hxxps://cbdt[.]click/

Analysis

user interaction
yes
max time kernel
134s
max time network
134s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/07/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cbdt.click/
Sample260701-qbcd2agy3x

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4452	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273847081284233"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
2704	दस्तावेज़ देखें.pdf 1111111111111111111111111111.exe
2704	दस्तावेज़ देखें.pdf 1111111111111111111111111111.exe
640	chrome.exe
640	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2368	4640	chrome.exe	84
PID 4640 wrote to memory of 1428	4640	chrome.exe	85
PID 4640 wrote to memory of 1428	4640	chrome.exe	85
PID 4640 wrote to memory of 4452	4640	chrome.exe	86
PID 4640 wrote to memory of 4112	4640	chrome.exe	87
PID 4640 wrote to memory of 4112	4640	chrome.exe	87
PID 4640 wrote to memory of 4592	4640	chrome.exe	88
PID 4640 wrote to memory of 4700	4640	chrome.exe	89
PID 4640 wrote to memory of 4592	4640	chrome.exe	88
PID 4640 wrote to memory of 4700	4640	chrome.exe	89
PID 4640 wrote to memory of 2236	4640	chrome.exe	90
PID 4640 wrote to memory of 2236	4640	chrome.exe	90
PID 4640 wrote to memory of 4896	4640	chrome.exe	92
PID 4640 wrote to memory of 2308	4640	chrome.exe	96
PID 4640 wrote to memory of 4472	4640	chrome.exe	97
PID 4640 wrote to memory of 3860	4640	chrome.exe	98
PID 4640 wrote to memory of 4792	4640	chrome.exe	102
PID 4640 wrote to memory of 4792	4640	chrome.exe	102
PID 4640 wrote to memory of 4928	4640	chrome.exe	105
PID 4640 wrote to memory of 640	4640	chrome.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cbdt.click/
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffcab49c728,0x7ffcab49c734,0x7ffcab49c740
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,14439605685267656653,13871086019983148239,262144 --field-trial-handle=2024,i,14336023664798232814,9474442282572067888,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1660,i,4773215666666357892,503890182220633312,524288 --field-trial-handle=2024,i,14336023664798232814,9474442282572067888,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,15779161327865349031,2923089005048827582,524288 --field-trial-handle=2024,i,14336023664798232814,9474442282572067888,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,16665458411108006158,7792876925068982703,2097152 --field-trial-handle=2024,i,14336023664798232814,9474442282572067888,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,745541316129095773,6506476042600446537,2097152 --field-trial-handle=2024,i,14336023664798232814,9474442282572067888,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,8467277950253057356,11112760053696677147,2097152 --field-trial-handle=2024,i,14336023664798232814,9474442282572067888,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4428 /prefetch:2
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,11956352857966554161,5752646467193607015,524288 --field-trial-handle=2024,i,14336023664798232814,9474442282572067888,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,18374270652047887518,15079597515615938703,524288 --field-trial-handle=2024,i,14336023664798232814,9474442282572067888,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,17624028201695141670,7794763735936492113,524288 --field-trial-handle=2024,i,14336023664798232814,9474442282572067888,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,13986210518497339867,1174659337593444024,524288 --field-trial-handle=2024,i,14336023664798232814,9474442282572067888,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5328,i,10803939923048296409,9457562051420377366,2097152 --field-trial-handle=2024,i,14336023664798232814,9474442282572067888,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3272,i,4085032969342944370,11143090592804534301,524288 --field-trial-handle=2024,i,14336023664798232814,9474442282572067888,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5968,i,8298807303491851392,4958799568780783349,262144 --field-trial-handle=2024,i,14336023664798232814,9474442282572067888,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1736

