hxxp://quick-excel-7[.]preview[.]emergentagent[.]com

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/07/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://quick-excel-7.preview.emergentagent.com
Sample260707-pcw96aev3k

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3464	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278999131966965"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1864	chrome.exe
1864	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe
Token: SeShutdownPrivilege	1640	chrome.exe
Token: SeCreatePagefilePrivilege	1640	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe
1640	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 4960	1640	chrome.exe	80
PID 1640 wrote to memory of 588	1640	chrome.exe	81
PID 1640 wrote to memory of 588	1640	chrome.exe	81
PID 1640 wrote to memory of 3464	1640	chrome.exe	82
PID 1640 wrote to memory of 1228	1640	chrome.exe	83
PID 1640 wrote to memory of 1228	1640	chrome.exe	83
PID 1640 wrote to memory of 4000	1640	chrome.exe	84
PID 1640 wrote to memory of 3980	1640	chrome.exe	85
PID 1640 wrote to memory of 4000	1640	chrome.exe	84
PID 1640 wrote to memory of 3980	1640	chrome.exe	85
PID 1640 wrote to memory of 3480	1640	chrome.exe	86
PID 1640 wrote to memory of 3480	1640	chrome.exe	86
PID 1640 wrote to memory of 3492	1640	chrome.exe	89
PID 1640 wrote to memory of 3492	1640	chrome.exe	89
PID 1640 wrote to memory of 4600	1640	chrome.exe	90
PID 1640 wrote to memory of 4600	1640	chrome.exe	90
PID 1640 wrote to memory of 2328	1640	chrome.exe	91
PID 1640 wrote to memory of 2328	1640	chrome.exe	91
PID 1640 wrote to memory of 3452	1640	chrome.exe	92
PID 1640 wrote to memory of 2476	1640	chrome.exe	94
PID 1640 wrote to memory of 1004	1640	chrome.exe	95
PID 1640 wrote to memory of 1804	1640	chrome.exe	96
PID 1640 wrote to memory of 1864	1640	chrome.exe	97

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://quick-excel-7.preview.emergentagent.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffbb61cc728,0x7ffbb61cc734,0x7ffbb61cc740
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,4577674913650032890,13922476011572445839,262144 --field-trial-handle=1924,i,11843799465949873811,9443105679600340008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,7830837873532612233,5821848538124936301,524288 --field-trial-handle=1924,i,11843799465949873811,9443105679600340008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,10008808453175525475,10692635386497908309,524288 --field-trial-handle=1924,i,11843799465949873811,9443105679600340008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2672 /prefetch:13
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,3565929795995725614,11599075384410882103,2097152 --field-trial-handle=1924,i,11843799465949873811,9443105679600340008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,6666805838012924310,13463187479856099863,2097152 --field-trial-handle=1924,i,11843799465949873811,9443105679600340008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,5741496435693988948,9701065901313930927,2097152 --field-trial-handle=1924,i,11843799465949873811,9443105679600340008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:9
