hxxps://b1[.]xznkjzx[.]cn/

Analysis

user interaction
yes
max time kernel
78s
max time network
90s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://b1.xznkjzx.cn/
Sample260507-psqsbad13t

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
856	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226309768763086"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe
Token: SeShutdownPrivilege	4492	chrome.exe
Token: SeCreatePagefilePrivilege	4492	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe
4492	chrome.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4688	4492	chrome.exe	80
PID 4492 wrote to memory of 856	4492	chrome.exe	81
PID 4492 wrote to memory of 5040	4492	chrome.exe	82
PID 4492 wrote to memory of 5040	4492	chrome.exe	82
PID 4492 wrote to memory of 428	4492	chrome.exe	83
PID 4492 wrote to memory of 428	4492	chrome.exe	83
PID 4492 wrote to memory of 656	4492	chrome.exe	84
PID 4492 wrote to memory of 656	4492	chrome.exe	84
PID 4492 wrote to memory of 3212	4492	chrome.exe	85
PID 4492 wrote to memory of 3212	4492	chrome.exe	85
PID 4492 wrote to memory of 3156	4492	chrome.exe	86
PID 4492 wrote to memory of 3156	4492	chrome.exe	86
PID 4492 wrote to memory of 1752	4492	chrome.exe	89
PID 4492 wrote to memory of 2528	4492	chrome.exe	91
PID 4492 wrote to memory of 424	4492	chrome.exe	92
PID 4492 wrote to memory of 1120	4492	chrome.exe	93

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://b1.xznkjzx.cn/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff9e4f6c728,0x7ff9e4f6c734,0x7ff9e4f6c740
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1864,i,12326419039981714436,12004989394916979472,524288 --field-trial-handle=2052,i,3078264564827066673,8313079062208151891,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,12985698598763323438,3044207429383565556,262144 --field-trial-handle=2052,i,3078264564827066673,8313079062208151891,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,768613407457121138,1058698784515318500,524288 --field-trial-handle=2052,i,3078264564827066673,8313079062208151891,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2532 /prefetch:13
  2⤵
  PID:428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,8310480848719184639,4284558251782011453,2097152 --field-trial-handle=2052,i,3078264564827066673,8313079062208151891,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,17473874293849877482,190750900093383832,2097152 --field-trial-handle=2052,i,3078264564827066673,8313079062208151891,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3792,i,14568595198524415337,17501265130621994350,2097152 --field-trial-handle=2052,i,3078264564827066673,8313079062208151891,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4188 /prefetch:9
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5068,i,8645787845337655877,8543865624020594186,524288 --field-trial-handle=2052,i,3078264564827066673,8313079062208151891,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5068,i,3050278039091185974,8616191974332724430,524288 --field-trial-handle=2052,i,3078264564827066673,8313079062208151891,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,9979178426729873885,5484096956286341017,524288 --field-trial-handle=2052,i,3078264564827066673,8313079062208151891,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,3398685457168976122,9512811296307429301,524288 --field-trial-handle=2052,i,3078264564827066673,8313079062208151891,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:1120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

