0b3f24af50482a8f215da8a832062c28f70cb378b351efb406f6a727799c03c3

Analysis

user interaction
yes
max time kernel
111s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20260130-de
resource tags

arch:x64arch:x86image:win10v2004-20260130-delocale:de-deos:windows10-2004-x64systemwindows
submitted
18/04/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DataFuhh.exe
Size 20.3MB
Sample260418-rx4k3sbx21
SHA256 0b3f24af50482a8f215da8a832062c28f70cb378b351efb406f6a727799c03c3
MD5 4f9340df9cd279a1907b07e037645a5d
SHA1 4d213f3ef930b17ee173644479ebd2fc0855f869
SHA512 1ccc6ac24c14bcc56fbae53e853ff48f8cd9cb4835f5750882c1e4c02d27cf7de7f154f3c412bbcc83827e1f5bf835ec08843c9294cac076241b9a05e8d1f3c2
SSDEEP 196608:DqYD8gWSbP+LLg8sZbjnSo9uu1+LTa93YcW0l2KmNEGt2wbMhOaeP:DzD67LLg8QiKC52dkaeP
TLSH
T11A278C03F86548DBC7A491B5C9EB43867334F80017276BDB1B10B734BDA66D9AE7A390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2828	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209965727255198"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe
Token: SeShutdownPrivilege	5008	chrome.exe
Token: SeCreatePagefilePrivilege	5008	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe
5008	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 6128	5008	chrome.exe	93
PID 5008 wrote to memory of 5532	5008	chrome.exe	94
PID 5008 wrote to memory of 5532	5008	chrome.exe	94
PID 5008 wrote to memory of 2828	5008	chrome.exe	95
PID 5008 wrote to memory of 5276	5008	chrome.exe	96
PID 5008 wrote to memory of 5276	5008	chrome.exe	96
PID 5008 wrote to memory of 2688	5008	chrome.exe	98
PID 5008 wrote to memory of 2688	5008	chrome.exe	98
PID 5008 wrote to memory of 5616	5008	chrome.exe	99
PID 5008 wrote to memory of 5616	5008	chrome.exe	99
PID 5008 wrote to memory of 1360	5008	chrome.exe	100
PID 5008 wrote to memory of 1360	5008	chrome.exe	100
PID 5008 wrote to memory of 5984	5008	chrome.exe	101
PID 5008 wrote to memory of 5984	5008	chrome.exe	101
PID 5008 wrote to memory of 5912	5008	chrome.exe	104
PID 5008 wrote to memory of 228	5008	chrome.exe	106
PID 5008 wrote to memory of 228	5008	chrome.exe	106
PID 5008 wrote to memory of 5752	5008	chrome.exe	108
PID 5008 wrote to memory of 5920	5008	chrome.exe	109
PID 5008 wrote to memory of 5568	5008	chrome.exe	110