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,11704937166052627106,2457477690030265502,2097152 --field-trial-handle=1924,i,11843799465949873811,9443105679600340008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4888,i,11809156845964238015,1740290990840439627,2097152 --field-trial-handle=1924,i,11843799465949873811,9443105679600340008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3240,i,16808860231353219382,12489205350879376704,2097152 --field-trial-handle=1924,i,11843799465949873811,9443105679600340008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6336,i,9418308774835434225,7850330882986514287,524288 --field-trial-handle=1924,i,11843799465949873811,9443105679600340008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,5135325395046142286,17951128190516663208,524288 --field-trial-handle=1924,i,11843799465949873811,9443105679600340008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,3523733087352071561,7445430995458964816,524288 --field-trial-handle=1924,i,11843799465949873811,9443105679600340008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3328,i,11920276926952141566,6267826703062383654,524288 --field-trial-handle=1924,i,11843799465949873811,9443105679600340008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6376 /prefetch:14
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6260,i,6798320590307999164,13115956505164922302,262144 --field-trial-handle=1924,i,11843799465949873811,9443105679600340008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

58ca7c78-cbf7-44e1-8994-45f7844b6fcd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\58ca7c78-cbf7-44e1-8994-45f7844b6fcd.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4f1209129f68248783ad23dc57d292243c07fe9c0142580bc164f30a74aa237c
MD5 3f23a25652bc0eda71955bbf8ec8d3c4
SHA1 8634cb583eb92673b2e4c39ae58818a2b885ce72
SHA512 b6259c0bcc926c63993c6e8c4111fbacfc3dec7eca9ae91791c77b5c55295eaa173f59b1d7c2670bef451bb2be568a568946315c8842f191209acb9a641acac9
TLSH
T10FE02BA9C812DC3B18F90B1C60500746EBE123A72B418A4F3B3C9209CFB5B36059586C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 6e4b27250865589f5de1c5e317751420ec802bb71dea318014559e3923017335
MD5 e9a43fb8294a075bf5816cd655be5fe1
SHA1 5571b56ec352bde07547cadf6b11ff2f91302259
SHA512 8daac5065dbd479d5f485efe889e4ab9b7738c5810dd8401c38efdf43d85a9a03b3306b9a97d9658a6115bef54501a93ceba9aa60134416d8d6aa8e4b171d399
TLSH
T18C31610DCBCD54DBFB1069F124D88890BE78D894313F0E9A48D2D8B9A0527E052F2494
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 4105716afbecb1c52945d295178d44fcd5de357e5b083b62c71f42dca3e6295a
MD5 08551edbdbc0c988f9d252f288854726
SHA1 27f56e9666e0e6d775189969a4546576bfe279ae
SHA512 1131191a8485616697fa3921e5d9958ff2febef168761ac819ab33c55952c9e16c37dd0e845d3e26b1df4deb4e7c868fe34a18eb8714d8cbadb7a748df007585
SSDEEP 192:D77IuUOQ0caIaEdSSi+WLMkt1x397agw4vxyPdnRx+UMt7FHjn42J6wGZZf7h0Gi:D77IuUOQ0caIaEdSSi+WLMkt1x397agd
TLSH
T13432AAFB83A4463DC90192F89A346E3BDE3905A413DC786689DCBE0FA3F1522E18554F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c97e36df21205567c2196a13a6a3b397ce950ebfa2519a41c98478689a671690
MD5 095e401cd37750a22a7b8feec19f0b42
SHA1 b40603b0885ce4ee66303623e858355ee634d772
SHA512 b24f6832167a426271ad30692ffb5bf3e3b4d432b52a150d8578068fdfae9c71a4c0b647573d127c6fb27b58674a1da49692432eb6dd654f360c7c789af35b88
SSDEEP 192:4RdesTgAFv2bVF7xy1CyoAv7dpAPRp2cS99Hsb+WNnt9uB8T25/Wkw0/VyIsnAUp:4RdeMv2bVF7xy1CyocZUXkrwP/2lWge
TLSH
T10142D62ABE10697B4CDBD22AFD653753D7F5106121901E84EAFCCA2C16E79CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
MD5 c23047ed70b8fe98404f2d539506eb71
SHA1 777411f14fab3beefe67a6f475f14f7e6e56c013
SHA512 0a47725dfc0cd3a51a0c13fc01329dccf73a0e6fe775075f027ab629f4c8fde68db8b61d4cd2ce4269a02632bafb0dcbc043ec6377186b9c4b1d39ea91b3d0ec
SSDEEP 384:8mjoj7KxkXqKf/pUZNCgVLH2HfgslTg97pLuLcSjuvXODof+ErU3i4JHGtovIld:8Goj7KxkXqKf/pUZNCgVLH2HfgsZg97V
TLSH
T1C77208676C4C9E370F94CACCD8167B4F9DB5014B65EE886483FA982903D5BDB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b0e91d4945acfe6e5b7da9cb83a2ff96f31e14e2a561b34644c19db60740f6ee
MD5 13fa6457f7589572ee50e7a57c2e8be4
SHA1 a51282d3e41d8f52883ab9892c7d0227c52f24cc
SHA512 bc7b4f3bfa7b2b2786cd003d1e7f1dbb07dbc2d3ac1bf62a1ffa1c7efa5bdab65637a0705b89ef67fddd389de611cf4d9765e4312a8f2a94bbca9a58a6d51384
TLSH
T1A9B012408041D142C40206F4118214C8B178AF10AA0E170143E06D2288295518534050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c704.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c704.TMP
Size 96B
SHA256 3729df66bc85149ed8cefd037b29c7a4d36d10ed6ae4bb51ca82a58a083a4434
MD5 3afdcc56de3426d8bd003637eb779616
SHA1 8957d93e1076d711001d300c3900e5a2b56d9ddd
SHA512 7c89a40aa75f15a19cd14b890e8b5da38c8f173d640700f2d0a3fb5dce327d17ff94d275bbd4ac23506e40729da28ea2e348095db589a647b8316671cb7b2bd3
TLSH
T1BAB00295C3537252E04243B029E6D9D871A0DF26CE0352AA96E12B66DC297604525664
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7c8049d4611bcdaeefbe3193061ac1b93a872fa60fe4ed953edd3208c3deafa7
MD5 cfd25b16969289b86a9655c49dd33934
SHA1 e2481233f2fe5034e29f1bec13e0cb112ccc2d75
SHA512 831816058f14b542060d435aa01a339e41a178ab88285d89efe2962519f1e375bb9ac4beebde767af1ce45c7a1dfe85fe409a1d6ccba902ae49514b57d310b65
SSDEEP 3072:Gj3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:Gj2m7Rkm1tYpBeh2BAoi
TLSH
T17AC312379D74A8375DB9BB1EB04E0E1F1DF14DA6DD20EE52C8D85A0423EABCC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bdbee72fa3ffd9cf0ae2788359cc7c90b0dea9408de87f7dce304af414dc4be9
MD5 d9fcd49f1a442f3049f3750d36b78a78
SHA1 4fe766b439538bb9976e256f5e844c2dc5e91043
SHA512 5f0278f0f38107edaa0405dec2694f65189f8dc5a2d83f287363b47aa84a2ed76ca67f6ca352f4cf5a94625b8786187b9c34eab2027ea8c938fb4881c112b45c
SSDEEP 3072:n0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:n3m7Rkm1tYpBeh2BAoi
TLSH
T107C312379D75E83659B9BB1EB04E0A1F1EF14DA3C920EE52C8D45B0423EABCC0A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4739f67a83c22026e9c0209cbde3871bb031a1b0cbcece332379a3f0b825954d
MD5 03a1cae7b5f0e620d605aeb2c7e8c9d8
SHA1 6208d9b1072aefd6fe2803a485964c08de70aa60
SHA512 53c24cec16b8a601b88267541f384af85e8df21193a23ef967a02d16b6b13ed6ab740a66d686340b56457d51b42e3d482bd9f9edecf74cd28c32b86f1f4f8a57
SSDEEP 3072:E0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:E3m7Rkm1tYpBeh2BAoi
TLSH
T182C312379D74E87659B9BB1EB04E0A1F1EF14DA3C920EE92C8D45B0423EA7CC0A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 76748dee7776d74513a2db92345a5011448f31bd5b287e72e3503a537b521849
MD5 5a4f026303b6221715947440c8833308
SHA1 a64618440182303d4431baa88e0a7dfee47410d9
SHA512 d08e9831eee0064c6c5e0516c4cd7fe8561ff46c2a851c0e686c194a3b33190bf6720fad906d399259455cc2a7fb04323fabde38c8a675365980772f4b216d9a
SSDEEP 3072:OGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:Jm7Rkm1tYpBeh2BAoi
TLSH
T142C312375E70E9365979AB0EB48E0B1F1EF14DA6C820DE92C8D85A0437EA7CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download