hxxp://Malwer[.]com

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://Malwer.com
Sample260517-kdgtmsd121

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4532	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134236950613985018"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
2088	chrome.exe
2088	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe
Token: SeShutdownPrivilege	3856	chrome.exe
Token: SeCreatePagefilePrivilege	3856	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe
3856	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 800	3856	chrome.exe	80
PID 3856 wrote to memory of 2820	3856	chrome.exe	81
PID 3856 wrote to memory of 4532	3856	chrome.exe	82
PID 3856 wrote to memory of 2820	3856	chrome.exe	81
PID 3856 wrote to memory of 588	3856	chrome.exe	84
PID 3856 wrote to memory of 588	3856	chrome.exe	84
PID 3856 wrote to memory of 1548	3856	chrome.exe	85
PID 3856 wrote to memory of 4536	3856	chrome.exe	86
PID 3856 wrote to memory of 1548	3856	chrome.exe	85
PID 3856 wrote to memory of 4536	3856	chrome.exe	86
PID 3856 wrote to memory of 2392	3856	chrome.exe	88
PID 3856 wrote to memory of 2392	3856	chrome.exe	88
PID 3856 wrote to memory of 4296	3856	chrome.exe	89
PID 3856 wrote to memory of 4296	3856	chrome.exe	89
PID 3856 wrote to memory of 232	3856	chrome.exe	90
PID 3856 wrote to memory of 232	3856	chrome.exe	90
PID 3856 wrote to memory of 2040	3856	chrome.exe	92
PID 3856 wrote to memory of 2144	3856	chrome.exe	93
PID 3856 wrote to memory of 2144	3856	chrome.exe	93
PID 3856 wrote to memory of 3140	3856	chrome.exe	94
PID 3856 wrote to memory of 1124	3856	chrome.exe	95
PID 3856 wrote to memory of 3644	3856	chrome.exe	96
PID 3856 wrote to memory of 1676	3856	chrome.exe	97
PID 3856 wrote to memory of 1676	3856	chrome.exe	97
PID 3856 wrote to memory of 1520	3856	chrome.exe	98
PID 3856 wrote to memory of 1520	3856	chrome.exe	98
PID 3856 wrote to memory of 2088	3856	chrome.exe	99

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Malwer.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff966bdc728,0x7ff966bdc734,0x7ff966bdc740
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,2690214181523782003,11383687790992692065,262144 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,8496947477045803367,1590602742287569936,524288 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2088 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,16397482111851395666,7024562262878645321,524288 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2528 /prefetch:13
  2⤵
  PID:588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,5683059200402894220,17249508874219090005,2097152 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3116,i,4282704315442271029,17168906704347253354,2097152 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,3246835112621603909,4256193607822661717,2097152 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:9
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,15442533162938039261,17326201982637653419,2097152 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3224,i,17179527937026537572,13361190129742465153,2097152 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,17296654462312172250,3934467776977448914,524288 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:14
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5524,i,15889800527076657999,2282686003856626442,2097152 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3472,i,5697722830794552256,7278399960504348169,524288 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4796 /prefetch:14
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,9469586703576713122,5158949821406585633,524288 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:14
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4392,i,504322614863038732,6303179394302718483,524288 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:14
  2⤵
  PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3948,i,9101454637745409239,3150850640961579887,2097152 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4820,i,7733663902295460813,8806813299750340200,2097152 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5628,i,13969565412690260384,15545207542585987354,262144 --field-trial-handle=2032,i,428102792005674311,4331316801023474668,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 666e9576bb8e39771b10cc2598c62b037b93baaf4e95b99525d18f39b6a58055
MD5 be534d0b578550a9b5db244d1adb558c
SHA1 9ec4f65c59db459091c46a8a8841ad0379295221
SHA512 079d2ce039082a1c0d5167f195364045aead77dd3dd5f5937af9b76c67aa9dc133ce37bbfda62837b80884a39b8399aaff3a0ade71ca07b1a20f2c110a17b9b4
TLSH
T1F7E022BAC835A8670CF99B6DA5544B03E75413072F61481F3E3D824CCFB523A568682C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4b3c56e3ad81a8d031cc082357a0bb7e71b35b6bd2bfad2b665c97973e76ae0c
MD5 15f26af8827fb371e914c8eb2a2fddc2
SHA1 79fce6e6da1c430c898bcf4ab6d2806586013c69
SHA512 ff900172aa064763c2340b832cc0ba2defaded359d901373f6aa9712cd888775f174aade945b89ab7274c96c45e205aadbc8bd9f896948cb7ce584bf768d8a95
TLSH
T1375177B7C7E8866D890156F4AB256E1FCE290E14532D3C56C8D8AF0B93E68B1D20169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c67de13881839f7b3d8ecc71e55840abdbfc19697ef6178d7e5e0dba52b84f89
MD5 0feb5d664e34c63a97ef6aece9c25487
SHA1 3263398633ecbfa2700d23ca5a84225f01a25c52
SHA512 307f473b4c3825ca873cfd23d5957f94d7c75f2fa378ce4fbd82e2b916c75e8b3e2bff29c5cefd863247bfd275761569d34383a8477d008e6c3423a4fb48bff8
SSDEEP 192:CRIbq3aZa2y9fBgv7mpAPRp2369EHdNb+WNnCQPFTeU5VyIsnAUge:CRIbUjoaUXNah3Pnfe
TLSH
T1F542C62EE924653B5CDBD22AF9297B97D3F5102125D02E84EAFC8E2C15E75CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 78f2b9e9ebc08798880cb4679beee8aef2e584a4e9691c5edb1c0165ca1273af
MD5 f3fb909317ed06709bfdddf6e293f823
SHA1 f9840b19b75e8120807aa0784c1bde6154aba029
SHA512 4bd189ef0e2f72445f5af07954ee4d6ebdcc450090a92b283a2c281a3cf530c9eff525dfd48ea12519fb7f49e455434598bbe11f388dcada8c12c9ada348e50c
SSDEEP 384:7NjnO7KxkXqKf/pUZNCgVLH2HfgslOv7pLuLcSjZkXODnq+ErU3BHHGu/n0To:7NnO7KxkXqKf/pUZNCgVLH2Hfgs8v7pU
TLSH
T18172E9A76C4C9E370F94CACCDC1A7B4FADB6024B65E9886443FA582503D5ACF114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 cf8e3cce2cfd0574aa15c8983a2c46d9431ccae1e28e11b7a8596ee6088c3709
MD5 f8e7ac5f84e01de546f4cc459202a833
SHA1 1cb1d92669bc75ce5da60d4cd228f1fb10996381
SHA512 8af5b11d2d35d8850af6331b870828e1916405fd1ebae5192cee4178831d0bf4bfd679f66139bb131e039ee9849793d8976893d0b51b333e4c48a3d8d71ddc42
TLSH
T1FEB0124084015341C04312B0125614CCB1546F15AA0F270143E47926CC362628814160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58949a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58949a.TMP
Size 96B
SHA256 dbe05c974465ad26cc68f978a338bbddb0ed7db05a110e5a1fb3520abaae223f
MD5 1a2578385bf5e2df563374bb70a11f36
SHA1 e666da246c9141199a87ee10693915b9ad2c3e2f
SHA512 56de50ec33d308a7b90c87138e249b2d39d35af922b2540054c29a537446766f0f45bae0c7fc799d0b2596bcc420744599276659e3086dc1ac248c6fba1a08b3
TLSH
T108B02200C202B203C00303B2228A88C832F0FF20C203020382FC0A2AEC202B008B2020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 0de9c2cdc93a9ccf4a67b23bf62ed7d23d0ae4c3397857e80f7137b86d321b1c
MD5 5452d9de32ed998c4cacf619b05bdfab
SHA1 cd5d23ad6602c738b81c3d47256a89ba3cc5d027
SHA512 ef80ed38450cf69e87937f92c1e4eab7bb233da2712f9ad94bbe62cbf34ac44e6491524c8f965a3143a918b060b6031df7a70a22a16d89f8daeec406bed10a14
SSDEEP 3072:2TlGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:2Tsm7Rkm1tYpBeh2BAoi
TLSH
T102C312375D74A83B5DB5BB4EB04E0E1F1EF149A6D924EA92C8D85F0423E97CC0A49A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 86732150133e41f3d7742f26bfde5e32698d9cd02e6309a6f704edd5d5a6a7ce
MD5 19a2c601155a9630dffd74381ab92efe
SHA1 bd4b1b91b521a47ef10844fcb94d012e6bbe6a0a
SHA512 fea4528797af423bc1fe254132692a3e924c4ca4ab2a0ad47fae2805c58a2bc1be4b0720813c30f8ad5a15234cab68e13ab92b9d0547047a82d0d9bfa9bd5e29
SSDEEP 3072:2lGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:2sm7Rkm1tYpBeh2BAoi
TLSH
T1CEC312375D64E9365DB5BB0EB08E0A1F1EF149A7C924DE92C8D85B0433E97CC1A49A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 97c701f26ff8ed8f2045529a73268be8640cfcdc756ae40b093719e6ef0bfb07
MD5 05329a5183dde95a3a685d791926a08d
SHA1 fc8394c48ed93f27804aba3dff1dadef739ece1c
SHA512 ccea56b9858d90808c55ca933c30701cb9ea58464ca05bfbb6ff95c5c002c3a72546af51672f7d3f95ceab8c9b04d667a59fa02f85dfb739abe0d28782231a54
SSDEEP 3072:JDGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:J6m7Rkm1tYpBeh2BAoi
TLSH
T118C3123B5E70E9375975BB4EB08E0B1E2EF149A6C920DA82C8D85B0437FA7CC1909934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 17bba3c6679c38c20668e65a88aa19c883ab68591e70333ce259cb269685fe2f
MD5 6705fd311cbe5e0c867ca4392321c010
SHA1 e2d9af31cd589cfe996c05773686d714c99e9c14
SHA512 4dd2c6b5d2631c3d0ae2fbb0994b27dff3a22c941e63423d56444fcaaf4478f817f2d65da70cc7ae5305a68e431e9f7b9aa287fabfe6ce1939a9eea6d6fca3f2
SSDEEP 3072:JlGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:Jsm7Rkm1tYpBeh2BAoi
TLSH
T168C312375DB4E9365DB5BB0EB08E0A1F1EF149A7C924DE92C8D85B0433E97CC1A49A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download