hxxp://gofile[.]io/d/LFIIPJ

Analysis

user interaction
yes
max time kernel
899s
max time network
894s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/07/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gofile.io/d/LFIIPJ
Sample260701-ddfs1sc15p

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	api.gofile.io
11	api.gofile.io
27	api.gofile.io
30	api.gofile.io

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4232	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273480156360305"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
3876	chrome.exe
3876	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 3340	1520	chrome.exe	81
PID 1520 wrote to memory of 4080	1520	chrome.exe	82
PID 1520 wrote to memory of 4080	1520	chrome.exe	82
PID 1520 wrote to memory of 4232	1520	chrome.exe	83
PID 1520 wrote to memory of 4984	1520	chrome.exe	84
PID 1520 wrote to memory of 4984	1520	chrome.exe	84
PID 1520 wrote to memory of 4996	1520	chrome.exe	85
PID 1520 wrote to memory of 4996	1520	chrome.exe	85
PID 1520 wrote to memory of 4872	1520	chrome.exe	86
PID 1520 wrote to memory of 4872	1520	chrome.exe	86
PID 1520 wrote to memory of 444	1520	chrome.exe	87
PID 1520 wrote to memory of 444	1520	chrome.exe	87
PID 1520 wrote to memory of 3572	1520	chrome.exe	90
PID 1520 wrote to memory of 3572	1520	chrome.exe	90
PID 1520 wrote to memory of 1232	1520	chrome.exe	91
PID 1520 wrote to memory of 1272	1520	chrome.exe	93
PID 1520 wrote to memory of 1272	1520	chrome.exe	93
PID 1520 wrote to memory of 2240	1520	chrome.exe	94
PID 1520 wrote to memory of 3608	1520	chrome.exe	95
PID 1520 wrote to memory of 2284	1520	chrome.exe	96
PID 1520 wrote to memory of 3876	1520	chrome.exe	97
PID 1520 wrote to memory of 4356	1520	chrome.exe	98
PID 1520 wrote to memory of 4356	1520	chrome.exe	98

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gofile.io/d/LFIIPJ
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e601c728,0x7ff8e601c734,0x7ff8e601c740
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,13345907593725601498,17721723581058212272,262144 --field-trial-handle=1952,i,2774611101564515775,11757749180465530328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,12770851444008044252,9023192923251688134,524288 --field-trial-handle=1952,i,2774611101564515775,11757749180465530328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,3469393960996852528,1745854804956756367,524288 --field-trial-handle=1952,i,2774611101564515775,11757749180465530328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2516 /prefetch:13
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,5212174485381293429,17018854827706230445,2097152 --field-trial-handle=1952,i,2774611101564515775,11757749180465530328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,4537636867121564331,10243098657554239621,2097152 --field-trial-handle=1952,i,2774611101564515775,11757749180465530328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,3740200816151097518,17476027986703815203,2097152 --field-trial-handle=1952,i,2774611101564515775,11757749180465530328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4136 /prefetch:9
  2⤵
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,8545857056353617660,3117229759463322975,2097152 --field-trial-handle=1952,i,2774611101564515775,11757749180465530328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,13021698320521971934,5012087753011631425,524288 --field-trial-handle=1952,i,2774611101564515775,11757749180465530328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5680,i,15048976674255908863,9414651216351146289,2097152 --field-trial-handle=1952,i,2774611101564515775,11757749180465530328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,5103417118818847779,18149452303135791892,524288 --field-trial-handle=1952,i,2774611101564515775,11757749180465530328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,973152493951928263,2932582816532890636,524288 --field-trial-handle=1952,i,2774611101564515775,11757749180465530328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,12484907584586894113,15529885677992320238,524288 --field-trial-handle=1952,i,2774611101564515775,11757749180465530328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5580,i,96050883245155562,6967972850073074931,262144 --field-trial-handle=1952,i,2774611101564515775,11757749180465530328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5288 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,5770008404114782275,9184537128567238350,524288 --field-trial-handle=1952,i,2774611101564515775,11757749180465530328,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:4356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 de07a9c84133982ef9c354b59d98bb632cd8021c44c56f0db21f1bf320742adf
MD5 f0468b0bbf039408c85d2d33b5516605
SHA1 6a554d6e3ebc7b9d6710259e374f9fdda01c102f
SHA512 1e46f4232fdd6cde932354ee3e517ac8f8d0509c8594407a4dd2f2c58eb93357a73fd01592cf3f439580404ab02f449a9bdd63dc66b4e9918d0c7aebdbae1d5b
TLSH
T14FE02BEBC831ED370CFD475870554A85E714139B2B80854F363C460C8FB177A4195D2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 5308194190688349f92f611f62b83b8cc87e20094dbffae1ca76809313602c72
MD5 0ff4d31c529a770b91cf3477b2529e8f
SHA1 059df543392b5d2edfdf6f499e8d12ca0c5f3519
SHA512 1ddf3986478ab968e540e2465d6629292ab70ec414119ded1eb7d77c4636cefd301927681cb6786c21d238d975debf3c30204c26b848afdb1e2c9e7067bf2d96
TLSH
T19D01E5764F9192D4E7D07E3592C9A560317A4F14C31F4DE6254175BC701E784553931C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 75c6a26e7de8228948c78b310ca1037f9e29b19cfeaf5a06119c59281a9eab18
MD5 b1e504466e07e1e1537dfaf73dc7aadd
SHA1 40ee6a0b8a210513bb0ef0dfdd5f28cbd1da7f32
SHA512 5f548a52b66bf871aed6939487dec6754f371671ab22f45af5ae65775dcd2e94240ff224cf9c8868a220a213fa895fd69c860688e538f0ab20a89b6b06a84e7c
TLSH
T12761BEF783F8857D8A2192F4AB156E1FCE5D0524532C39B689D45E0B93E3972D20478F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2ce2b79f5f27ef52c68b18ee48a34f767df7db0493ce2899f819e4dbae1db0eb
MD5 6b5a6d9796d8f98280d5079dbf4153e3
SHA1 b84931bae9e2668f06afc411fdfb0a7b2baba3a1
SHA512 41515991006b2b8a7c3a8c236cf64e648c51bc4fc6abd59283bb084658ee22b0d98d789e042ff39850c1e885cb872303a347f158932b06d7ade305988efc675f
TLSH
T1F271DDF7C3F8853D8A1192F8AB156E1FCE690524432C39B689D45E0B93E3972D24478F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4158a3d5c0adb45f61f1374225dfc24cbb070c29905ad111cf9a5f5105c1ee97
MD5 04c48c339efdc03f0815c93a74b48a59
SHA1 58a84afaaf9caebdd5e2a718db339fbb5810f19c
SHA512 f4c8326508b0532002606206dce8b1ce306e506964f62d5554653d8b793f45c5914e4ad92c95b6bff583fd74af9be67a59a9213092beb6ee97eb7f0e2c7ef4ef
TLSH
T1C561ADF7C3F8857D8A2192F4AB15AE1FCE690524532C39B689D45E0B93E3972D20478F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 697c099597e272f76ddd6b498443f3eddc0b4b64c31032739ee58eb5410bb6d1
MD5 9fc69a4ed2caa58f5837060b7a5d8c85
SHA1 2b68e64e950ed4094ea0a9df35eedc0294250497
SHA512 a9903e1367820fe3d361198cb340eac69b811a69dbd7b1d961573e8f349285b9992d4f1fded036629cb927255694e9a6ae4ffd177ec0db3cff874db86ebfe88d
TLSH
T10C71CDF7C3F8857D8A1196F8AB156E1FCE690524432C39B689D45E0B93E3972D20478F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 01e532a0015774aacd4dcff534bec3b054673a532b291f6596356d6752a0afff
MD5 46e2ce195b03cbc9b5176bc8cde63a92
SHA1 5cd590c3076f71bde3f71cc656109d57de887e8f
SHA512 a06cb1abc45cb350121af7b24a9851bb028f7674c945d78ca6a25f6a2ec5ca26572a52aa737d35887375b47017e9d1ad23e01ef0c0fbf6aafec760542bd9e2f9
TLSH
T1FB118C9BAABE745B11785DA74E057806297FA83602802CF5CA57806C70D29E31B1A453
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d7f7983bc5bd33598c2d953b834d359ddf66b7e8c3d8837ab730938671e93783
MD5 a151269db4eca99b8db5a956a29bbeb7
SHA1 675e3baa012ab0cd55283a9d08cb86a835307a9c
SHA512 97caa5241217eb226816da1800811e5e8ca72ecfd302b9012d15af750df9cb95fe86d9b3ceb2a56e85cd401c909de775a4d3ea0c3e20306245087d68d6cec2be
SSDEEP 192:RRVDKYBGvNSgh+q/twJkov7H+pAPRp21lVtd9WHsb+WNnVR5QVt8HJ82VtztdOFr:RRgVVWiUXuUw9e2r0l4e
TLSH
T1E942D72EBE10A57B9CCED229FA267B53D7F5202171D01E84E6FC8A1C15D79DC221B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 32750ae270bba44a188558c9a0c7d7d383adab2338d5167b8cee076b328e6fd2
MD5 5a102d2221d7b3163f57df5bc50d1e28
SHA1 472284c21b9d44d6857c2e84729f8e2884459354
SHA512 8a369a13f3f180a5075259e1d36a748bc638e253a0399056196c4e88edba9c227ca756b28b94d6d6e8926f04b6b9f101e517098208ebe452996b054dfd076a1a
SSDEEP 192:RRVDKYBGv7KSgh+q/twJbov7H+pvuPRpWi1lVtd9WHsb+WNnVR5QV8cCVkktdOF4:RRgV8vi+XxUw92COI0S4E
TLSH
T1B752E92BBD10A57B9CCED729FA667B53D7F5202172A01E84E6FC8A1C15D75CC221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b0c37a39269c31d5df2f56a68c1fd82c2be36033dc694aa739c6d3346b6013c4
MD5 86f087d197ef6e22168c773c1c790e53
SHA1 e17b6ee1a2ea11f611ab65ac4835ebb423fea986
SHA512 d799fae4c4a88b69d3765b5fc403d625426309761f2431d657b7ab1d3297ded114110322fea10c19ccf3b065c02437164bf52386b40e3c252d6096946b24bdb7
SSDEEP 192:RRVDKYBGvNSgh+q/twJbov7H+pvuPRpWi1lVtd9WHsb+WNnVR5QVNdEVEktdOFkP:RRgVVvi+XxUw9SE2I0S4E
TLSH
T17252E92BBD10A57B9CDED729FA267B53E7F5202161E01E84E6FC8A1C15D75CC221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6f09384d80106faa1f1fd6f34500cd63fc7769536adc4c49690b3d9e7cedddc2
MD5 b25a3cd1a5eb596a492c4aec54ebc369
SHA1 69c76b8dc247ef8779c3bb4bf1c4d00692d99cba
SHA512 7b635ee01f8ee7974d271f64b26e8e3cb05447ac6569597961da581e1a6c3b2ab0c0a95c34e654a533aa4e6855d0fe4ba26e7dfd908d8cc051c0d1f198731c05
TLSH
T160B0125080416101C01303F411429CC871189F14D70B370183F07A37D82D150C014250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5878a6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5878a6.TMP
