hxxps://store[.]steampowered[.]com/app/3564740/Where_Winds_Meet/?gsc=1&gad_source=1&gad_campaignid=23286412995&gbraid=0AAAABBkoNjnL-7vbMtDI7jhz3lgcOboIO&gclid=CjwKCAjwzLHPBhBTEiwABaLsSt-tTuI16JmxDAkYpUJU2_WYbc4Mach2XPI2-tjKZa8u5MpmkzvlvRoCcGMQAvD_BwE

Analysis

user interaction
yes
max time kernel
1799s
max time network
1769s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
26/04/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://store.steampowered.com/app/3564740/Where_Winds_Meet/?gsc=1&gad_source=1&gad_campaignid=23286412995&gbraid=0AAAABBkoNjnL-7vbMtDI7jhz3lgcOboIO&gclid=CjwKCAjwzLHPBhBTEiwABaLsSt-tTuI16JmxDAkYpUJU2_WYbc4Mach2XPI2-tjKZa8u5MpmkzvlvRoCcGMQAvD_BwE
Sample260426-e91zhadw5z

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5112	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134216519746673717"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
3516	chrome.exe
3516	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe
Token: SeShutdownPrivilege	1172	chrome.exe
Token: SeCreatePagefilePrivilege	1172	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe
1172	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 4332	1172	chrome.exe	83
PID 1172 wrote to memory of 5112	1172	chrome.exe	84
PID 1172 wrote to memory of 1944	1172	chrome.exe	85
PID 1172 wrote to memory of 1944	1172	chrome.exe	85
PID 1172 wrote to memory of 4856	1172	chrome.exe	86
PID 1172 wrote to memory of 4856	1172	chrome.exe	86
PID 1172 wrote to memory of 5600	1172	chrome.exe	87
PID 1172 wrote to memory of 3648	1172	chrome.exe	88
PID 1172 wrote to memory of 5600	1172	chrome.exe	87
PID 1172 wrote to memory of 3648	1172	chrome.exe	88
PID 1172 wrote to memory of 3932	1172	chrome.exe	89
PID 1172 wrote to memory of 3932	1172	chrome.exe	89
PID 1172 wrote to memory of 116	1172	chrome.exe	92
PID 1172 wrote to memory of 116	1172	chrome.exe	92
PID 1172 wrote to memory of 1976	1172	chrome.exe	97
PID 1172 wrote to memory of 3476	1172	chrome.exe	103
PID 1172 wrote to memory of 3420	1172	chrome.exe	104
PID 1172 wrote to memory of 3612	1172	chrome.exe	105
PID 1172 wrote to memory of 3516	1172	chrome.exe	112
PID 1172 wrote to memory of 2884	1172	chrome.exe	113
PID 1172 wrote to memory of 2884	1172	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://store.steampowered.com/app/3564740/Where_Winds_Meet/?gsc=1&gad_source=1&gad_campaignid=23286412995&gbraid=0AAAABBkoNjnL-7vbMtDI7jhz3lgcOboIO&gclid=CjwKCAjwzLHPBhBTEiwABaLsSt-tTuI16JmxDAkYpUJU2_WYbc4Mach2XPI2-tjKZa8u5MpmkzvlvRoCcGMQAvD_BwE
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffe8c83c728,0x7ffe8c83c734,0x7ffe8c83c740
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,10491940482475832171,15913486447620260490,524288 --field-trial-handle=2028,i,9544443899434919661,18153739536082651592,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,5033993432527840062,16032925809351181323,262144 --field-trial-handle=2028,i,9544443899434919661,18153739536082651592,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,16498605396446846240,13753744237957277483,524288 --field-trial-handle=2028,i,9544443899434919661,18153739536082651592,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,1692578876822489561,11693433751041036961,2097152 --field-trial-handle=2028,i,9544443899434919661,18153739536082651592,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,5700957806082483351,8313015483147653144,2097152 --field-trial-handle=2028,i,9544443899434919661,18153739536082651592,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,8316079628880367085,13209178130459073049,2097152 --field-trial-handle=2028,i,9544443899434919661,18153739536082651592,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4736,i,2258117208831629818,4622519810224331345,524288 --field-trial-handle=2028,i,9544443899434919661,18153739536082651592,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,2753988677741493445,14823061481416409191,524288 --field-trial-handle=2028,i,9544443899434919661,18153739536082651592,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5092,i,13574795273536835937,7829982330434528955,524288 --field-trial-handle=2028,i,9544443899434919661,18153739536082651592,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5072,i,10651537358288933293,1898291252753252959,524288 --field-trial-handle=2028,i,9544443899434919661,18153739536082651592,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5128,i,14444695292541518331,16315619316205193664,524288 --field-trial-handle=2028,i,9544443899434919661,18153739536082651592,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1184,i,4531591399400133116,16104163763110985976,262144 --field-trial-handle=2028,i,9544443899434919661,18153739536082651592,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4320,i,6932565919596523815,8393270661815753488,524288 --field-trial-handle=2028,i,9544443899434919661,18153739536082651592,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:2884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5a76e2bb-2250-4f53-bf41-d68392dc62db.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5a76e2bb-2250-4f53-bf41-d68392dc62db.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fde734ca63fd3d80eb67a0965cff660c98378b84236eff93fd5b4ea0269e9957
MD5 6faa561f1fdb26d1506f946fe806c041
SHA1 0e88ec8d6b10b28fde2d0d7d59c3d7e8fec547ad
SHA512 886d321d396e4512bb023b112e6c8edecc4b20a378863ffa8626749d74ecc65dc3e1e1b52f54fba539c0f85cafad8c18068ef5caec93b0589ed4fb38a781e94a
TLSH
T1BAE0E5AAD8319C2708FD4A6864550782EA5523572B51884B3A3D92094FF86764782C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005c
Size 1.5MB
SHA256 4d1f5f98d7e42ba4338d0388fb386344d5c374a47d45fde1ef5b3606080f5e8f
MD5 220d457252003a47bd6c120b059c2a92
SHA1 35f68a1017339b27c98a64d87540d7adcd241ad1
SHA512 7768d3c36cc77be7088a1ff5529e6cde2ccc1b0715c8f3dfbf7447685414e7982aa0202e85fb913eaae8be4ec70d3a8c5d09953e7f3ce524b97ba8d266f91d5c
SSDEEP 24576:4xCrAtw559JOAsXFnckkJP5AE1AjrKVv9Ls6WcXnFTyvcL8VV73Y5d5gVE:xAtwdJO5VnEJKE7v9LdW6nFe88fsSW
TLSH
T1A275335D110D9F8DEF238CB39E824B3DC63D827D69D193BF849261A4BDE6B9C25C2148
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2ab649676293ae7b3bf84722b82a68bca2b231ef78a6d9b33e5b8bdd8ecf8563
MD5 f6b4b0848b253da563ff4b32b90c7599
SHA1 7139e4e0b41c9f00a35cab7a65353dc1c2d9d4f0
SHA512 2b0f5271498dc558ee7e84887484ff36b46a15ec4344f4ff38dd65f40d1feca0fbb33768e44f61056b19fa61594416f108eec32597648441c0eba075d038f070
TLSH
T102319AB750C6F1C3CFEB44B8A8A54E796DAD41DB4A61231347D8E24F8907FD44094B67
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 01f823192a7194f7ff7f629fe88026c7047865507b553e9dd9bdccd7e33c8dac
MD5 574c1db26342508fd3a1141290bb6ce5
SHA1 2cdf56ed1f6046dd2c91b991f4f90bc6d4f975a3
SHA512 3ccd0274fc3ae6d0887cfb2643cb0eb18300cc548276e45081f41fbd7228150764390e491c385dc2170f648736bc0aec3a9aa55c0b5cb4a29d56c4f9d6f36cfb
TLSH
T1706188FB83B4D97E8A0195E4EA156E2FCE6D0524036C3CA688D46E1B53F6871D20079F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1fd2fb5e2861e46bc7b93db644f9cfff5d2bbd67adf7972eedebe3e8dc06ed0c
MD5 959369be666c1a95f0f1233b775cc08f
SHA1 76adfe3023e2c2fc559b2d4bfa885fccc6aeff1d
SHA512 ecdbc3489100ead83cb891f53497eae89db53950d8060dd343555789e7bf8fe9dca644313b23feaef34d8b207d8d6b4033d25bec2cf884fae173b1ef173c8b9f
TLSH
T1B66189FB83B4997E8A0195E4EA156E1FCE6D0924036C38A688D46E1B53E6871D20079F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 59e6c01e9afeba176adc38645699f4598bd39c0de4b61b10fc227d47d691e62b
MD5 9660769e2abf56bfbeefdbf9a91e262e
SHA1 0f1b2abad2c0f2d4ff26556020da2d2702329995
SHA512 d80127da2ded6a21de97e295a9205502a15eada46dea2f7bebf28e2c2bf289277c849134aed02a11c9de07b49d49380c4590f05630d429158baa6b918777a612
TLSH
T1515199FB43B0D97E8A0195E4EA146E1FCE6C0524036C3CA688D46E1B43E7D71D20075F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 859B
SHA256 01bc69e2315eea12f3d5f005e3634af4cc1f0b6ced87b34a04c2f686e6b15847
MD5 910ef5038abe89ee2364902154c063cc
SHA1 49b7f1487a023aff09516a77c1156eee72247e2e
SHA512 de11263c9629b026d43adb1a4fc8d828346d6370d1a0a51fe7b44356fa2a5955e3dfb5fdc3e086e02265f72279a8e05a81b55ebc8658845fa6fd3f37f4b2d788
TLSH
T155118C97E72E7827207D4CAB2E04B4495975A83207C174F0DE9A813CB0C19E70B53056
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7b9144559cfc6ec5635dca2580197ab55ae2974a24382da6262cd974a7bdfede
MD5 ab5360aecc218d3802846b9a77416ad2
SHA1 7a932dad18bf5943514e4d29a7b14c6b9d3e6883
SHA512 d764a5c40b4e74c9709972410bf0f475f2962b331653c5a03abd84a350f659088de7645a04695d847b83f72cb9f589f4c2997918b874a366b595384ae80e29d3
SSDEEP 192:CRfwy2Dvjv7opAPRp2Jm9sHsb+WNn2FXEs42mcmRkVyIsnAUge:CRfwvbsUXN6wEXA2LPe
TLSH
T15442D62EAE14693B5CCBC229FD227B57D7F61025A4A02E84E7FCDA1C15E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 601cf31b222b7d4ab7daf64d007e4830460b036ab4ca9bed637c7e2a1680be2d
MD5 93cad0ea1054fcc3def7942c00489e9d
SHA1 e9f2eb9b584e6ead47332b0176f8f03741404e40
SHA512 bb87ca1825fb38586bd9e0194b5e0484babf48d4ed22f30199975261a21b4d69ceff428c8ee0179659b06dc0cb54736a4351036a8f6546630e764a7df83b315c
