94291d5690a0ced7fe7da7f380fdbdcbe03cdac8ad4227a037866ba7455eff8b

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260126-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
27/04/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
krypton-0.2.10.jar
Size 263KB
Sample260427-ttcdjaas4p
SHA256 94291d5690a0ced7fe7da7f380fdbdcbe03cdac8ad4227a037866ba7455eff8b
MD5 f804ed489b36dd0b011b92b50e5c2119
SHA1 94ddaeeae6ca7fecc79e54a0aa02a5438a775a99
SHA512 4dcd7228d1890ddfc78c99ff284b45f9cf40aae77ef6359308e26d06fa0d938365255696af4cc12d524c46c4886cdcd19268c165a2bf0a2835202fe857da5cab
SSDEEP 6144:Sj7w1m3bYNkiJow/hdB8VsMfp1pjEcirVUvId7r1HkXRwGe6ZBa37cTs:+73ENJpMXRMRTd7rgRwGe6ZBEcTs
TLSH
T1364412377EABE32EC54B00755B628AE17FB5426C502749AF23540FAE85D029F075FB88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2004	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134217805696362041"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4004	chrome.exe
4004	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: 33	4756	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4756	AUDIODG.EXE
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 5208	4004	chrome.exe	97
PID 4004 wrote to memory of 5312	4004	chrome.exe	98
PID 4004 wrote to memory of 5312	4004	chrome.exe	98
PID 4004 wrote to memory of 2004	4004	chrome.exe	99
PID 4004 wrote to memory of 4076	4004	chrome.exe	100
PID 4004 wrote to memory of 4076	4004	chrome.exe	100
PID 4004 wrote to memory of 216	4004	chrome.exe	102
PID 4004 wrote to memory of 3388	4004	chrome.exe	103
PID 4004 wrote to memory of 216	4004	chrome.exe	102
PID 4004 wrote to memory of 3388	4004	chrome.exe	103
PID 4004 wrote to memory of 5092	4004	chrome.exe	104
PID 4004 wrote to memory of 5092	4004	chrome.exe	104
PID 4004 wrote to memory of 4184	4004	chrome.exe	105
PID 4004 wrote to memory of 4184	4004	chrome.exe	105
PID 4004 wrote to memory of 5464	4004	chrome.exe	106
PID 4004 wrote to memory of 248	4004	chrome.exe	115
PID 4004 wrote to memory of 1872	4004	chrome.exe	116
PID 4004 wrote to memory of 3384	4004	chrome.exe	117

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\krypton-0.2.10.jar
1⤵
PID:4332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffd1e0ec728,0x7ffd1e0ec734,0x7ffd1e0ec740
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,892296267426958165,9725855919910503085,262144 --field-trial-handle=2156,i,18182522468274319916,12236583670272444645,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,12140736786315917112,371214488603281691,524288 --field-trial-handle=2156,i,18182522468274319916,12236583670272444645,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,10735116740240656426,4371887560679289633,524288 --field-trial-handle=2156,i,18182522468274319916,12236583670272444645,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,11432261970030895577,4335609206010444933,2097152 --field-trial-handle=2156,i,18182522468274319916,12236583670272444645,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,11030751230047143454,10133444513322360306,2097152 --field-trial-handle=2156,i,18182522468274319916,12236583670272444645,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,6239970764307776804,9421214624570590680,2097152 --field-trial-handle=2156,i,18182522468274319916,12236583670272444645,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=4468 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,10667662526782308496,10604576683068752476,2097152 --field-trial-handle=2156,i,18182522468274319916,12236583670272444645,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,10852653388509038340,6433300207969124949,524288 --field-trial-handle=2156,i,18182522468274319916,12236583670272444645,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,8250493401909727013,14093968058420161949,524288 --field-trial-handle=2156,i,18182522468274319916,12236583670272444645,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,10276911897565886048,300527444357405090,524288 --field-trial-handle=2156,i,18182522468274319916,12236583670272444645,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,11763421863722995446,17402672646936105136,524288 --field-trial-handle=2156,i,18182522468274319916,12236583670272444645,262144 --variations-seed-version=20260126-010020.760000 --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:728

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4072

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:4332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x514
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper
1⤵
PID:744