Size 96B
SHA256 48c532ef806d144f949480143c26f926a0a073ad53c65acf2a147298337be64e
MD5 612de5b527a06c0a53a8f8945e046b1e
SHA1 2fba0791d1248bae31c4322a8ada344fd0130ec4
SHA512 5a8fb0a9d50d51c0e4c35742dd6b6bcd0f5af839a0bc3b72d6ae5df0e0f29107585a74c0f355e2fabc37917fe2fa81d2b19495c9613809c500773ca18805ed85
TLSH
T104B02220C0022322C80303F038B380CC3230CFA0C30F230AC2E02F33EC2BAA00028030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2d35da2db910de96b98efa4cdf0e6c6c559a551c6b14ce6d1ed7fd7296206afc
MD5 bf403b4856d2ecfae64f4fc778881365
SHA1 9a9f8eb629e69133ff38ce3cf37623dfbbe8ef96
SHA512 1eabfcac81aca3a3cdd9252f11f45a9c3f203ceb00a5a690fac51bb295362b1ae9319506558da0c9a09067cab0e4563bc06029386da835165de3201e351542ad
SSDEEP 3072:SrzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:2WDfxA3OnjrYQ9EU0/hEV
TLSH
T148C302A11C3ABD660DF8EE98640D3A60BFF4AC9A92875DD392E91F4C14FB5C81139931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 f97c0fd93fc53efbc00b63967c1f4d87a9a2ab8d5f4d17b23171293770731bca
MD5 4d62bcea60a0aa2103305f0ee247bf67
SHA1 6041bb48f4258b28c592cc29350cb5bd640c67e0
SHA512 1b1cec309d9643a330dc7d6c722b5d193e6bae5ecda189570084644df077a0e9ae71c8778a4ea9c196026b31900e3304c6951b0587ff22ffe9cab32778617571
SSDEEP 3072:FyDzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:FoWDfxA3OnjrYQ9EU0/hEV
TLSH
T155C302A15C3ABD660DF8FE98640D3E60BFF46C9A92436DD2A2EC1F4C14FA5C81179931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 37332d647f86737c929ae802bbf66a185aaa390a7a585704974037a12dc041ec
MD5 92e90cf282d91732c7fe7f230d2daa77
SHA1 0511d743c816d72140a536c3bccf05a665cc21dd
SHA512 a2d9af62e12adee25e157c0923fd028e35b6bb0b8efce905202ad7f83851076741c89a4c902f8a147461e29af86d759fe0ed9acfc67852ecb18b081a53c56944
SSDEEP 3072:lyDzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:loWDfxA3OnjrYQ9EU0/hEV
TLSH
T142C302A15C3ABD660DF8EE98640D3E60BFF46C9A92436CD3A2EC1F4C14FA5C81179931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 962d4b24a8ab07bf82fe8375f2802c01b8deac5123ab5ee0cde4f73302ffc654
MD5 7cddd25db18fc8d70ed11039171915ea
SHA1 163d114e1bc4b53d91a62f26c6b1723f435b4004
SHA512 12da6d94195a9ad61880d88219ba46912e1a9d5eee5b22a19458d778511038105d87cae72a773de6d25255dc40ecf4b6b594ef4153df5b6c721368760ce99f99
SSDEEP 3072:/rzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:3WDfxA3OnjrYQ9EU0/hEV
TLSH
T10BC302A11C3ABD660DF8EE98640D3A60BFF4AD9A92835DD392ED1F4C14FB5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd41d2ba-4780-4e52-adc4-bb0a0935c36e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bd41d2ba-4780-4e52-adc4-bb0a0935c36e.tmp
Size 115KB
SHA256 1475695a07a1a177e189bd45cc8a378d49c80ea76c1493aa77b3266afd96c5d5
MD5 cade0c1d32e9473f9e3d9a8ce01fd02c
SHA1 28007134432e42e8efba703fbf29da2e46a3a8ac
SHA512 4e0d6112bf44a5576be507980bf73b2030714bccbd14bd01afbaa8d4723de4520094eea9c0e71905775e8166acdae0c753c2624c36a714bd89f21434b69908d2
SSDEEP 3072:5zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:dWDfxA3OnjrYQ9EU0/hEV
TLSH
T109C302A11C36BD660DF8EE98B44D3A60BFF4AD9A91835DC361ED2F0C14FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download