916803015,131072 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4732 --field-trial-handle=1812,i,17293400996511864179,11957663093916803015,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6112

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025

Filesize
216KB

MD5
29f3b5de369947720b2cd5574ecb1ea5

SHA1
7cf4373d4471aea8a5f3511893f8155dfc194577

SHA256
66be19b433b653739b10c257365d71d110958c8a150dc19c0948c27fec3ab5b8

SHA512
b0f82658be4f39f41579b62dccd4ac860a1a385a2b4eb3aecf91998615ebb4c34e95845fd565067d295ab35c47eb8287ff365a6505a663615dd75669f453bd59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dafbdaea3f3150a90f61b552a4cb8387

SHA1
84b4ba0bb302ca2e9a6cab95485542c20a4596ce

SHA256
b0c87d4755c34f9c4845ed483d3c3a7ceeb4c96be7599204a45df5dda8389f92

SHA512
b9617f78ea99c780b818bcfda2bae6b6a7ad5571dc5aaac6bb680cc38b36250a02efe325f3c3e400fddefbad3e871f05e65d2350758a0f53d2e64d00d42c7c64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b240b6a6ec16d5779d55a9ce6d615473

SHA1
af0c863be01fa36d59f9be8b5d3b22700146c78c

SHA256
cb142002f70d6c36636fc58b6bbde9845fbe25b5208fccae28bcb33de6236913

SHA512
6b61051d6dd943a709112d0ee8e4f69dfe5b08cc34fffa98b52ba8ec1ada68a3bc77d167244679f5a3691be8168e8fbb1fff40dc5c6028dfa3f523bb1886528f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
f695f430d7d495b7bf632bee90ecbbbd

SHA1
9843d4c8fdb0ebdf8d9d4fbb95c83baffe8d1659

SHA256
8aeeab479a5448b3116a23e8c011293afb6d5dbfe7801748e76c0042c1791faa

SHA512
5185bdf13d039d9a366417d62095d1e4ce424f47b840668df0ea6a1a771e2d6bcb7ddd1983ffbab7e0735fb0795c6336fc1c97de1ef8ece0f5da0d8cc15a6c54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
6cf2246f07efd4ed000da901a9a7af56

SHA1
d035dd5c186ec7f0a4752bdf2f0cac2359e8d758

SHA256
993944d8d10200678da224dd9cf015e9bf74548322c059ef38c69afc017c2853

SHA512
af5019a8c6710830434855168e0144a7f3810b6a82ee7a1ca1d3a6b89e63abb83a1cc29e7dfd3caa683b532f601015a4fc938d888231d55e3fc0084856f8eda0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
db22f7f00ff0a8351eb5a2f1a634de68

SHA1
afb95896ea3deb76a7bdd587ab15dc0d6586be2c

SHA256
b83e832b4da2b7554f3acb0e7a9395cf5bf6135f56ab9a7a3d1a27bb2743eccf

SHA512
20e05502f9fc0144b8ed815c5daf5849d47d0f12f8b88ceb6e9304cf367539ea2d8124c3ba02f633d5c9cf1c1e02e63a27f8b69e51be77040120cd8720e37d08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3f628c8f5b7c414f4fae0a284d85f649

SHA1
5692749cfcd03dbd67cdcce8ef8f16276b9e611f

SHA256
0ac9973f3dd616214561cfc2f8a72d0556e3a52a4de51fb1016fd89f71df1068

SHA512
aa390db8e448fce97362e3dc87981a9edd5a091a34eeb7830f26e3d77b66f17f3b695d7a514db2f7440b7d4d6cfb398e84748454b0728e055b07237d26cbf257

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ae8f2b93c7f3faabda72b9a819a7a56a

SHA1
714551ba8ed5c21105eb94626fb3d334cc4e0c7f

SHA256
373e5cb04b6b6bac767105b33ca650abf361659713b034c6fd79542e4de4654c

SHA512
9019460cd59a72a3a10eeccbfdf401799fecf157f998bd24df823757ae7ec94d0d5ee09d99514af6d03797e0a863a7266c243715b60e7f2e6eb9bca218f13e82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
a5db0f518a47105b1cec6534d5345cbb

SHA1
616796b3cf27d538181e6e40eacaf502d6893c78

SHA256
3d26a755f7391325d5c156e3ebbaa72760361296e4ba4f28d6100cb5e93def05

SHA512
9a85b64789ae6fbbfba0eb788e84d25f95d2b8fd64e5f7594ac097495d55c6b9f8b2450a1b1d19630a8f44a224c7d37997593bff4886355414b091812a776e65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit