hxxp://gofile[.]io/d/XjEDQC

Analysis

max time kernel
899s
max time network
891s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/07/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gofile.io/d/XjEDQC
Sample260701-cpy83aet8x

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	api.gofile.io
10	api.gofile.io

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3476	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273463826516325"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
1452	chrome.exe
1452	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe
Token: SeShutdownPrivilege	5092	chrome.exe
Token: SeCreatePagefilePrivilege	5092	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe
5092	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 1560	5092	chrome.exe	80
PID 5092 wrote to memory of 3476	5092	chrome.exe	81
PID 5092 wrote to memory of 3116	5092	chrome.exe	82
PID 5092 wrote to memory of 3116	5092	chrome.exe	82
PID 5092 wrote to memory of 3852	5092	chrome.exe	84
PID 5092 wrote to memory of 3852	5092	chrome.exe	84
PID 5092 wrote to memory of 1212	5092	chrome.exe	85
PID 5092 wrote to memory of 1212	5092	chrome.exe	85
PID 5092 wrote to memory of 4352	5092	chrome.exe	86
PID 5092 wrote to memory of 4352	5092	chrome.exe	86
PID 5092 wrote to memory of 3700	5092	chrome.exe	87
PID 5092 wrote to memory of 3700	5092	chrome.exe	87
PID 5092 wrote to memory of 4764	5092	chrome.exe	89
PID 5092 wrote to memory of 4764	5092	chrome.exe	89
PID 5092 wrote to memory of 2980	5092	chrome.exe	90
PID 5092 wrote to memory of 2980	5092	chrome.exe	90
PID 5092 wrote to memory of 1644	5092	chrome.exe	91
PID 5092 wrote to memory of 2944	5092	chrome.exe	93
PID 5092 wrote to memory of 2648	5092	chrome.exe	94
PID 5092 wrote to memory of 1852	5092	chrome.exe	95
PID 5092 wrote to memory of 1452	5092	chrome.exe	96
PID 5092 wrote to memory of 1344	5092	chrome.exe	97
PID 5092 wrote to memory of 1344	5092	chrome.exe	97

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gofile.io/d/XjEDQC
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3480c728,0x7ffa3480c734,0x7ffa3480c740
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,4228225645456243491,9363155387291432451,524288 --field-trial-handle=2076,i,1646044210934583049,13967331684443487233,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2104 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,7914241809089831649,6096325699480958702,262144 --field-trial-handle=2076,i,1646044210934583049,13967331684443487233,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,4265427151082162013,17907603255935659243,524288 --field-trial-handle=2076,i,1646044210934583049,13967331684443487233,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2552 /prefetch:13
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2952,i,888685509054231214,4823770505720429366,2097152 --field-trial-handle=2076,i,1646044210934583049,13967331684443487233,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2960,i,10205779292008069020,3596357118937665325,2097152 --field-trial-handle=2076,i,1646044210934583049,13967331684443487233,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,8076110711944079258,10184915873101204320,2097152 --field-trial-handle=2076,i,1646044210934583049,13967331684443487233,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4316 /prefetch:9
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,12814881947674502876,14121191257931229481,2097152 --field-trial-handle=2076,i,1646044210934583049,13967331684443487233,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3120,i,12053166915467244668,2140367995313846074,2097152 --field-trial-handle=2076,i,1646044210934583049,13967331684443487233,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,835586278096999538,6260193013708158086,524288 --field-trial-handle=2076,i,1646044210934583049,13967331684443487233,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,7217193338089753111,15457101101622562034,524288 --field-trial-handle=2076,i,1646044210934583049,13967331684443487233,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3652,i,8502199041760151370,8067394660380152396,524288 --field-trial-handle=2076,i,1646044210934583049,13967331684443487233,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,7104410972070764584,13533008996762744764,524288 --field-trial-handle=2076,i,1646044210934583049,13967331684443487233,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5500,i,2336817126782280269,9269139369621311141,262144 --field-trial-handle=2076,i,1646044210934583049,13967331684443487233,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5728 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4360,i,3228617241980859896,6191890496862331223,524288 --field-trial-handle=2076,i,1646044210934583049,13967331684443487233,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4004 /prefetch:14
  2⤵
  PID:1344

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

931bccf4-b8b8-40ff-b381-48e6225c7470.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\931bccf4-b8b8-40ff-b381-48e6225c7470.tmp
Size 12KB
SHA256 147c89cfa11dd5d08b977d415f43808b0f0d4717f29348f00c8b956d678c6de4
MD5 8747c03c0a6603d00814c85b0fed52ef
SHA1 c776966fb0fb4557a52df5dceeced1b63f9c977c
SHA512 1132a25ffb8d7ea1caf0b6552e04bf6515b8a64d9edcde08cc3d8ae6101264ed16df35090296a63aaa2246a833d9c36decc4aa1eb53cfb4c85c17dda893e0ea3
SSDEEP 192:GRVwrY61NHkcNnqWEwUFzv7+pAPRp2BlVH9uHsb+WNnVi+QV6d2VlY0QeH4yk5WJ:GRK1CVd6UX2UwD52RJ4Te
TLSH
T1F242D72EAA11697B5CCFD259F9327B53D7F1102222D01E80FAFC8A2C15E79DC211742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 64c3a096bc9f82c5f9ef1bb799e783dd052e01b05763ddbcef33f25b4f68054e
MD5 985e5075419350c2f913898e19cb7caa
SHA1 6b3ebcea9be8f5a6f054e9aec24b3bbe01c707e6
SHA512 7660dfcaa332c455fdc7c80e65e7ad9f719039efbe1078191ad90c4cd14790f237dc630b0cd47813c1e1e0bcacf33d744f5be2a8cd00463ef80f8f944c176e0f
TLSH
T1EEE0E56ACC219C7718FD4B5920644A46F640132B2B804A5F7A3C82098FF067E01858AC
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 342KB
SHA256 d3a40f63c8cd9524a63b1bb54d99e913aecfbb8afff73931c496338b7d034da4
MD5 34fedb5db4046c07f45e5a9df3b86b9e
SHA1 69761fc4c37b942164edb20ac85cbad60b7b20fb
SHA512 7d7779868aa8ee1e26ac476f83839c948b52f181bcbaaeed21edb6eec0d0ed1ef7cfbf44b8be52252df6ed0133d4a918fb5313cb6b73ea5035ff1e23f0e01513
SSDEEP 6144:oU+VyrT3wdVRw8zk/Lm1bmzybaxtsL9cqa5TienvpFmZW0c0DnG:oU+V8kywk/a1bmGbhLqqaImMEl0DnG
TLSH
T1DC742315A7F61C42C2DFE8383C999DFD8609AB34658858B871CD281B6D1BBF6C4331E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 b7fd3118f940962c33e6184922c8a4d45916a1ea0dfe9f44c3ff415e6b0ad96c
MD5 8cc5e1f2cdbe3f72233d57a019defa60
SHA1 ee260a7082832c246254b3e113885da102ff4baa
SHA512 916eeb213bd116f1cd0c33d5076a2ecd0dbcdf874b98fa4e317b853aa5beec82bc5635dcbea6297266e121c3b6223cf1fc57ff6fb432cebfb8d7eca4ecedcc7e
TLSH
T15801B8434FA4A2F1D3125A38F2CB6AA03DF61ADC01038F12D0534EBB98D63B36C46B19
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f70e67ae8e176a467988dfd726c14da5bebed3582d250e9f9e90c7588ae87da2
MD5 a32d0ca0e2a5029e9494a49b97eb490f
SHA1 adccabd2a4f0ee17804fca335a7c83b41c5552da
SHA512 81ed8659b1420ef4de5d56db14550af75355a371971f451d4b5a360580e9410696cba4ea25d3c03972dff9e21d9b9eb926b0ee042ffcfb1a20f4fae720fc3e9c
TLSH
T1CA61DDF783F8853D8A2192F9AB106E1FCE691524432C397689D46E0BA3F3972D20474F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2fde8bb6eee887c02ade90103621bf846154dfcd6d82921722a2e55dad146e68
MD5 46f8c2a073aa843a85d2d5197360c8be
SHA1 2f794bcbdc2866593a4d25194dc82fdc6cfcaef6
SHA512 ed56426ae06fed1a598952738b45b07545ef2acad4c4d8b95f547b422676d0b60796f08925376feec0908ed40a32bec11c2bec746e1b63381ca7bce5d52c46aa
TLSH
T11871DDF7C3F8853D8A1196F9AB106E1FCE590524432C397689D45E0BA3E3972D24478F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 63064159c61ff30d81d0bdc3910a3e25506b6b825456ea96dd67544368725dfb
MD5 595bc0fa216aeada8b9a178e29ed72c9
SHA1 4a27a1d75fb1d304cc503e94527f181cf299218c
SHA512 67771b14636742c70a9578826a236d902f147e71eaa9a6becaeb9b77477749df5646f76fd6d162f7dd5300b1fcb19c6b012db7f89c2a2ebd3be25c9b9f2f6b69
TLSH
T12871ECF7C3F8853D8A1192F8AB106E1FCE680524432C387689D45E0BA3E3972D24478E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6d8f4c7b6faac60fe74c1aa1a755047764bb72502145b69ef122afce2522a2cc
MD5 5cc041507b9d7b15d63c858f38d56035
SHA1 3fc29bcd9209882951bffe8c8734c06178e3f942
SHA512 00ded52457765a265b7f4167d27716da2b464d3894a233df31cb7c953b9b2b9b4838be75c1adc9f891c0b9083276fd76fc73ab95d6885d2c097cc218ff1de4c2
TLSH
T13D71EDF7C3F8853D8A1196F9AB106E1FCE690524432C397689D45E0BA3E3972D24078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 e6addd90d9b888c8e812443f503971aaa2b1218f2d8bdd2498cb3404a14f5ea5
MD5 7335e7c182d3fea3dc79a448f9feeeac
SHA1 6ef09b117fb2e6c95aae75cfd071cb4b5e98baed
SHA512 bb9819a1cbe42f7552d2ad9eb811480a3db70121e0211828016f8a9105e5a975b74ad17519ad5bc5f50c05c1a6c2b29d90dd8a145da7e7dc6d5ab99ee3552a99
TLSH
T10A117FA796FDB86F507D58BB1E457C0AA97AF431034154F5DA97402CB0C26E70F0A462
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 baa2326a53b8f5b7ab6b8df7a8fa7b4aefe640976893741a8fdaf67459f378bf
MD5 63e79d05caede74749265b08259cf008
SHA1 aaff00ad7ef9ef6464f93e28bdb1517e6997b98a
SHA512 c288b2457781067024ce04ec49e31ef05c33f9e13902986067a49a924b33247746fd3bcf503958317f2e06af06a8f0a28aa61512a48e8400cad8e226d1ac4562
SSDEEP 192:GRVwrY617JHkcNnqWEwUFzv7+pvbPRpWbBlVH9uHsb+WNnVi+QVox4VvY0QeH4y2:GRK1SVd6FXCUwDb4nJ4mE
TLSH
T10052D92EAA11697B9CDFD659F9357B53D7F1202222D01E84FAFC8A2C15E79CC211702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
MD5 04c2655e775a571e3b09dcdcd782d924
SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
TLSH
T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 462f5c3ac5d87aaeefe2ff33373caabf2aaef49bd1ad23d4834add7a564b39e0
MD5 30f48798b44bdbafcb2606bbebb89efb
SHA1 bbd86f2ef434645ad5e864f2514882b9cd64cd30
SHA512 3a532ffb3a7279fbd04c115817ad4e80aabb5a4d3066f71c122082464655b427a729eb7b1ce3147b490867a356355399c6068718be6d2f23e9038df5e2fcb17e
TLSH
T1F5B0124280016122C08302B0A246149871185F10960A1B0153E06972D82B1728024150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585d00.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585d00.TMP
Size 96B
SHA256 452c5e52059efad0b3fc21a4de88998a0825632baa447051ea59cd9f92c6a673
MD5 298502d872dbc26cb10c02631832958e
SHA1 0990d6d96f409d5b5f4e497c20aff1fe05b72a48
SHA512 2d4fe8861c00e1221e5f850c965a02671a81e575ea37e4f8000bec995038a4f2d2a3390e772e24194b456376e91e0e094b1d0566213f827a539a56ddca98035c
TLSH
T1B2B02280C002B323C00303B0308282EC3030CF20C303038282E00EF3CC30E320030320
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 430e2702d24e2474213295da6fb14ad4aceaccf1e486beaa7d619894027299a9
MD5 7bb248460c56d1f23da8c8491c2a5a97
SHA1 4c0f38a2bf1e736a274945da94f0d8a1086dadcc
SHA512 e1cc2209adad98a7eb01ab58b802dda6f53e6d4bf15a0a11f960760bdbd4b6fcf3a4bd8e3dc09db307b3278af5ef7c40ed45dd0acc19321ec94ecd4594de63db
SSDEEP 3072:q8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:swCcmXKegIh6jh9JvexhQ
TLSH
T148C3125928273DA688FD6EB3B41333828AA353E16D05F54E94C8DF0A45CEDB415EF474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3677c49cf61fe8038fc78cba71eac877678e069400074d50dc433fad7a27058f
MD5 d1da1fe57c17d029e4cb2380dabfca3c
SHA1 34dc66089d2ee4dd3c64549fcb1ea11271bb7f54
SHA512 ec7e6df97fd2775282635d379652b0d1788970d29385ba0821294a8c70bf92d573e21c73104f4ccf1a5aa7f098c640ada7530d94223dee2bbf401afa1cd5150a
SSDEEP 3072:Vl8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:VzwCcmXKegIh6jh9JvexhQ
TLSH
T16DC31259282B3D968CFD7DB3704737828A9213A26D05F44EA4C8DF0A45DDDF815EB8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 89ec719626265e69b785a4f8f418a040dc2d79bde260abcae918e2588ff1c011
MD5 48bfea2f80a8738656947056851437a7
SHA1 408dbd7d60098160e57b4a046742ed050c888cfb
SHA512 9606aa4056040abeb76277226119fec89b7314f7b1ac5d79edc2b25f5770eeb1d466ac9feb565591ffc4fb4ed88abdc7befa1b49e3919e0f58b991b0b6a5f169
SSDEEP 3072:D8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:1wCcmXKegIh6jh9JvexhQ
TLSH
T1A0C3125A28273DA688FD6EB3B45333828AA313E16D05F54E94C8DF0A45CEDB415EF874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4a8f2b483f8f560212214b17bbc12db3c5d8bfdb912aa668b8fec7a52a5c1c5c
MD5 9cdd7dec185777ab64f4fc2ff36e31f9
SHA1 34ee9ba0baf0332d8e2641c6bb787a8a48f1fca8
SHA512 764ef7b2c824fa380112833d016417ad82c4bea413504fc90f84cf3f23030b964200de56fd55db4d1bacfbc84092749db883324d7cb535558ffb268e5691e077
SSDEEP 3072:Nl8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:NzwCcmXKegIh6jh9JvexhQ
TLSH
T1F0C31259282B3DA68CFD7DB3704337828A9213A26D05F44EA4CCDF0A45DDDB815EB8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e3fe0959daeb382db3f38e2fc6ce3fd0ee770d9dafaf9749e82fddf50f47e593
MD5 4127d41e675e1d18b9696c1ba8955c27
SHA1 47230b196a47719b73d835f7602718c7c542f739
SHA512 c7bb64ff55908b5602310aae6b56d6539a80dcde0b1fa251dba12b70180f08d5670e8d3498571bd639c17ba8a292fbb68da7cae7d93981461ca5e00a23c63a9f
SSDEEP 3072:x8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:HwCcmXKegIh6jh9JvexhQ
TLSH
T1FDB3125A28273DA688BC6EB37457338286A353A26C05F14E94CCDF0B45DEDB415EF8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download