SSDEEP 192:CRfwy2Dvrv7opaPRpUJm9sHsb+WNn2FXEMdkk5cmRyVyIsnAUgE:CRfwvTsGXn6wEXxkkyXE
TLSH
T13F52E82EAE14697B5CCBC229FD227B57D7F11025A5A02E84E7FCCA1C11E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3ff4cd3f9c907bea679d6a52359bc35b4fc5d10a8e0613a058f7e98a8357dbdc
MD5 9d91e83f7443ce11efb8d9ec6262b2f7
SHA1 2f7b0136caeb4b2ac08c8b5350e58609316f005e
SHA512 9bc0c3ea2aa2e3fe5590e75f7500aee3c1a6bc273849d355abf733646f096e0b809a3eb59ccfc06fd3b32c2b922b9aa8ed7461c72a42b19d246931ad2f67c09c
SSDEEP 192:CRfwy2DvVv7opaPRpUJm9sHsb+WNn2FXEtqEr5cmRyVyIsnAUgE:CRfwvlsGXn6wEXhEryXE
TLSH
T17C52C82EAE54693B9CCBC229F9117B57E3F12025A4E02E84E7FCDA1C15E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9067e251a802814c9714196819f121519516eaaf5914ba92dc124e6fd5ed7263
MD5 64dc851416c6898d10ccfb3df1264203
SHA1 c3e18ad9727f345700c92972bc5930592ead0d8a
SHA512 2a5faa3b910193639238b4137d3ee10fa025666d4ea485cb908b9d160757097bdb52aa41dd18fb6962e795f0b694f1f918159b74446ea65d789673ac97160620
SSDEEP 192:CRfwy2DvFv7opAPRp2Jm9sHsb+WNn2FXEvP0kWcmRuVyIsnAUgE:CRfwv1sUXN6wEX00kbxE
TLSH
T16D42C82EAE14693B9CCBC229F9227B57D7F12025A4D02E84E7FCCA1C11E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8204f8d948ad8315180b268543703480ee134f22a67947b054e6ec89b8591f3c
MD5 ab36ec981f0dbb280d49bd1816969bbe
SHA1 062724d64aa5dad48c55f0af4929951c1ec50e5c
SHA512 f1750d285ee22061ac8254f16faa1886e28093491534b9e195549a1cf0420dbb554f74ffb2f610ee96522095b158686e01bd548ee1a4dd3d73768b9e1cfdb280
SSDEEP 192:CRfwm2Dvrv7opaPRpUJm9sHsb+WNn2FXE8rm85cmRyVyIsnAUgE:CRfwLTsGXn6wEX3m8yXE
TLSH
T1F752D72EAE14693B9CCBC229FD227B57D7F11025A5A02E84E7FCDA1C15E79CD221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3d93d7e83d2d6212112a97e8d679e4fb22ec907c21584671cc7e50b9310eee23
MD5 25b7ed0ab9c3386b0a97de6e6a43c597
SHA1 ca1a25d795bdffaf98824848e4bfa3025b20c297
SHA512 df5e048a4d29095a6582e1f16e3c9d3c22d791f4a3c3d21efb7bbb347d3b87e1a410762945190f1a68eb34245ed35ab4683b8f810094c40ea974936f4e425351
SSDEEP 384:jBj/a7KxkXqKf/pUZNCgVLH2HfgslYn7pLuLcifVQXOD/e+ErU3FRHGLL+vV5bsc:jB/a7KxkXqKf/pUZNCgVLH2Hfgsin7pi
TLSH
T17E7209676C4C9E7B0F94C6CCD8267E4FADB5024B61EDC86452FA981903D5ACF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e05f8205d12c6a8f548e7342472e934646a3cc3f5123828820ca7551d35b8cab
MD5 5414667789d0b4467658347ca63c90f5
SHA1 eafee773c0042c8ce83ce3d7e68bc122584aa68b
SHA512 1e7902204fef6d5f7f2e625c5d8fc0ebac14be3c83f5f37d411d0e6d3ec4c97f8a9ea31b36854ac9e09cf4b65e16a65cbd190b764efda5e08f2fee62680873ab
TLSH
T128B0129080419981C40302F811834488351C9F19970E130153E06D71A8762924018160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58534b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58534b.TMP
Size 96B
SHA256 6e10bc09c3e9a6c99fea4392b725cdebc826cda5383439c663274961c725be6f
MD5 2d319feb04519b356ea8c981cbab9766
SHA1 718c84963d47b227c80305b6d382c6d4552e3311
SHA512 cf8747f871774f328c98b4ca4fb09096e2a375d77e3ce9da64f57b21a65a9d670eb6f38323ff3e85505e0a068bd47874a30152deba5374b249f9ce33e60ef5ae
TLSH
T185B02200C082A222C00303B22A80C0C830F0CF38CA03030F83F00F22EC223208820820
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 3f1de8b6bb1ec0c3612907d11d84a42c15a0a199d2f026e97247d33527385fc6
MD5 89f908674945d28c6541b633a944a2bf
SHA1 1fe3f6853c0b719a8d80c3da9c5e90974f6a1bf7
SHA512 df3dc4153f2b71d9e32b6838dcd319372a75cd88a013cafb754118703dbff2fcf87b713720569a13b45a93d9189fac0cbad3eb60baed9b1a0a10dca1d49f85c2
SSDEEP 1536:KSW9eUL3dM3oP7D9jfHCfDqONrCjjIpsmodhdeAHmA5EFDptwKpyTtcHkxd19frp:s9NL3dkAdfifD0jj+sxdhdenFnHYZxXv
TLSH
T14F931278626405BB4118C2C6726E7E9BC77C6D9A96702F7839E44D729AD0B4C0FC781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 038ef19f0e4ec83b2263ac0a59c9c0b90c38c5291c1a70810d608f05da54423f
MD5 c48a48514605e16ecdf5bf878b95688e
SHA1 9e5c8cd0077f58fc4ca275776fe2696aa31639bf
SHA512 5cabe6578e9f941bc73d7664e41adbbc24e9e7a2ff88e8b810b40b1b1d7cc1ac4cb60ad6722e6897bd1013aa15d2cb939895e74ed0e616a2961d4fbce81f077f
SSDEEP 1536:VSWZeUL3dM3oP7D9jfHCfDqONrCjjIpsmodhdeAHmA5EFDptwKpyTtcHkxd19frp:HZNL3dkAdfifD0jj+sxdhdenFnHYZxXv
TLSH
T194931278216408BB4618C3CA726F6A5BC77C7D8A86A42F7436E44DB29AD074C1FC741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 1fb8eef10691011471e79a39eff358d76bfd0950dfbf7a8007dddda4df78d308
MD5 1a91983d0236ce5a054d3b6ebae0ad90
SHA1 04628f28a7c3ecac10ece3adbb22b9908db75f6b
SHA512 80a364a616c35e5d974e22534e656d078c6f8eb7fc5aa02c8f84324a8ffa97ec7883ef51cc6e23bdd5e8fb50dc79636b5fb46995edaa99aab565e3fc1e0e257e
SSDEEP 1536:WSWZeUL3dM3oP7D9jfHCfDqONrCjjIpsmodhdeAHmA5EFDptwKpyTtcHkxd19frp:IZNL3dkAdfifD0jj+sxdhdenFnHYZxXv
TLSH
T16D931278216408BB4618C3CA726F695BC77C6D8A86A42F7436E44EB29AD0B4C1FC741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 d4791ad36989e7a5d93d4c1db959d1699e56c512672d8d116e3e09ef9b723fe3
MD5 e3305bb9257caa61555206603fba8351
SHA1 8eca921a1e3ccd3b929a945a5b95e53a33add5ee
SHA512 0eb79db6b622ec1e9c79b656df30dd133436e8e632a4e76b85d847438e8c0e59ec47053b5d3c2548f09941632bb9bd567ce0811d1f2d128a5ea44dbfeaaacece
SSDEEP 1536:GSWweUL3dM3oP7D9jfHCfDqONrCjjIpsmodhdeAHmA5EFDptwKpyTtcHkxd19frp:4wNL3dkAdfifD0jj+sxdhdenFnHYZxXv
TLSH
T102931278616808BB8124C2CA726F2D9BC77D6D9B86A42F7835F45D625AE078C0FC741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1cf73d2-9552-4fe7-add6-1d1cd84c7bea.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e1cf73d2-9552-4fe7-add6-1d1cd84c7bea.tmp
Size 91KB
SHA256 c6d004cbf4a3df1d713442567ea95248ba225f655c58ae956c9a61ebb6e15fcf
MD5 01693cbdbf3d5822f939edb0cf21b4f7
SHA1 641c3c4f0d3caab45bd93549865d3e2771f1ce4c
SHA512 94e2f2ae85c085249f46affd00f5a527f40fc97c1e1d37590c8977b71f2b92a14f002870d765842a6bd18134d319b5aad27f5faebec3ba6b43d02182ed3377fe
SSDEEP 1536:WSWweUL3dM3oP7D9jfHCfDqONrCjjIpsmodhdeAHmA5EFDptwKpyTtcHkxd19frp:IwNL3dkAdfifD0jj+sxdhdenFnHYZxXv
TLSH
T11A931278616808BB8124C2C6726F2D9BC77D6D9B86A42F7835F44D625AE078C0FC741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download