hxxps://www[.]nexus-creative-solutions[.]com/login/?xcstoken=RDJHWFlpVkR5UTFhQWZ3ZVI4T0M3dHVtK29VejVoRjlpSVF3ZFRIdEJlUkRiTlVvRXErUU1aZjhYUE1naDFjeQ==&email=cesar[.]velandia@groupm[.]com

Analysis

max time kernel
600s
max time network
603s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.nexus-creative-solutions.com/login/?xcstoken=RDJHWFlpVkR5UTFhQWZ3ZVI4T0M3dHVtK29VejVoRjlpSVF3ZFRIdEJlUkRiTlVvRXErUU1aZjhYUE1naDFjeQ==&[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133568270564059468"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
2988	chrome.exe
2988	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4036	chrome.exe
4036	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 4696	4036	chrome.exe	94
PID 4036 wrote to memory of 4696	4036	chrome.exe	94
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2888	4036	chrome.exe	96
PID 4036 wrote to memory of 2952	4036	chrome.exe	97
PID 4036 wrote to memory of 2952	4036	chrome.exe	97
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98
PID 4036 wrote to memory of 2192	4036	chrome.exe	98

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.nexus-creative-solutions.com/login/?xcstoken=RDJHWFlpVkR5UTFhQWZ3ZVI4T0M3dHVtK29VejVoRjlpSVF3ZFRIdEJlUkRiTlVvRXErUU1aZjhYUE1naDFjeQ==&[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb05a49758,0x7ffb05a49768,0x7ffb05a49778
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1968,i,11049199940529162438,8330814270483680140,131072 /prefetch:2
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1968,i,11049199940529162438,8330814270483680140,131072 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1968,i,11049199940529162438,8330814270483680140,131072 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1968,i,11049199940529162438,8330814270483680140,131072 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1968,i,11049199940529162438,8330814270483680140,131072 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1968,i,11049199940529162438,8330814270483680140,131072 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 --field-trial-handle=1968,i,11049199940529162438,8330814270483680140,131072 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1968,i,11049199940529162438,8330814270483680140,131072 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1968,i,11049199940529162438,8330814270483680140,131072 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3600 --field-trial-handle=1968,i,11049199940529162438,8330814270483680140,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5180 --field-trial-handle=2260,i,3739451884007376837,4900555371550671478,262144 --variations-seed-version /prefetch:8
1⤵
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2196 --field-trial-handle=2260,i,3739451884007376837,4900555371550671478,262144 --variations-seed-version /prefetch:8
1⤵
PID:6108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
911abf90ef8fc67e4a72fb7bcf47944b

SHA1
0b44eb777e3caac7f923133339a5bea5138b42d7

SHA256
76a8759df9b7504b6f8472e95fad113053e81f4d76daa683478e2e7037e9205c

SHA512
da9f76f9be4c1f58e95495f2f7723ef3e19aac462a0cff26e48408d779fb882ffd135750ba423542ae678dad9893eb634b7c50a3633907159aa24aac5d07a994

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
0ef6af0af0891741c3eee37350c3c4cb

SHA1
aa2d8fe06e31f9234095a0d10b61b962fa620f5f

SHA256
8b91cc18cc8febf437d6ccc595f0f4def2e8330043b1149d150bc74a6def4226

SHA512
35694e2ac215ab5f03c79475301172481adfc2544e80a57f10f2e612da3913d57bfc9786fa9d230b3d750a102e8a773e4cbb67aaaaa76d6d4929d4c367905197

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
b2d90c58ee6510523f6ed6e3cbad96a6

SHA1
57d75ad598987d2cd2c7f15c133a4daf6b5a6ccb

SHA256
19676378e7417dab25ff96107fca768f1c605bd3f4f576213bef985ef54db0d2

SHA512
0d4753882edcaebbdcc58de6cbf84dab0cb81c9e91ee54f4a8278f053203e2e399974d8ecf91817df558b7f95d2b42dad3f8dc79814f08d0982639f996342349

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
a237b695441c6d2659e145abf8be72c6

SHA1
e69713d4b4512e3e58306f30d1fe8da4b7c7b29f

SHA256
da03d08c9631d3e76418fd27e6cc7d9346a84f7162dda04cf334ca7855087ab1

SHA512
8562d98a547b5bd1d3c2dda8e305a775b12626346cfaf633c52b6e716c2f15472ac9d2be5bd82c422782322582ff683a663f178b8041bc62314b42df9cb21d86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
92e58ac06f94bbac26c6b34fd123df3b

SHA1
ccd29c17af31e617d5c653524cb7981daabc5dd9

SHA256
6e7af979ac3329b17b07bb0a09f9a831cf55ad076332c259b4fdec2328131ac9

SHA512
5edd2edb0ac660b4522387cd2d7e2941e8ddf931f012811e355fb199ad0d33e27536718da85b0e0fd09bba7604263f11cdf91d3112a73421a8002ef10060ff97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4bcb6cb82e38ac9d13a9d343bc47dccd

SHA1
10e491360da1a53a2a685f059b1298567f0f315a

SHA256
713bd172153e81e4c76a170b0de76be1dc0caa1bcb2021b7498e83330357c07f

SHA512
832eb19d2ea97566b72f41c3407c99806602418b3cf11e6741856bb706ae831569f022cd0427a966cbc6f9bee3e460076dc6c77e196b9c8c9992dc018dd39797

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
e85e8e0a0a6c43a752678aa65be53160

SHA1
58b1891e91c1205e9f0144d56a79cb2f9b2ccae1

SHA256
c1a8ed1caa737061364475172f7058dee22a827efbd6881ec26f72e43b9a43b1

SHA512
f6a6cf21c218d68f07b7d421c1ac97263abcf2f40e5480b9eab57ad526e2fdcffd41ae27500423579b887ef142efdeb2d468f1707ca9eb88083aad1cdca9b062

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
843de107f1313b2c5fae5b9d6e01ff2c

SHA1
5c101d13e4c441a8e2c36e9c883c451debc16025

SHA256
34147c6492e303ca5bf81b51ddc0b13a3bcd62d5fe15831003f1f9b99047ef62

SHA512
1bd8f1abe27355c79ce6ac800ce2e2b49799b00c0fd81625b51c2fc4d5f6c0a5764d65499eb32882b59040e753b5dd49f2e62d0a67862cd40b6f46690e048d3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
85b6ae5470eada41d4bcf140bccf2bfc

SHA1
f7e8b07e19fcaacc8c20271188db230d908227e8

SHA256
9f8cac3366445b4fd2323e6eebe9dc1eb466c8a8a9a64762e2e49e5d00fed6d7

SHA512
bf8a2d0e99c6f1668c588980cfeb9cad525bab19a468773315c4aa0989def1a4d5a88591f31f93ca35c5c0965cb3195b405324af85db7343bdf17cb4dc919580

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit