hxxps://mega[.]nz/folder/PmRDhY6S#kqg5jGPCFYuKDtPk5FMtRQ

Analysis

max time kernel
899s
max time network
888s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/07/2026, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/folder/PmRDhY6S#kqg5jGPCFYuKDtPk5FMtRQ
Sample260702-ewt9ssh17p

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3424	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274394921822322"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
392	chrome.exe
392	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
488	chrome.exe
488	chrome.exe
488	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 4168	488	chrome.exe	81
PID 488 wrote to memory of 3216	488	chrome.exe	83
PID 488 wrote to memory of 3424	488	chrome.exe	82
PID 488 wrote to memory of 3216	488	chrome.exe	83
PID 488 wrote to memory of 3000	488	chrome.exe	86
PID 488 wrote to memory of 3000	488	chrome.exe	86
PID 488 wrote to memory of 900	488	chrome.exe	84
PID 488 wrote to memory of 900	488	chrome.exe	84
PID 488 wrote to memory of 4012	488	chrome.exe	85
PID 488 wrote to memory of 4012	488	chrome.exe	85
PID 488 wrote to memory of 5084	488	chrome.exe	88
PID 488 wrote to memory of 5084	488	chrome.exe	88
PID 488 wrote to memory of 1588	488	chrome.exe	90
PID 488 wrote to memory of 3360	488	chrome.exe	92
PID 488 wrote to memory of 1944	488	chrome.exe	93
PID 488 wrote to memory of 3144	488	chrome.exe	94
PID 488 wrote to memory of 392	488	chrome.exe	95
PID 488 wrote to memory of 4580	488	chrome.exe	96
PID 488 wrote to memory of 4580	488	chrome.exe	96

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/folder/PmRDhY6S#kqg5jGPCFYuKDtPk5FMtRQ
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xa4,0x108,0x7fff2961c728,0x7fff2961c734,0x7fff2961c740
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,11575518312369758548,16655562049716731005,524288 --field-trial-handle=2132,i,974729795935607005,3645036816896090893,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,12985592773994062413,10458655290956583765,262144 --field-trial-handle=2132,i,974729795935607005,3645036816896090893,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,18142225953519431605,3578954162668109254,524288 --field-trial-handle=2132,i,974729795935607005,3645036816896090893,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3028,i,15555285927680157098,6327408882991924911,2097152 --field-trial-handle=2132,i,974729795935607005,3645036816896090893,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3032,i,17181199977058361895,9351776800156266478,2097152 --field-trial-handle=2132,i,974729795935607005,3645036816896090893,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4292,i,4154122783605782765,4066779560071326908,2097152 --field-trial-handle=2132,i,974729795935607005,3645036816896090893,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:9
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,13081901514382793568,16266909585845575584,524288 --field-trial-handle=2132,i,974729795935607005,3645036816896090893,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,11057363519978577049,15691573623333776268,524288 --field-trial-handle=2132,i,974729795935607005,3645036816896090893,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,8662447157828434604,3622948985014749930,524288 --field-trial-handle=2132,i,974729795935607005,3645036816896090893,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,13825897535376768868,9667674384703275638,524288 --field-trial-handle=2132,i,974729795935607005,3645036816896090893,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=740,i,4882942381322818699,17234584848331542136,262144 --field-trial-handle=2132,i,974729795935607005,3645036816896090893,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3036,i,2101248585905218758,12304947084084540056,524288 --field-trial-handle=2132,i,974729795935607005,3645036816896090893,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5088 /prefetch:14
  2⤵
  PID:4580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2d167c9c-ad95-4c1e-a1f2-49a2b616013e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2d167c9c-ad95-4c1e-a1f2-49a2b616013e.tmp
Size 117KB
SHA256 7d4dcb3bacd84052c91de2a1e01616f59aeaf10344e95c66033fc01c7b895217
MD5 f0d49be35397df234a73283d698f2909
SHA1 4de026abcedafa50bf6752519a36ca3b0d52f926
SHA512 d5c2706fcb1120ae95f3a520f66d2c20f50bf8f29c3722189f1a1e20ee7294750598eb87aa65c1261f5a97086f6b7a92d88920d0080de31635444b1b68443a57
SSDEEP 3072:wyjzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:w2WDfxA3OnjrYQ9EU0/hEV
TLSH
T1F3C302A15C3ABD660DF8ED98740D3E60BFF46C9A91876CD6A2EC1F4C14FA5C81179930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f1f2424-e483-412c-934b-4d6546fde5ae.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0f1f2424-e483-412c-934b-4d6546fde5ae.tmp
Size 414B
SHA256 7ffa8cb679bb23b4786c250e5d17a308e47d97bd1c35c0efaf072f5558a5d0f2
MD5 0d96099dda5c1b56906d930af0b403a4
SHA1 cc4c90c68b01145e33a5abdeccd6b49334787d2b
SHA512 dff9286db3341e8eb2e6df211322f53d294011e21b3743d4b973aa3dfcc6c0df982ca5dbb057f90e2a00986153dbd0c8af518eaf1e9ce7bfe5fe4ecedc9d2317
TLSH
T1EEE022EACC31DC3728FD475D61544B8AE711039B2B80894F3A3C82088FB063A52A691C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 e64edc3aa12bbcd7b38d1ccf4d0439082a39c9040b1b751be5061a4de1d9e6af
MD5 ce88fea22f3a16e2103a75f864d64ad3
SHA1 3f3127f7420e48431d7de96c1d9702de253a6d60
SHA512 b35c03d5a3edcbbe463b0b07cda8f70ed15139ae97f800357c9c3a095e8fb1ec3c47b5856cfed240c31e1f361ec47eb47fd0f2d1bd79751d0912818209b69a4e
TLSH
T1AEB01120B2C2000AEFE0023828820C8022B00A08C202A33A82E220A880332E88280080
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2882fff5e53ee828bf2e8091d25d78bfe7ab2d569ff79beb1713ef4d2f1e46b9
MD5 ea74b9bd9d8dcd37b9f8a866ef2f6323
SHA1 a973383afa9e36088767a8d67d4d9a072ceb5086
SHA512 7ccaf2c343427d61024880168c0a93803b0d09f877b9b2c2ba71a62f36d4e55d594b010ab7e6f761aeb444abbce9bbfc8fa30b8940b1491f46beca543df1c5ae
TLSH
T1A8516BF783B4C97D8A1192F8EB156F1FCE690625032C386689D4AE1B93F2972D15074F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 728a2d837b1c7ded13d4822bae1c2ffa7a21a96d0209b403eea0be2baa5b2856
MD5 1ebc7c6e6933b25c50041f9f724f50dc
SHA1 28367736094c1a4f7b6aba0603b101e5f53cbb97
SHA512 0f6ad626f396338b6d5b5fbb0714c9f68ac580e534684fa13ed39c977eb5654bc2c476f5250bb00b97744f68a496dcdf2d03e8173deb1b16b50b49bffa28732a
TLSH
T1A7517DF783B4C57D8A1196F4EB156F1FCE690624032C38A688D4AE1B93F2972E15074F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ebd4a2b3212858d071b630f251938bbdeb8e4837e53190f3faa3742e9e800c11
MD5 49511cb13c907e70b37831f9bb30fe7b
SHA1 b98607578c67ae7821afac0345c3fa4b06e3aa9e
SHA512 8c9ea0681ebd7e1a64eea7b5291f40c09d68634f68b698ff6619a21799bd0bd3f41c229bfe5b0eff9df47841a4b69825d9eb30e6087b8a927cf8bcf2ced114a6
TLSH
T14B516AF783B4896D8A1192F4EB156F1FCE690625032C3CA688D4AE1B93E2872D21574E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e742b2dc3389c39c178c3c2f373a17cab48cdd28aff9f65fa16fdcb1a6c37d0a
MD5 08374810ef90f973c35754c50dafb03e
SHA1 2db6524b3bbc77b0300e4086082f20296919c426
SHA512 f126a7b7f366959c39ec19c09456c85ba2a9c2ebb6fee6f06be347bcd0501f324b28fa4d8442af0dd6d154bd4a15d0a1b1a197ee1669c284e331795382868cc8
TLSH
T1BE517DF783B4D57D8A1196F4EB156F1FCE690624032C386688D4AE1B93F2972E15078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 267c7f452ae9f0a3409d65ced01973a5ba990796af2b324ca954a0df7fd85156
MD5 304981cdf582c71cc280d140d73fc8e7
SHA1 10e7446c5c0d15f90d0e688e32be3e84284d1665
SHA512 64df55e423bcda4d63f5c3369a9dc615f03eb53cd5b4f1b96f221a56a95d4533f34b9a7be4e5133ba9209c787f07f42f6fea9593e46e3f89e877b4a449b4f6c7
TLSH
T108415CF783B4C57E8A1192E4EB156F1FCE690615036C386689D4AE1B93F2972D11074F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 ce1b8a92d310f45de1abd2b0ed56fb71c76c4af757cc63fea189d8f0758efbfc
MD5 267853448bdf166c53e9a13c0d8da9c9
SHA1 4d51f78bdc88530f9a3e1240f385febb71f8779b
SHA512 8c566b112ee1e0377fe60f742fb3660284e3db41f516377fd14782b425ca72ab8b6094f5ecd5fb0c0fd8bf2fc9db3dd15f9997dc7fb52ef72108d7bc59f19f01
TLSH
T18F019EAFD36AB457107989EB5D04BC0B5AB6B43202C168F1CF9B416DE1D64F33B22407
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 038f9077a0669156b0aebdca77825edac8ea7ea7298f31f8fcb6c77437f01d20
MD5 0a877c97eebb567fd723d536c850e6c3
SHA1 16c5f2bbb434ab692b8f805d5948baa36ca466c5
SHA512 f4b7a31f86df911774c4f3b3288c07c3d96f3a879d3e81e2cd70a24d3e7d8ec8e9747a1f81dc28cf420429b60241a948f22f8cb28affcf259569fcc2da004af2
SSDEEP 192:RRJlvSH8lAEQQEv7H+pAPRp2Ve9WHsb+WNn6KG0q2dnegPkwPF8VyIsnAUge:RRJV3giUXPUwX42dnHP9Ye
TLSH
T11642E66EBD50657BACCBD229FE217753E7F5102165902E88EAFCCA1C15E76CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 18c06004d00c825b83e11879e3eab992a483d5389610abad7145a4577347d6d0
MD5 0f09e8a5a410c18e2bba23a3c3c34228
SHA1 6831ea106abe83ccd058861f21b975ed62206e52
SHA512 95bbb36b29263b473252c104c0e69bfe86aa7b837bfeec8aa91e03ba663c2b7405ed8525f8665d41d8303b62f4973d0b3e8d3975c65c8f3094abea2c070ac163
SSDEEP 192:RRJlvTH8lAEQQEv7H+pwPRpyVe9WHsb+WNn6KG0q2cegPkwPeC8VyIsnAUgE:RRJVYgiEXbUwX42cHP9YE
TLSH
T1DB52E76FBD50693BACCAD229FD217B53E7F5102166911E84EAFCCA1C15E76CC211702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 a427a92dc1e3f569a7dcbfd7d8c20bf010e40ab09958c4bc6e815b7238abe14b
MD5 71fff9f1a2ebb91f07227488d996160f
SHA1 171307f274e30b77167f9fe6afd2952862a455f3
SHA512 bdf607d7ba8a96462c267bd39fbc2e633bcd861af6ad1c53ec119292a2154657ce6665b64fdf1ee1428699b334272d070f7baec8d2a0a3bb09bb7d25e405b2ed
TLSH
T1E8C01242CE01F261C05B03F81953D498B15C9F2CD71E27D862E41B129C3415082162EE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588160.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588160.TMP
Size 96B
SHA256 4d6cc1300b2a4b5bf28d7fc95459e8a5002e34ca037cb50fba6ac4fac8e84438
MD5 c444cac8b062c88fa80ca6eac1f3a16b
SHA1 4d6a6ac210b47c6592368a9169bd59793539de47
SHA512 c2367782126cf80be2b0804119ba15c6ecc00d76267265436b2b2337f04f2473e57461981c1ce3553134be4660554c3572c0c9263d4b9230e9b58e5e49610d1f
TLSH
T1EEB02202E2032282C00203B02880ABC83030CF22CA33033ACAE02B32EC302A0002A0E0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 35eb5359ada9001b9fae120ccd72070b488fff239c6e9f4386d3ab2af9c66e2f
MD5 5a055f633bdbf550400bc15849c1269c
SHA1 61a3c364ca9479a31370d68f1b5e9a212b97c230
SHA512 da865c4fdf41c956d185062ade8189a74c24f7cc0f11997848fc17e4084f917b01fea228ac59663be72b7270bc813f1b5d734061a250ee3452b1112186467450
SSDEEP 3072:rPzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:HWDfxA3OnjrYQ9EU0/hEV
TLSH
T141C302A11C3ABD660DF8EE98640D3A60BFF4AD9A92875DD352ED1F4C14FB5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 80376a27f3991bd0b1c3466a7b1d0d034a32afc14a084e54247d4934ac9fe512
MD5 9e6f72a3be476b1399343b90b3780ea7
SHA1 8dd56fe96f09afa735819777301f5d4590e504cd
SHA512 6dedba5314e4d06db4044a51cc96224b370136f3ace63c5b49764beb075b575aaac8e326f303346a8e85e49098e1c7c059834598367091d03c104ca3d6697484
SSDEEP 3072:APzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:AWDfxA3OnjrYQ9EU0/hEV
TLSH
T12FC302A11C3ABD660DF8EE98640D3A60BFF4AD9A92875DD392ED1F4C14FB5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 827e80660fb15b7e032bdc3c0609d93f5cb62164978002d8b8fca219448f69cf
MD5 f161588024b1598951026c777865d381
SHA1 d52b738f456a1edf509cf02ae46387c573fd0bd4
SHA512 3bb1b3c6bedfddab8cf79a4b4fd9c0b0102a1024659ce4e0db6f137966121466e883bbc2c6ab0c9f288d4dc7e5c33ade12f5a6c29413f14588f85ebee7391758
SSDEEP 3072:EyjzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:E2WDfxA3OnjrYQ9EU0/hEV
TLSH
T166C302A15C3ABD660DF8EE98740D3E60BFF46C9A91876CD6A2EC1F4C14FA5C81179930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 10b7b97a9f32156b593d54d4b1a98d5a62ea7f0df6222ec5839228bdf4867ae2
MD5 3c42e820ea3283e6e072ef7e1167ce91
SHA1 9971a38308f9a336b0a7488d3c0ee451ab924104
SHA512 8b54cc761a838717db59fd3c10b47cbc13693e06c0c54d9860ed6aae315eb48581f0279545f17b8f62db3799894109f3562b01e95daa7dc629adfec5de19f8ff
SSDEEP 3072:UzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:KWDfxA3OnjrYQ9EU0/hEV
TLSH
T14CC302A11C36BD660DF8EE99B40D3A60BFF4AD9A91835DC361ED2F0C24FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download