hxxps://dfigd[.]signfactorystatementservice[.]click/?vpv=xvxxfYnJhbmRlbi5jb25yYWRAZmlyc3RjaXRpemVucy5jb20=

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2023, 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dfigd.signfactorystatementservice.click/?vpv=xvxxfYnJhbmRlbi5jb25yYWRAZmlyc3RjaXRpemVucy5jb20=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133336678284663839"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2468	chrome.exe
2468	chrome.exe
4192	chrome.exe
4192	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 1964	2468	chrome.exe	66
PID 2468 wrote to memory of 1964	2468	chrome.exe	66
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 4524	2468	chrome.exe	87
PID 2468 wrote to memory of 3752	2468	chrome.exe	88
PID 2468 wrote to memory of 3752	2468	chrome.exe	88
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89
PID 2468 wrote to memory of 3948	2468	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://dfigd.signfactorystatementservice.click/?vpv=xvxxfYnJhbmRlbi5jb25yYWRAZmlyc3RjaXRpemVucy5jb20=
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe22319758,0x7ffe22319768,0x7ffe22319778
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:1
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4508 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4784 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4708 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4796 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4784 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2320 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1616 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5824 --field-trial-handle=1892,i,6677801506164335500,8306083152826391439,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
47c990bd2cd0af85ecbb0eab0e219db5

SHA1
88ffe262da279a621801e2e76f2869a7a839246d

SHA256
34b5c114a88fd4aef8858313ddb45524b4b7261d0dd55a80c426cc430f9652d4

SHA512
898db5c191555591274a22b7e75111a1d9664b4d651075a6dc6a858d0143736d15a816b1ee20e84b877de308158bd36eb9f764f80ae5d00893fd9434d80afdd7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
29a5b2580363d8fcc11cdd65c08f9ffb

SHA1
7db44e0234e4eb8bd0af8e4a37e0dbcd0db235ff

SHA256
ee6de632211457071fe0ba1e16768a11a7ba726137cbb7f77362f47b0e6175b2

SHA512
a7b3c1756469a6cbf71d82e8c990ab6fafef676778b1abc5affbfdb469dde9bd7f5691d50be0d31335aea3f0acac39ce6ba8c376d1dbcaddbf4e45ed491b0e74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
d6ddea023c03baa21ad3c332f89f4782

SHA1
6600286f66af275d2e2b47c1c92d0c1e7f3cbe20

SHA256
2236c5724bd67b2d306d791ff2bda23420c883e3c127da5918960052b125ad74

SHA512
2b0caf9325af94d7c6db90d2fd0ecc335fba49c5e3675d5692ba701cd466274605d6a6873291c4ef09366b3710dc5ff7507bbd29fe1bbd6338fc9996d8cb412b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
7d900171f202d1fbf2e7c83d96aa05eb

SHA1
280d7660b10676d394aa52f7ac34fac1521ff1d9

SHA256
1363a0e0dbdd2445d3503f5a1f30a8f6409e96c9701a6e7abacd1ec7b41ecfe9

SHA512
19aeec9b1094b591eafae1030547b72d6a1f7ec9a273ca058c1ccb38ea271f2f362e9e8053ced043bf1b4c00e1363683472cfc8d3df04fa884dcad991d93acf5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0260a3f1d6221eba0c989958733dcf88

SHA1
b5f416233162cec3b91cb879cc07d2e8fce9a4c2

SHA256
2db73654003cb81cfc365b80dcc10e6044d50956d6ba947ce470a2b5a7619476

SHA512
e53a9035a56b2d6b1d997c2e9892f2f36d50206ae6ce8efa1504f5b6f1e8a9b76fcc1160982fd316dd04bbf3f6e33422012bd5e1ae91eb92ad2b2cb0e40c77f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
40ba1e90ab3505427dd0c5a34f31fe05

SHA1
28658c655ce2ad935b0770fa7f03ec24d67a9378

SHA256
42f04500c50e757eefaaa93543d708d702463ca47b54b9bfe506ef87357dff74

SHA512
80182e4e0f464c3a753b43ae3bfcd6773334f4d202ed64f7b39a799f47c8f1e64b2e22a208033f8fa851e27ece3f55eef92288318e5ed66bd1017a17eb38a2c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c72ea93739bc6241214b30b908341c08

SHA1
d6709e2aa4b60a7576457ffc6cda8d4f42261184

SHA256
c89d0d68a01aff40690b51308f376a60bca999cef500a745cec887d8c9d440d0

SHA512
20a52e34013d8b6708303f91d036966f02d807f8a3be0b1ed5908f3f46514a5e0be824aaa44040b3cdfd6408cc27c9802b477be36361b75934086ff76a4f4fcc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
f4be5866ca61f4b5626c141618af76a1

SHA1
9bbe8a432d647292e4af0e4615d382dc14f6966d

SHA256
52b7682c401ad1d3c75d2777dd94ac7b9d973a93fa7ddca57b4b065c8a2f941c

SHA512
234c42a4cd939dbe7d11087e3f23cdac7c3d2dcce30df13910e5a5838c6c63e5808260d8ee04c54578ef1e39b8abc7269683c899f6c20cc063b9a2f8b47c8352

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a78e17c242a6ed7cd6905bf390c738a1

SHA1
4393d98f5e3fefc1f5496b7ca2d98715d90fc242

SHA256
aeac50c28893d3f9408bf9bb88992d48f3b25c9caccf005fdfdeae1b56c1706c

SHA512
e04fde5bea2ba380e5e03336dc218ef5ff2505013e66c9f1f9eedc39d55716960f6283709f3aa56911262b8f997ff90028b55b1712686c627fab69710e0ab010

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5eaf2710d3988b70d6220a748269a559

SHA1
b9fa1b443fabb4b270577ca294abb7d410bc8662

SHA256
ba37a57c2752d8f78fc8ebfcb0122efa92ed5b23443a529b1f7af9193198e9fc

SHA512
c10c43f568e6ade73c73790939241d397395c91a17e6890ab874a4fba8382067bfe81d55798a897842282742bd44a30fcc024db30fe2e70b279df01a4dda045c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
f5e8c530bff447c051cd4f68035740d4

SHA1
ade9da3758ca2c77327aee9252ba15823d929501

SHA256
15e41c32e3aae19d9cb6429c6030b418cb6074668f73c1945c46fad55473c3ba

SHA512
bc3b74a0f3040d79fb3dd20c1efa48eba05f24ad46b5ea1b569cb83a61465faa624b2e9a5e3103b8559db3bb9a5252de04f675b07ac866741e47955e08aa0aa7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
46e6fc7f1766c5e489df7f9e7b04df08

SHA1
441e5dd47992a7cd7ff987509480d5d7251f686c

SHA256
32ad6879920fbf32152440618018f3248716de43e6e3355eb903895029921b97

SHA512
2f2afa3d8d44c171d9fcad035cd8cada9bac4883455e8baa4a59d3c6983f2fa805679aeac9c388fc22f698f0a5a277e0c0012d99d70a61c5429f57c730aacddd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe595edf.TMP

Filesize
103KB

MD5
adde6ddcb7ef09d7de23dfc11b7189a0

SHA1
34aa1d3d708f5d31bec81b9c5a45cc743fabbe8d

SHA256
b59153b4456ec6e4e04953205e7e393c272d47efe5d195853df3745ece81bebe

SHA512
f67eead05be2da220c68225639fd0e1ea5bef6621368a1ef03ebd7a227f219f2c08be1620de800e9b3d8427dcb913fe9769b39cac02b274698a5ac1abeefe523

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit