hxxps://www[.]keicedc[.]com/

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/06/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.keicedc.com/
Sample260630-ecltbaev8r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4376	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272648984072479"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
1492	chrome.exe
1492	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 4852	3428	chrome.exe	84
PID 3428 wrote to memory of 64	3428	chrome.exe	85
PID 3428 wrote to memory of 64	3428	chrome.exe	85
PID 3428 wrote to memory of 4376	3428	chrome.exe	86
PID 3428 wrote to memory of 3784	3428	chrome.exe	87
PID 3428 wrote to memory of 3784	3428	chrome.exe	87
PID 3428 wrote to memory of 3904	3428	chrome.exe	89
PID 3428 wrote to memory of 3904	3428	chrome.exe	89
PID 3428 wrote to memory of 1112	3428	chrome.exe	90
PID 3428 wrote to memory of 1112	3428	chrome.exe	90
PID 3428 wrote to memory of 3184	3428	chrome.exe	91
PID 3428 wrote to memory of 3184	3428	chrome.exe	91
PID 3428 wrote to memory of 3448	3428	chrome.exe	98
PID 3428 wrote to memory of 3372	3428	chrome.exe	106
PID 3428 wrote to memory of 3980	3428	chrome.exe	107
PID 3428 wrote to memory of 4416	3428	chrome.exe	108
PID 3428 wrote to memory of 1492	3428	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.keicedc.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc5d83c728,0x7ffc5d83c734,0x7ffc5d83c740
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,2729512903894197526,12377249651636710844,262144 --field-trial-handle=1972,i,11688786441453892676,10752108305538705607,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,3867591139314480496,16699019162738852468,524288 --field-trial-handle=1972,i,11688786441453892676,10752108305538705607,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,17299792619563655385,14296317604158408459,524288 --field-trial-handle=1972,i,11688786441453892676,10752108305538705607,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,3087628358143345153,1193354078839633273,2097152 --field-trial-handle=1972,i,11688786441453892676,10752108305538705607,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,466458044225620094,14166789523631305006,2097152 --field-trial-handle=1972,i,11688786441453892676,10752108305538705607,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,9715674514601453691,1096994885469690695,2097152 --field-trial-handle=1972,i,11688786441453892676,10752108305538705607,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,16865058755681486227,17968090028228719855,524288 --field-trial-handle=1972,i,11688786441453892676,10752108305538705607,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,18076472078393830525,8725328818796340646,524288 --field-trial-handle=1972,i,11688786441453892676,10752108305538705607,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,17257075343412785176,12679426091216247548,524288 --field-trial-handle=1972,i,11688786441453892676,10752108305538705607,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,16006171946050805135,13795024767960987864,524288 --field-trial-handle=1972,i,11688786441453892676,10752108305538705607,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5924,i,13208146858956952357,9325439071872263307,262144 --field-trial-handle=1972,i,11688786441453892676,10752108305538705607,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 37a9e6752a6d1c74e664f7bd8ab61516ca74404996975b427c3d3d1abe320092
MD5 da9b528565db92df136549525c9c3cbd
SHA1 2599dc1de8a8c7e29dcad41ad2b466d35efd1a67
SHA512 bbe3fb56e8b587c5565ddbd2341b2f966e5f184594c4f777f546dfb8c884eb09ed09f9fd5f83f351be1564630a9ae082509a855867a65d7398311a6c4baa4ff7
TLSH
T10AE02B75CD229D3718FD1718A8B54705E641231B2B409C4F773D810C8FB573A458685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 165734d19ddcbd608681927ad163a19984ae24919382b89332c2fe52c87c711b
MD5 525bbd72aea1e6ff12f3dc81ec354041
SHA1 97bc078e69fc604b39270dfc18e69066f6b13843
SHA512 97c962200862cbb8e340806b5dca6f9bc85270ebe3b7577e8da27d6b885b18d05c40b0d833854894101024ce83a15f4d8c2f2d445bc44f53b9ca1eb6d885d84f
TLSH
T198F06DC012D127C6DFBD4E3433A10E5571FC85A1010E6E67715E0DB9DDA63E2215A792
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d1fec4f7fa77856b5ba5a46b54e2ba495ec340eb78cb1323fbffdb427448aafd