07ac4788-fcf5-4e10-87fe-9298009716b1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\07ac4788-fcf5-4e10-87fe-9298009716b1.tmp
Size 91KB
SHA256 b2ee40aed5c3fd9b174db002306a6627bf08fe01c4f077fc49b5d224682adbf4
MD5 b8ab7ef6e05328d3aa45f12d5d737200
SHA1 1156b8926395cae32ee7904831f96b84da358dc1
SHA512 a0ad34adec978cb64a138c564e946b324ca850b029dc12e70431c0942fe6e7d8a3b52d1c770adf7c9c853129dc5bb7875d0aa0ecc8b104bb537673e3cd8a5570
SSDEEP 1536:RuxmTP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:W2++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1229312B9AD0E7C7523ABD2A690079CAD8CD3DCCE1614157C31C76F0E14BA392A35B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 337ea784177fe504aecfe45550db2fa7e11283cb2859fef4c88267805b0bc541
MD5 e5e1871abb431f3da96d6fe697783721
SHA1 4cfde2cef5267ff2e5534acd44d81bf3f4e3599b
SHA512 0e3bed34829118e77f026edd827e9de4009f66fa9705b9b85ef3b8be1f7676c19fdbf69c713de5112e2c2cc75faa24f8979564fdb745a4d42bd50d4646fe4f5c
TLSH
T1C4E065EBC8219C2719FE0B196054478AE750135B6641855B763C810D8FB166746D596C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a1c8e1ef455c0fdf4e1dd6a7cdef6a1f824738f8583f642646fdc54445c7cbd1
MD5 02be9ac917776c56de61e997330abba4
SHA1 c79635a7dc3403156e7f262e0867567e6170a01a
SHA512 c71461d75b4b859db99546efcb0db20de434f3cceadfdc2d6c74202364d4cb88504f6d5402fd79ccfd1c2561191203e9fbae44a04a4716842ef899b4d2ba6003
TLSH
T18551ACF793E4997E861192E4EB146E2FCE6D0924031C7CA688D4AE1B53F2972D20079F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 9984f1ccde208a3fa4cbe581e85a6e2ebd21e1325618f567c30024e35b77bac4
MD5 d388a5a492e3d0171a930c1b70721136
SHA1 a7a8bc759054e24ddf201a18d37b0ea16feefeb2
SHA512 f74231a515d9b93669f2a67bc3689a8fcc89e79b22ce695f4b1402c08c31f1d85b37d75f2cd822a8711eece2e481df3a540135fef3351299c4b948c5bf7101f0
SSDEEP 384:NRkt1uBfLPHpVXfHwcm26cxj2iO85LxAP:M1OjPJlHwc6G2Uvw
TLSH
T10D52B72FE914693B5CCAC629F965BB6BD3F9602631901E84E7FC891C24E7DCD212701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7161fef984aa4d0574c351623b87d25cac3521c83ee0ad362ff34040be9e0c1a
MD5 17f5478317258abeb05f6e7c26269f8f
SHA1 9a811559c767690f2272aea37cb7c4b182a2dfe1
SHA512 bad47ff942ed89c7046baaa7c5488e49fc921613b7b238ca72382f42a3f3efdbd120b66f1cfa8ec1daa4880c29ac453cec6b9340406ba2fe7b753d274f11daf0
SSDEEP 384:NRkt1uBfLPuZpUXSHwcm2sxxj2iOC5AxAP:M1OjPqlHwcsP2KYw
TLSH
T1E452A62FE914693B5CCBC229F9617B6BE3FA202621941E84E7FCC91C14E79CD212701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c5f7ad3b5a4a4768d808354b3a75704621179124cf54f1b6c558f7028e28f051
MD5 343a6577d436eed922eb58e53df17904
SHA1 9d0f417a24bbf3beb04a044572d48ed9d7899cbd
SHA512 0bbe8af5ade4041ee0129af2e65994c88c90ea0e3c06769228ac01fc9302e43172b00563daf7f1b7d2c006f3a11319396735aad700ad25c28e768a05954a0ddb
SSDEEP 192:NRkh71uBUyxUCGg7fv7dpAPRp2R59ZHsb+WNnAvFNC2JEXWxj2iOkw1CfVyIsnAC:NRkt1uBfLP3pUXSHwcm2Jjxj2iOY5e
TLSH
T1C852B62FE914693B5CCAC219F961B66BE3FA202A71841E84E7FC891C14E7DCD612701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9078e5ceb66122f5ec89a7e589a2a0559ddc60c50b9f938076238c33522ad19c
MD5 cb788029f89fbac3395d681668cd5808
SHA1 55ba6f562f0afd9e0557a22c727e2d79924c0de6
SHA512 2933259e6685ad9fafb6402f5c6f93377e36771989566acf87349ad3992a20c47f270b71bd02e359e3110832cae4b72e80ea6d9031174f22e3b1f4af71211946
SSDEEP 384:NRkt1uBfLPapUXSHwcm2sxxj2iOC5LxAP:M1OjPqlHwcsP2Kvw
TLSH
T15B52A72FE914693B5CCAD229F9617B6BD3FA202621941E84E7FCC91C14E7DCD212701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
MD5 6c2a084e9725415d6e6f241570b51988
SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
TLSH
T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b986e6ff30e92c5cd81a0cb56ebf1a86014508ecf9269be14ea4682385cf72b0
MD5 2fa530f1b4cf49a12a05cb0834cf4455
SHA1 c53797a063352994a5b35587ef14892a363d514c
SHA512 58aa61918717ade4fc8cc770a5cfb40c3813ecc965b7497db45e744d21eb0ea75703ed5c178f59eeb0181717e28447e1f854b84ea456ca361df5a34c07d972fd
TLSH
T1A9B0122080419501C14302B5118304983178AF20C70A130163F0ABB6DC261A18014161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584e69.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584e69.TMP
Size 96B
SHA256 c6f1684051b0b8a1584eeb9d1fe0c779f49a492a6259ad5c150346210d8702c7
MD5 7b8d14eef2b5a2333d3ab9641e1fa337
SHA1 f34fd7679327b490e454ff2040e705564da2e853
SHA512 85d095bea0378b1c1b58626dd00b57fecaf57c9d9d3b873f8a99ecb363c58553ab9e7a6fc95fd567e3225744fde8d73fa8c92417319926b93c1beab0d62166b6
TLSH
T1DBB00297C113F326C05213B0259AA5D87160EF65CF13129292E05A66FD26672C565174
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 1afb1640e3039f208f91976cec8d30b2c25ed665762196ae161ca6dfa75c860c
MD5 d02fa21c34390a3db8fafaac7592e455
SHA1 440070d6014c90e47c5ddaeee3929350e2691f24
SHA512 45c65012c63baf3cc337d978531cd6acc08b7c18949952badaa256cafec1778fe1ce68a4f9c1cb5b18bc25f95f1f6bfc258402fad80fe0e786f9e0decb3f475d
SSDEEP 1536:8uxmTP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:Z2++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T14B9312B9AD0E7C75239BD2E6A0079CAD8CD3DCCE1614157C31C76F0E14BA392A35B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 5c30c7cac7a19a6a9b6cfdd85317598e99545a71eb3f4345353890b54872b767
MD5 86395050621fbdc1eaa44a07e5811bd7
SHA1 47b41dca68cd6a874f2f7000de9b748b4f922553
SHA512 72d04059fbd75a4affc9ed8518e55e4cbb09385dd949a54e6e09769a18c5c98a5f79072c3018d73edc8c690543c515d3254474db6abaf58503b891b0fe689248
SSDEEP 1536:8zPqP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:IPw++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1269312B9980E7C7913ABD2D690079CAD4CD3DCCE1518257C31C76F0E14BA3E2A35B8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 b7fea7c2e0d083e9eeffd49044f1f5a568144732149a5d724c66fecf69b8633c
MD5 6c39ce9dde7b4aaf94b01bad90da737e
SHA1 aa6f4eceadd6d733e2c4508b32bcc1efdf26bf0b
SHA512 928ab40f6886c9a6f3258624e959437661890f1fc9483fa07eaa28e63d0e1c01717cb88f5c337b0efe00829efc1a8a759b7689587dd943bae4b52d1f8509c848
SSDEEP 1536:XeP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:E++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1E79312B9991E7C79536BC696A0079CAC8CD3DCCE111451BC30C76F0E14BA3A3A31B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download