C:\Users\Admin\AppData\Local\Temp\DataFuhh.exe
"C:\Users\Admin\AppData\Local\Temp\DataFuhh.exe"
1⤵
PID:4448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff90644c728,0x7ff90644c734,0x7ff90644c740
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,10544965477837719220,2679818801487422644,262144 --field-trial-handle=2072,i,5777409419716143630,7647921162120855155,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,12871789607457114567,12705709306880329398,524288 --field-trial-handle=2072,i,5777409419716143630,7647921162120855155,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,12273816163613176457,11202900229864677308,524288 --field-trial-handle=2072,i,5777409419716143630,7647921162120855155,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,8483200919364777606,5890793895489058764,2097152 --field-trial-handle=2072,i,5777409419716143630,7647921162120855155,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,12323703466118456199,6469711223245752714,2097152 --field-trial-handle=2072,i,5777409419716143630,7647921162120855155,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,4464767713230573919,14992750362056870389,2097152 --field-trial-handle=2072,i,5777409419716143630,7647921162120855155,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4468 /prefetch:2
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,11741796168557215963,9391517710152896565,2097152 --field-trial-handle=2072,i,5777409419716143630,7647921162120855155,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,2041978643892746823,4018477578943011290,524288 --field-trial-handle=2072,i,5777409419716143630,7647921162120855155,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5928,i,3128280548269378776,1941293715067523300,2097152 --field-trial-handle=2072,i,5777409419716143630,7647921162120855155,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,8411785546534244895,17022319660176766855,524288 --field-trial-handle=2072,i,5777409419716143630,7647921162120855155,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3236 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3252,i,10979520976013580507,1618537966778410263,524288 --field-trial-handle=2072,i,5777409419716143630,7647921162120855155,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,13284751173001440529,8074977279914171909,524288 --field-trial-handle=2072,i,5777409419716143630,7647921162120855155,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:5568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ce99b431c3a80e08a863400142475f56139050be87381630c51b2d9463d54e98
MD5 8b7e51b62ee2661529674069f57153c0
SHA1 9dc7befd69257b788bb9d5234a3536e9d0598d91
SHA512 c1b79a869c9d799d2ff7d031587b472e1348a40d2ba96659c494e36449805d5a14be67fba8b5f6f19ad864135481306170d1269f67a69fd4c37791663a51effe
TLSH
T1C9E02BA6C820DC3758FD072950488746E75513573B90998B763D810CCFB1636519ED2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b4f422e6f5740a25a76eb446fae19360d8f59ef950f92fc8baa9b31afaecb078
MD5 abfd0d30d1eaffc93bcc821c61349f8e
SHA1 cfbd47538713517f1ebf9fec6e74cbf03a7c2ccd
SHA512 4c9b626d6b2d4354dc05a111e3edce495b76d730d379186a50fe2ac7daeb8c250dd9bea9f4f7341b8806545d0a767a6f2b707f176bea989fd12300b81040da24
TLSH
T18F519CF793E4857D891196E4DA247E2FDE7D0A24031C3CA589D4AE0B53E2872D20139E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4dc3246e7f835833c17d04669316f8068b5393971aa18d0f5431c33f212ddebd
MD5 bc4fc8ec02c96b7e105faaa6338aeddf
SHA1 f21838943b444442bf5b855d66c415400f3cc87b
SHA512 6cefd93987453f402b835f772ea655251e7ef424ea46e7b1ecd1f044abb5704ee25e4d266a0522d2d4b6166f8a855ccb3fe1b92365696f80698dac6af4da1231
SSDEEP 192:cRYI1CREX9IUv73pAPRp2V9YHsb+WNnYnEY0jo59YuqkwrVVcVyIsnAUgtaJ:cRYI0NQTUX6Cw00CJqLQ8
TLSH
T14352F82DAA04BA3B5CCBD22AFD517B57CBF5202175942E84E7FC9A2C14D75CD621B00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 eed1b450b5454ddefa006bb03b9a57506d59ea4f70b0b04b32e7a3c58ce3236c
MD5 6d7c2bb47226e7e5ca6439b3a90ee1dd
SHA1 e6e6818661a88c75bc7b2d121c5dea540252e6db
SHA512 e683fdc91432b2935b4864f97c0e78ef51f89798485449cf7a60c968d311be0c68ba4d6ca3638c7129002bb183e62970eb336fdda6c77a0012e54575e7ed962c
SSDEEP 384:rVjn27KxkXqKf/pUZNCgVLH2HfgsljM7pLkdLcifx8XODnS+ErU3iPHwktivX8V:rFn27KxkXqKf/pUZNCgVLH2HfgslM7pv
TLSH
T13B7209676C4C9E770FD4C6CCDC267A4FDCB5024AA5E9886883FA982903D5ACF114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 680ba4c3fa195cfcd327eac3d0ed15a9efe1507f8cd7bc593a124a235b562865
MD5 9c062508e51128b1ae1302d102c8d0a0
SHA1 6193630e685904816e87845110c57784951b18f5
SHA512 37a5ee5ab81ca61bad956e4eb55ec54250c920b4e9f7b4b39169cb19a45b1bb95b0a6eeab64a70cc7e1116dc6dd60eb3ef92488a1d8a06b9a7558325930452b3
TLSH
T16EB0125480419543C48B03F4218214C871159F118B05130553F06DB9A8375B04014150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5927d1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5927d1.TMP
Size 96B
SHA256 b6654101cca5386adde77abf1b84a4a3aa9c06e0db3fae89f40d40f532ab05f2
MD5 e0800bfe9d2fa6ff9be9908fad7936bc
SHA1 3464246579e0b69c945647660f02721cd369c88c
SHA512 67ba6f6bde4288512525a5f71da26e8076db2c236aa09bd720e234e246dcfbe18bcb71aeb4bb4b37235eb11cbf73890ba18c5b5c7a059df6e8b82ebdcd00f68a
TLSH
T1EEB0228AC0022B03C00203F03880AACCB0A0CF2AC2030202A2E00E22CC22AE08220220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 e5b07c518ccdf6311f7f9225115f988f3ab716e9c646d823fd8412a04f7b4771
MD5 7b9840005da194fccab782fcb008eb46
SHA1 d9012d2966aa26553166fa7262b5a55ec8058c52
SHA512 83996f4129b255b7e268817d0517f2c547ff5e791d42fdccc0d81583da7f006489bf022575d0fc52a830053a4c2afc29376fde5f34268adc484863f583283593
SSDEEP 6144:Ul5io1AxQlDYjyDlP2VrOk0HOGm/SFyEEu:yimBQyDhirOjuGdF2u
TLSH
T1231413F95E2C76DB54B4C885B25A3806CC23D747719F598E71ACEBCA13DE2C84B42E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 1f248a0487c825c87e190f280cb97991d71e719528185b9d39aec7febf33be7c
MD5 b0812b570112cd4f8f3a1feeaa41f557
SHA1 08d392e2e04df39844007e4a2fb039bcaa980027
SHA512 cefc685ab2f24f5c2eac55652d43c539885d940b2296469e786817b6f05b667a67c3dd8e46fcab38fe72b9a58a729bb081f776828134a7a1e7690485a515f3e7
SSDEEP 1536:536cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEj:c3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T1539312B94E1B46F7957D468276AE7808CE22234D709FA9CC316CA39C61D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 631b092875728f8eaa9ad733c67b56b932e0f4456127d4febfd8c1cc87516091
MD5 a19911a61b16b355ed9723ea1774ab09
SHA1 6cda872329e119b521e09b3bb44ffde03d4d4f58
SHA512 7b5c2bc743d07c23a7e7ec89a29c287d50ce735ca2b32795dfda1964ca6f0fa060479f6e67473e39ae2c3e5f4b34eb22fb1ba6ed3fa3b9b49593c9f11462ee0a
SSDEEP 6144:rM5io1AxQlDYjyDlP2VrOk0HOGm/SFyEEu:ryimBQyDhirOjuGdF2u
TLSH
T1281413B95E2C77DB60B8C581F25A6906CC13874771AF5A8F71A8EBCB13D92C80751E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 f322b5abb8748f3230152d633aa74466d4d19dace1de8d44f0874c639c03addb
MD5 3d27da6ce517b84fbc338d432cc42a24
SHA1 9dd42754543d1417e761640de67c7c7d2be022de
SHA512 837a4409bee49507def34c3b2d387c9c1228dbf17b953dd060065a8c32d1aa92fe386352971b1583f4f7664d325223fd9ad1d9b5b1a24e4131064e65427cffd5
SSDEEP 6144:kM5io1AxQlDYjyDlP2VrOk0HOGm/SFyEEu:kyimBQyDhirOjuGdF2u
TLSH
T1431413B95E2C77DB60B8C581F25A6906CC13874771AF5A8F71B8EBCB13D92C80751E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2620-30-0x00000222BC290000-0x00000222BC2E5000-memory.dmp

Download

memory/4256-115-0x0000019783950000-0x00000197839A5000-memory.dmp

Download

memory/4448-16-0x00007FF6E5970000-0x00007FF6E8D56000-memory.dmp

Download