MD5 3e8d3ddd0636835efa8c999c503137a2
SHA1 cf858e838f50890eee9f3bd46135254b46e42550
SHA512 e6bcc705ecd48c12597c609ab257b7a63df740b2279bec8ee78a2faf78abfc18c6fa7f531489cb1df12a6aa949e76cb5a10cbd2b8817cf4b26e113a435be5b1d
TLSH
T1AE51ADF787F4857E8A0192F4EA146E1FCE2E0524431C7CA6C9E46E1B53E3972D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7fbbf567f4c849985dcc2178c3cd051eff4b5b5c0e63adbd449bb63d7a7ddb1d
MD5 d7492e166db7c1b6b083248e37d52c6a
SHA1 7efcf4768aa9f85d33bce91c107a4d7debb17f40
SHA512 111926081d162cb22fc88496a93630fcb38b70e3c8ac8043847af73fd212ffe70ce6c7e57504e2413fd617000623451d07c5e663dea85adfe8671fa159dd8b80
SSDEEP 192:FRbMk8VTlWkv7MF+pAPRp2XG9HHsb+WNnHfbfM2CqesbMaE+VyIsnAUge:FRbMpVQAgoUX11w/w2aaE2e
TLSH
T1F442D82EAD15697B6CCBC229FD667B53D7F5102121D42F40EAFD8A2C05E76CC621702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d31edb3efe2feffa1b194c4d26ac43c6cd817ab7b2538cd47b575ad07a49bca7
MD5 916c89fceba5b6007e310f9d67854cec
SHA1 08566842788499e86208206df2898f4b83df16de
SHA512 720f66fa2d8546ef262088178755662384be86776fcc1387f15b21a2099bff580afc436600dc16012193019c6057a478e10267e0b677231f9eeca44c1f4619ec
SSDEEP 192:FRbMk8VTlWvv7MF+pAPRp2XG9HHsb+WNnHfb0A8YAfYeAwqesbMa2+8yIsnAUgE:FRbMpVQngoUX11w/gYKa25E
TLSH
T1FA42D82EAD15297B6CCBD229FD667B13E7F5102121D42F40EAFD8A2C15E76CC621702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 efa1826af42f16df759b25a3dd1059da3ee34333d03953af9c12de0adcdafa45
MD5 0771d6fb3f533ed82c34f674ce6b4ac8
SHA1 2d02928ae4c30fb92a473b41f4917af558765aa6
SHA512 60c1361b634ebee39ce686babb27d65eaae364edf34a9b2478f13c5677ccb040a1387aae80e315868803e80aa176f34b464a478c47d229a1a52b0c1ab9c6064e
TLSH
T10BB0124080415641C04602F812471888B25CEF10A61E170583E0AA3788291508414050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587c20.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587c20.TMP
Size 96B
SHA256 77e90ce47c87986b02bc78a43d083ce0ce53f2a349f31f2118fdec9ae500157d
MD5 4142c62c503076b207b0707bf58c6fc8
SHA1 a0c25b945b2b62b497545764e4da4437959b8fc8
SHA512 75a193aabd4a01dffe37497ab1ac8576b11ed5319d0f903b6c04ed499627ad37f112fbb2831f2d173e0ecb2eb0e9365d93e83376f14e6dd2f39ed9121e07db56
TLSH
T12CB02202C0832283C08203B02A80C2CAF2B2EF3AC303220AC2F00ABBCC282300032220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0d5add00603339c2a1cb3f936805ef78e787d26e81cd8cf60ae8f3c92ffcbcea
MD5 54735771c7d6bf627685a5eec463d354
SHA1 374b0e57efa84fe02c4b2199e7ff74be274a37c1
SHA512 c121274d4988c79c8403b6cc3ef305cf9a51b35bf099544a96068c02e59f51cd5e7c495608ed9e44cc624d22ef2bd8f08e4bae7b67286c826419106cba5f0b5a
SSDEEP 3072:9wNjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:9wNam7Rkm1tYpBeh2BAoM
TLSH
T15FC312375D75EC3758A9BB5EB08E0B1F1EF149A6C920DE91C8D85B0423EA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e6f5ca8e91c8173e70368b8c9ca9af218922625cef1a69fa4d19d305048d9dcf
MD5 5d8fb814a65f2fbbc7b7c32c0a36b2bb
SHA1 21cd69f7dde44cff5415654501fd043bd1ac637f
SHA512 0190df6f7f37a89a19424b5f4d9b866726da982dae7c4962669e05fc176aa7074309d2a491a9c31fd2945926a5acaf5ee6c305a46ed1e5793ff74b5ac1bfb460
SSDEEP 3072:9DNEGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:9DNnm7Rkm1tYpBeh2BAoM
TLSH
T14BC3123B5D75A83758B9BB1EB08E0A1F1EF14AA7D930DE92C8D85B0423F97CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1457194d49171ed363c7734dd00fb9e6ff2e2c9b952cbe8dff6deb19e756d9aa
MD5 39a1a876c39e1248a9fd22f3e58fa625
SHA1 dade54cb7e9a3b423cbad14a190bc5378bd59372
SHA512 e59945918dbdde16505d5ea719c99ecd2bca0e6307a1a9d583b5437b1a7ddd737e450bfe043033bc9a0e3badb3b81c6e265c98d4554b4eceee166c382dbf4dea
SSDEEP 3072:/KGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Nm7Rkm1tYpBeh2BAoM
TLSH
T149C312275E75E9375878BB0EB08E0B1F1EF14AA6C930DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7eaa7a09ec5b788efa393a1ad79db4f130695bd0e08762b2fedbe520bdcec9e8
MD5 9b957094aaa8440b94b27550fe17b548
SHA1 5c946f508e537e3b2c695f042e6375660e075975
SHA512 7bbdf3d82fd72cc5eac455bbb52fb1eb4c79f4c6a83194e952a2ce8234a929a12866e91efaaf20aa77a5e0417d08cf41fa491d2fea06712940e1982eeb7d15f4
SSDEEP 3072:9DNjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:9DNam7Rkm1tYpBeh2BAoM
TLSH
T1CEC312375D75EC3758A9BB5EB08E0B1F1EF149A6C920DE91C8D85B0823FA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download