hxxp://freemovies2021[.]com

Resubmissions

25/05/2023, 15:37

230525-s2nwvsbf4x 1

24/05/2023, 19:54

230524-ymzbyafa8z 1

Analysis

max time kernel
1800s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2023, 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://freemovies2021.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133294389149068309"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4084	chrome.exe
4084	chrome.exe
3876	chrome.exe
3876	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe
Token: SeShutdownPrivilege	4084	chrome.exe
Token: SeCreatePagefilePrivilege	4084	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe
4084	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 1332	4084	chrome.exe	86
PID 4084 wrote to memory of 1332	4084	chrome.exe	86
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 4440	4084	chrome.exe	87
PID 4084 wrote to memory of 3864	4084	chrome.exe	88
PID 4084 wrote to memory of 3864	4084	chrome.exe	88
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89
PID 4084 wrote to memory of 4616	4084	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://freemovies2021.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe6709758,0x7fffe6709768,0x7fffe6709778
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:2
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3132 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:1
  2⤵
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4496 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3308 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5552 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2724 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5224 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5472 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5644 --field-trial-handle=1812,i,13749797009275515422,3464279374171353363,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3876

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4636

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x4e8
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
44KB

MD5
c40791b72f4ad0ebf989950b66054b9c

SHA1
3b54bc6ca46c2f771ab640469e3f240ed89f45aa

SHA256
2359eb5355b43d46555f670de2b77bcfe49eac29da0cbad9758764ba5baafaa0

SHA512
71aa60fb66a75394910b2524e5d84cf0302e0de14a3cec184ddd8ba1e770ca4d7b5dddeea9d01025959842d18351adb0227ba682d9dc1d08c8e687bec78a259c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
24KB

MD5
a42c6333a13e5376af95f46fd9c7b627

SHA1
57a98e519a44915e39a0cb6f23812adfa6611e67

SHA256
62bff9dd0379da44f9d7f739af671bb6b243c016b49c7146b431ae9e6b9cb41b

SHA512
68e511708465c75662845c55169de20572adfb359e1f4fd037c169bda44d853fdc622794912406b1908b585c3965d4a8612c007af9ca2601dacd4a14283fc894

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020

Filesize
162KB

MD5
08f3851748975142ef7c08a8ea1ce61d

SHA1
31ffb52b4d2e4263a2b5a19195ee1784bc884a15

SHA256
e374d418c7975a482356a79e25f0722ab71616be443cb19d96ef88706937bf30

SHA512
d4b86e69582cf1bc33991cd44eb1db26eff3013dcc7ed34d8b7d890be510ef3949a50332e732c22182a8fcbba418c6ba18aa031a6f0b5b621ea2211e665af3f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
a081b7736e226576c57a8432ef979a05

SHA1
743d2a9d74093113cfc7608b9a8fd9085a4d250e

SHA256
a9e49c972513be98b3e060d037833f16093856082def3195b9aa8d557db36eb3

SHA512
a1cf45c7d1c868f59f566c878fb93582718b82b31db938635574f0549566c1f5eaa40b041bd2dd30d3b15ec4c87218e270047dc71f5742e8065398c7e8616d6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
7392fab40c3f9fab38ae42f21d839609

SHA1
716365279cd4ed496a20e4506103bac4372bb563

SHA256
023fac27336513fb76afd8e862753dbfea11004dbbe4c3c7ce36c711ffb13611

SHA512
efd22415734bff5414c361b0ae283a7adb9bec9293b916f887373e06bc419c2d8b70937a3d3e364e6361e695c95c98411b618a9101772d12c6dd6fbd991d4af3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
9672ad8fc565724316c41717de049796

SHA1
69f68e325d51ab8f6a4466e8bcf701d7fb375004

SHA256
fb47f6d3033e004e628a022cdc933b0c2c26c4f2ffecca91f508a3cc08bcb4ef

SHA512
44ee40a7a5e858e346bbeed18749164e70ddc5a46a6dd2db02b248a3a8c995245994c7f8f641b3b3c5b746648766a75467c965644eda76b76dacb0c52ae4466f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
cc15d31043c64b9b13b2a43ff3bc1fa2

SHA1
f4fed0215ee66cd0fc7a45fe864ac423517b1635

SHA256
76685c1cb4dca6146ed3901bbb04208911eb6ddc89e63e1bc0425bb775234738

SHA512
23df6bd1dc950108b9d4207296e7c2ca01bbe88796c42d6bdaf5936221607e5fe090d5ba4cf2c1d2c34a10f7fccce8c3062aefafdfe294ff1818c5399fe6959b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
47e305ffcc1243e3c927512253d87a31

SHA1
acf339e24564b73dd08154f6840e858d47a072a4

SHA256
1455e0126736bb6baf575429eb3c1472bdd91f289c2e2d0523a20a3cebb404cd

SHA512
5768e6ecb02de21297c1550e96727f1679006fb91925f6365a48130c43b2660f28a404a92f0fb03a8ed4a44fac870634eaa82234420bf09a3f557db63dde23d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
683ed53a0cb04a9d0799d4473de65e58

SHA1
0cd18c6a5eb4419073688b930d890fea6f43f27c

SHA256
9adf601673943b4aa30e979ad854568267d7b3ad10deef085cfdc3c807cd4153

SHA512
2c40efada5674dac6449869631f1a056550bdb94ea46002b1549dce72b466fb3d8f1b1c2ddd5a50abfd236c68707699ba19a1d204bc22294757ceec3ad766fb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
64e9e4518673a7c535b4760ded6ca2a9