C:\Users\Admin\Desktop\दस्तावेज़ देखें.pdf 1111111111111111111111111111.exe
"C:\Users\Admin\Desktop\दस्तावेज़ देखें.pdf 1111111111111111111111111111.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b752ce994546cdba709df3c11c0b1d5c756b9491623d5961e8c303fe1bc4ead6
MD5 b205b971e6e4973a13c752728ac9a94e
SHA1 5bc536bb960d2a620a33fff53c7221d6510476f3
SHA512 359ac48f415d6808f3cf919870c2678395a1cb84c4c97d4481cc03741a3ac2d8789fd61d679634443474e9e449786b22f048510ae8d413fa7c5d1ecdab04b6ec
TLSH
T158E02B6AC821DC3714FC4B1960198B82E79013173740994F7B3D960C8F7173A459681C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d6d7cc1d928e96e104d3853656db210663c72d494f74fc09081e797fd76eb268
MD5 bd4794750f9890828566bede4154194a
SHA1 a920de54ef5741bf9b48effe93fdbdfd885a9689
SHA512 c08d9c6397d08720feea0dbf8ccebd260ad072488cb19b07e23835e414a09e3f4ed130ea206939015f0f60f7bbe87cfb47965840c5421221d81fcb6c0818443d
TLSH
T13B418CF797B4897E8A1192F4EB156E1FCE690524532C3CA6C9D46E1B83F28B2D10075F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 59ac58ab9804f8cd8054b24fc5e91f69dca4ca33617e0b3d382007aa9995636a
MD5 ad5453d912bd25f33158284a6940286c
SHA1 e4bd085a1e772dc0cb206d3c377a1ef84927de8a
SHA512 5694098a023e48e145afb12ed1a2be3da6d9e0fea4dcbb7106b9733358954101f6f214d17a9cdec95fae699c7fedc3463590714e15bb7bc24d5fb06168b81205
SSDEEP 192:ERVD7RYmSSB3s2qiiUDKmv7PpAPRp2aVA9YHsb+WNnVbuxV+K26ZfCeUyHwnaKt7:ER/2k84jUXYWwMF26wnaW2e
TLSH
T10F42B72AAE14653B5DCAC269F9627756D7F5202231942EC4EBFC8B1C11EF6CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3f899f9880cac3533cc9df5a2206c4f18d9e4c1ee6a8acd902567c4f373f6d84
MD5 9edc01e99d793a6393fbae8629b9d514
SHA1 c6270534c212cf176fdc0bf61f3cac48adbb3381
SHA512 6f41016a494bf5ee8142b8fa8601025d09b906ac71a7ca8fab24bfb1eef6fe45a13c2f2c8616b94708ada69db6ad4c4f2669de35b731418792401d2c8ddf49e2
SSDEEP 192:ERVD7cYmeSB3s2qiiUDkmv7PpvNPRpWcaVA9YHsb+WNnVbuxVQRE6vfCeUyHwna9:ERSqk8ej/XjWwMKESwnav2E
TLSH
T1AD52B72AB915253B5DCAC659FA667B56D7F5203231902E84EBFC8B1C11EF6CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5e78389837019b50e270c34b8aa42b67a3b0e1fa8ea83a8b92add8037d6d2148
MD5 d436a84226267c9501b38c25f90a8a6b
SHA1 6b2649c89fa85cb157483cd1ee5b4f8554989eac
SHA512 fa493d647425aad73fdacc3e4c470eeeb84cc312b2cabb1271770cf8835a57b4487ebf252e3f73e0b91c4857d33864fc29561000027b7c6bb9a972659ac19b69
SSDEEP 192:ERVD7RYmSSB3s2qiiUDPmv7PpvNPRpWcaVA9YHsb+WNnVbuxV9fY6ofCeUyHwna9:ER/2k8jj/XjWwMJYdwnav2E
TLSH
T19952B72AB915253B5DCAC659F9637B56D7F5203231A02E84EBFC8B1C11EFACD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4438812d966e1d11c2f4b4dcd5703934145668a842e5f18c309b93e6cd0ba09c
MD5 1386314059085d62a9101bbf1a039b65
SHA1 c0c9d9db0103f0aa592eb50b557e1c7af59924f0
SHA512 f7b9944b5b23df4170a875adebfb1950f8d576c4adda2b26467f584019e888c6a674a0a567adcf681cb9c5f7c120924ecf6d54fd0463d975b4fb31a520df19c2
SSDEEP 384:bxj3K7KxkXqKf/pUZNCgVLH2HfgslcP7pLuLcSjlAXOD3u+ErU3KMHGu/g2kRm:bR3K7KxkXqKf/pUZNCgVLH2HfgsmP7pS
TLSH
T1FF72F967784C9E370F94CACCD8177B4F9DB5015B65E9886483FA581903D8BDE11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 50c950cdd6125c79a2563063b9e8dae7733e9c0714a7ab5a2b6a9119d8a52825
MD5 f4d383fe1a0e6d51a74f2cd0a34d8279
SHA1 59c6e12416f5636a58756f1da36aaf009c8e27c6
SHA512 b957f538e6c9b0e5d87728bb4435c524fb9a669c47eb427743e90a863a6f2c7a5218c8d56407480c14e89e117972827c54da448948c7aad52161a83acc2994c7
TLSH
T134B0121181815202C14202B4154218C9F3145F10960A170543F0A96ACC25362981A060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588306.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588306.TMP
Size 96B
SHA256 b491339420c1b4a67207ad32477ecc1cdc3175cc65aa45afd5847d89041c7a89
MD5 768b786983cc115ef65fb4beaa43e54c
SHA1 618a2efcc5ac74fa471856318739da7071135846
SHA512 9c175ae89eac76c699e34a7f5e06b2656eb6d41206b5a0830add64482d9324ef2bf042c00a2ccf245966008ea98d55d081888ddaacc61ef26343919b8e05a2a5
TLSH
T147B00276D112A253C06703B0259795D8756CDF26C6432A129AE42A6FDC257B1C529370
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8a7feabf1774ebe5f01f09c0b6013334c1fc6aeb4935a0c3d2fd0c0010805031
MD5 6869c3732b80f78c40bc291628edabda
SHA1 287d6dbc7c80a8ab6093da7e70352bbe47ddc11b
SHA512 eb36030015845bbf73a1c2140ffbc57bd915f4a6dcffc7c496f85b6fe904de5d69abebd245faca0d4d523824d38a335492f3f24e8c8eae04e77168cd6d6d4394
SSDEEP 3072:2GGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:2xm7Rkm1tYpBeh2BAoa
TLSH
T148C3123B5D75E9375978AB4EB08E0B1E1EF149A6D930DE92C8D85B0437FA7CC0908934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 74463530dbdd1165e38c7e5942dc0e379ee02e0dbe137edaa27dab84db0e8d33
MD5 3ac22eab008cb3a9ed9a054f01784533
SHA1 10d382030a56f1ddb554c9f0c59dcdf9fb3d5bcf
SHA512 487af7211ad24c29776d8005f0e42abac8bb000b74617a63b01eac128c810954f517d8ea332797b9a9370f6426e3cead82cb1f2b6fbe6e7095a3e4295701b678
SSDEEP 3072:CrVGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Cr8m7Rkm1tYpBeh2BAoa
TLSH
T136C312375D74A8375DB9BB4EB08E0A1F1EF149A7D920DE51C8D85B0833EABCD0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 77f9c52629cb46ef0d34c7b7857547c004f4ec1d9870f83d7198a628207b3296
MD5 8c7e4b9baa511dcd41e67c630eb572d0
SHA1 c4ef022ee0887c68d027927217478517fce4104c
SHA512 e8e563e85f704b0ca3f51be52dd88067a5fa8e45334dc2f363fc58548f94cb7f50eb2ec1c4ce2e20b46079c437beaa3f09fc3e275c4f01095a6fa47523a4075b
SSDEEP 3072:CTmYGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:CTmTm7Rkm1tYpBeh2BAoa
TLSH
T157C3123B5D74A8375DB9BB4AB04E0E1F1DF149A7DA24EE51C8D85F0823EABCC0945A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 955940c14cdce9c9d9cf3511f2a496986cbb4772e84522592ace310b02f223fb
MD5 d39a154881ee1984cf473efe5f92e89b
SHA1 c31e887d7d666a904f9ed589d99e98eee8a1e347
SHA512 20040fe6103a54a19ae389144b456db8c1e27b0fa250c448776441de9790d6918b2159cbbe8996541c19ee6416b33a56d5e2bc4c67d0bfa8be7f3352c15c9efb
SSDEEP 3072:CgLGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:CgSm7Rkm1tYpBeh2BAoa
TLSH
T16FC3123B5D74A83B5DB9BB4AB08E0E1F1DF149A7D924EE51C8D85F0423EABCC0945A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 933debc18909a8266d7aaacb07d78659bfd638065a537f8f8d3e668d7b2b8513
MD5 393edd4c51b4c6edddc2f527a5a2fc44
SHA1 33bc2c193fbe208e44730f11f123c9884927c9ac
SHA512 f7aaf423264bc59e357e2d9640041ad3da737ab1320938f530ead87d8ba69ad81b0ec535b53790ed5a6b665309f6948a9dffa7ad0b4425f12ff15a26a9694b35
SSDEEP 3072:RrVGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Rr8m7Rkm1tYpBeh2BAoa
TLSH
T166C3123B5D74A8375DB9BB4EB08E0A1F1EF149A7D920DE51C8D85B0833EABCD0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

दस्तावेज़ देखें.zip

Path C:\Users\Admin\Downloads\दस्तावेज़ देखें.zip
Size 19.1MB
SHA256 c6bcb3feb84fb15d30fed18ecc5b1f6e2681b563fe7c63b7a29169c34c3c7b6f
MD5 65e18e132a0aa81f2246ddbfdb36dbb8
SHA1 ea08f2f61f78cb96f95752f4d368a699984fc27f
SHA512 ab52c4be6443183f920ed415daad4d70659ff83fae331b842a2762891efabeb1ec0de3b4d3d6f57cd48653bc6072461e728ed31cf3ff6d4524d062cfa2bdd613
SSDEEP 393216:x+1R+oxk1S81StNXnYh2oSHTMkniXlp19Xw/odkWLGLz:xPo8S1X/oaMyclpzXwwdkNH
TLSH
T11C1733B0DEA1043E4A2E522714CD77F504CED77B70EAB97C0ABF17A289649785C67A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download