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c19375dc599e6e6b3804905f005295fa9cac45c92fb0f6c19d13b9f1079374b9
MD5 677996ea8a8480fa83ed7797bd419660
SHA1 100641460910a11a25d7d7ffd05906948485ee8a
SHA512 88c50430372c9047a03de095137f1cd65664b913c02e7acf10c74070d9e6ec674dd58f86380fbc001a1869cb5d91a70f2bcf1a12e78f9b1faaeccbfbffbf5a5d
TLSH
T13CE02BBAC971DC2B55FD0B1950045646EF60031A17814A1F3F3D93088FF057A4A4692C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7362284995d0ffe28a0abb507be72b5e3c197c0694f39060921e54944c742465
MD5 be68c481e82314b7f4d771643342934f
SHA1 a5329305d7b4e0361565b44fc46d2d928bcfeba5
SHA512 64815d311f964cc412d7b7f3c531b577f4d0a8bd0238c24d845fd9aa8ea6b69bb43f419827fbab4c1bee84dc2adcaf84966ccb2da5b0729b1e56b79361445c00
SSDEEP 192:xRycxOQ03Nqv7TpAPRp2A9bHsb+WNnnF0baeQpYJZtVyIsnAUgtaJ:xRyckNm3UXrVwF0s68
TLSH
T1D742A43DAE14653B9CCAD229FD627B13D7F5202621C52E88E7FC892C24D75CD222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0e11e2cbfed0fe61def4d5dcd2ba1920c396e023faf026c274d308e1575e2bf5
MD5 c63c3cb087a2de0452fa72abfd721caf
SHA1 5412f9fd41ce8854e57b9987065f34e5902a6976
SHA512 5cd7a5ff8e370f4760b062c8f0e422e8e6f74096dc12e1addf485359b9a51be6865f4c78a5289f98dff2871c559c20e5726954761e0daedc2458f55d38dcf2be
SSDEEP 384:VHjJc7KxkXqKf/pUZNCgVLH2Hfgslke7pLuLcifD+XODJE+ErU33WHG9EwF/:VDJc7KxkXqKf/pUZNCgVLH2Hfgs6e7pM
TLSH
T18B7209A76C4C9A374F94C68CD816BF4F9DB5024B65ED886883FA981503D5ACB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3c5bc0699011bad846c652581eaeaa0d7174a1c68ee5c95ebd84870f183ca63d
MD5 27553ae9c06027eb1def40b57d087cd3
SHA1 62f6fbc51fafd12f123e11e8f2daf5369cef2cfc
SHA512 e10a9bb40885ee01f070ba4421bbc89798d3b16f971cba6f8a301d43f1d06784245e1244187e2c6add7ef0cdbdc5153ec159899ea9e402329281900ee63d881c
TLSH
T124B0126180019A01C45302B01283068C7728AF508F05170193E86A72D8371A14014154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a762.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a762.TMP
Size 96B
SHA256 c060e293436220a03c6cf50f1772e2456e8ba89125f66002874f2884347e5c80
MD5 bb9c516960883d773a257e053d884bf5
SHA1 f307b13de1e1b8f9324ee358846ff023a17bb0e8
SHA512 1c2c6d8f3ea86c557acd8c65a9c27f99d87cc07a2f3d9a0e6abf53d400db4f9efe828e6fb5a19fffb4715717750a9de2128f92e7f46c2283f7d5f022b84294e6
TLSH
T1F3B02202C003A203C00203F038A0C0C83330CF33C203020382F03EA3EC32AF880202B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 85KB
SHA256 414b13f24c47ed04729cf579adf14bad1aaea73d788735c985997c52316a3afb
MD5 d7f0957eab4a4fd2471e672ee738cdcd
SHA1 cd1a39a30030feb717cb2ef6006e53754fa703d5
SHA512 2bca8bc8069194a59af1281d520de6b7d6e9ceb1d1947f21470b0ffcca1250a1ce69dc057b5a847cd3d0b11ff0e3a619418ed99ae51337ab4af46a17b74b3ce7
SSDEEP 1536:v/b9YWQn+F0DowGIBSnu3lfRHGKgxVAw8wgvAmyzCT7O:V0crICu3dR1uGUeO
TLSH
T1278302259EB7133AED1DB199B0176E23988D64B4E2044FFF67E02F27C191F18C749A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 192KB
SHA256 3ba644a046d00196e1a1f1ee99563bda62b08631315a489d0bcbb103dc73b634
MD5 cf1177d428e6d7cba77e1d7177b24aec
SHA1 00354935f5c491bc53d906472b205c57387459ba
SHA512 c79d258312cb8ca52666542c4250ae22951b58eaea97a56c122c11a4a14e57621ea9269d82f161eeeb8be12d662ced3cc60b985fd88df778dc89ae4be025b95f
SSDEEP 3072:z45kJlVHHzQdUUxAndLYR57B85rnM6DfZIx3YeRFtK0crICu3dR1uGUe+:z4qJlZzQJxAndL25725wFdCuZuGn+
TLSH
T19B1413284CBA0A871D7D71F8A0065A176CFCD4A5D65A1FFB57D41FB796D0B18C30E824
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 192KB
SHA256 a76a8c3389d948453edc322c0bee13b975e233145b70b8530c3e8cfb83a8363b
MD5 2694e2e402b5695d8c5a851d60931c41
SHA1 0d0f41964f5ee19814e66f003da460d6bd1f7af3
SHA512 82ddf73ef08945ba3d98a8bf9c6b6cfcb986bffaac766f06d3c0c6a951d0fa63a1bee76d298b17c9e8b761e0f0a8c8191e5a7ed0457415ac8c8fd97e62a5ab80
SSDEEP 3072:645kJlVHHzQdUUxAndLYR57B85rnM6DfZIx3YeRFtK0crICu3dR1uGUe+:64qJlZzQJxAndL25725wFdCuZuGn+
TLSH
T1971413284CBA0A871D7DB2F8A0065A176CFCE4A5D65A1FFB57D41FB796D0B18C30E824
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4100-78-0x0000000001990000-0x0000000001997000-memory.dmp

Download

memory/4100-77-0x0000000001770000-0x00000000017ED000-memory.dmp

Download

memory/4332-2-0x000001B1DF560000-0x000001B1DF7D0000-memory.dmp

Download

memory/4332-12-0x000001B1DF560000-0x000001B1DF7D0000-memory.dmp

Download

memory/4332-11-0x000001B1DDCD0000-0x000001B1DDCD1000-memory.dmp

Download