SHA1
71bfe62d10469b5d5e197d2172eebea79983e424

SHA256
150887a939f38e41717353ff164dacaafe881936b8fe95bc1a552952faea988f

SHA512
e3a28949eddab51d7517ab0162afb4f19de2f5e324c749b9f02831926a701010ab7f51c62cd6b22ed448379c132cce05a9b3271338ae14fd21f4a57326bd77a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
9e818ed551f295567f8635c6332a3dc2

SHA1
8cc975efbe8053595c30b78f59d5f0f31dec1255

SHA256
9eca40d28f330d3e26189a93db262c29fee1bae6b7ef204a6cebe28790e03502

SHA512
21a1df27515b5cfed55e8deefe356282670d5d6f5b9c7b50569b4851852f263b6aecc8ce1c1b0295f0663953ddae983ad5dcdee1b0620e46c28202a307094bb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
bbbb8bd06aa2022b6f61fc0150b238d4

SHA1
20852d263de9acee55b4538aa2b2b7114cdabf2f

SHA256
25c6b34c30d574e9da415b86d0ca4558a69a2c57e2b97d13f10b23e2826f50dd

SHA512
feebfe723f116a77d404eb86da79114c600b7f63c236eca84f5b5fab37aba97e3e50aaf9b86e07b7d8033aebb3255a8308529c5613351eeffcbda50dba5421d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
280f90684e347cb3057276f85122a2ad

SHA1
00c377683601c57e4d958089ddc528fd0fb8aba1

SHA256
7965b42bfcfd6f85a33959f24476f7f873c4408119b4a25c5eba276e7a05c328

SHA512
4ee15f93b1eeb22a6048d8a9b80d8eeecea261bed2c59d532f85480bcc997edc8f2075d0da4d5422531f9615d6ac6c15f1bb2d6036d869ccc84d31fc522d969c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f2c46a80390a9cfec94ac0578eb9c529

SHA1
4773ab9da3d3a10ef3cd323bc2c8aa7980983ae3

SHA256
9c3e0a3b8faba2f5be22016be3fee41bc370cbd198a3706516fa7acb6dd0c8cc

SHA512
642ef95d0de0be39e96dddd38fd1838d7fa31d9bb06a6a9dbf15343b6b1e8c4fd86e6dccb0c6e7e34c22e8e4c6eba63a174626e785268694989172db3f701692

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1d276bb7bb315a8a3243c2eeacddb909

SHA1
8a193c1d9320c4c7bf923c557960097caa8ffdae

SHA256
7ea77b20148487151a2ccbcb4bbf0894493a914e8bef60b2825618fe20603fc5

SHA512
ef3cd3d23b0c9857faa764294a5650a2ab4d7fd55f3378a48fcfae06273678f27bff241a7bf33c04a42d2420e3594c747eac9296c4c6f84aca08339f74964c89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
54c26f76abb8cd4a103cbfea43413403

SHA1
8e99bf6b1a94385e621751b1e29cf1d3f184e4c0

SHA256
16b4e62446fe50d18a90a652903cd31a56570b88d24c26b5af9ca6bbe72bd65a

SHA512
96e62a400b95a39c65cf6a8988a385f4cb66ab66dbaca1df66ea77c221d10028fcc7364468b61bf991a6b15f9fca2bfea357a17b0b2341055f3da1ff8eea5ee4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
11b393a5d94a7c108ea1351e93b8d9ea

SHA1
526b554e82b278400d69d814120e5507cae1184d

SHA256
b580a04d34e6bd480504ddf1ae0757546490632c4f502db00a986df13b4c2739

SHA512
14f4a0ac7ab5b9056c2ba19d4d43f8e3ea41ac2c3178f4c9607d018e204f3829fc699d10cef1263648402dab93c1ee793e3c2a1eeda41b333372d60d04f78283

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
102KB

MD5
916f8cd7ff8428902974e36ad3c11086

SHA1
7c16d681358cd5d5d974b5c023c86839b0db3bb6

SHA256
e8344fe652da9299cb8d1641f8e0e1e65217251c44279cad77dd11da37068037

SHA512
226074c4f8227c02ab7e0499f6141719a9a5543d6b351d87c224ded100a47b68b03944ecd7baf88bbcc27fbf3c4642e3f6e4380bb5e75d584eb9dec79a9083d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
975f8fdefe1098df5cbb5fe1c82d3249

SHA1
5e534211cafd9e9dd9abde2d3dc72fff58ec33e3

SHA256
ee80237ea2bd1bcc52a8b386271352d4678a24df1c3f0937b03d87929b53dea6

SHA512
996be35b6fa9895b2250a18c784d6b1ad055bebc5801e2aadf3ae1b533a78f1d2a175f1cf676555fcd98fd18c921e3c56040a3c1c3589b4c9754b37385a462fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe571b39.TMP

Filesize
100KB

MD5
29ca9c6853e4d9854c196d2bc1510dc2

SHA1
7993cad36bb912b4117574c92a0dfbb745ec9596

SHA256
a9969a6330e920233cbe324911762b80bafe2121883abbc5dcc53e0e37565e87

SHA512
0a36329b6861785b102d132cfca9967191e0b106169047c41517032943b238b2709e40b82db49f1c83bc856e4588296d68ac743b63de6f85227643187d86c1db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit