hxxps://gofile[.]io/d/Y9TLsH

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
163s
max time network
170s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/Y9TLsH
Sample260717-trytrafs7p

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	api.gofile.io
38	api.gofile.io
1	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6056	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287787174679559"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
5892	chrome.exe
5892	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe
Token: SeShutdownPrivilege	4624	chrome.exe
Token: SeCreatePagefilePrivilege	4624	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 2024	4624	chrome.exe	88
PID 4624 wrote to memory of 2116	4624	chrome.exe	90
PID 4624 wrote to memory of 2116	4624	chrome.exe	90
PID 4624 wrote to memory of 6056	4624	chrome.exe	91
PID 4624 wrote to memory of 5064	4624	chrome.exe	93
PID 4624 wrote to memory of 5064	4624	chrome.exe	93
PID 4624 wrote to memory of 4552	4624	chrome.exe	94
PID 4624 wrote to memory of 4600	4624	chrome.exe	95
PID 4624 wrote to memory of 4552	4624	chrome.exe	94
PID 4624 wrote to memory of 4600	4624	chrome.exe	95
PID 4624 wrote to memory of 4124	4624	chrome.exe	96
PID 4624 wrote to memory of 4124	4624	chrome.exe	96
PID 4624 wrote to memory of 5560	4624	chrome.exe	97
PID 4624 wrote to memory of 5560	4624	chrome.exe	97
PID 4624 wrote to memory of 1392	4624	chrome.exe	98
PID 4624 wrote to memory of 3732	4624	chrome.exe	101
PID 4624 wrote to memory of 2068	4624	chrome.exe	100
PID 4624 wrote to memory of 3732	4624	chrome.exe	101
PID 4624 wrote to memory of 2068	4624	chrome.exe	100
PID 4624 wrote to memory of 1968	4624	chrome.exe	104
PID 4624 wrote to memory of 1968	4624	chrome.exe	104
PID 4624 wrote to memory of 4652	4624	chrome.exe	105
PID 4624 wrote to memory of 4652	4624	chrome.exe	105
PID 4624 wrote to memory of 1080	4624	chrome.exe	106
PID 4624 wrote to memory of 1080	4624	chrome.exe	106
PID 4624 wrote to memory of 8	4624	chrome.exe	107
PID 4624 wrote to memory of 8	4624	chrome.exe	107
PID 4624 wrote to memory of 568	4624	chrome.exe	108
PID 4624 wrote to memory of 568	4624	chrome.exe	108
PID 4624 wrote to memory of 2572	4624	chrome.exe	109
PID 4624 wrote to memory of 2572	4624	chrome.exe	109
PID 4624 wrote to memory of 248	4624	chrome.exe	110
PID 4624 wrote to memory of 248	4624	chrome.exe	110
PID 4624 wrote to memory of 1552	4624	chrome.exe	111
PID 4624 wrote to memory of 4792	4624	chrome.exe	112
PID 4624 wrote to memory of 1860	4624	chrome.exe	113
PID 4624 wrote to memory of 5096	4624	chrome.exe	115
PID 4624 wrote to memory of 5096	4624	chrome.exe	115
PID 4624 wrote to memory of 1812	4624	chrome.exe	116
PID 4624 wrote to memory of 1812	4624	chrome.exe	116
PID 4624 wrote to memory of 5892	4624	chrome.exe	117
PID 4624 wrote to memory of 5880	4624	chrome.exe	118
PID 4624 wrote to memory of 5880	4624	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/Y9TLsH
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa1ddec728,0x7ffa1ddec734,0x7ffa1ddec740
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,17625187199326188020,17162766479312873330,262144 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,17071820388827036837,2349748621787896696,524288 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,3428013437364222611,9915734174781084220,524288 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:13
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,11584849140054329652,18434451971623267729,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,6921137147895531238,3034043944386505331,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4712,i,7047517450270485165,16608973390291456234,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5212,i,13894669341013765796,17532259324318062513,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,14849658318712107141,8138596052675549887,524288 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5488,i,6093718131806682301,90927471373736939,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5500,i,17800253966303074521,15138451598233611606,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5832,i,18357188329882964140,5909213596013704349,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5692,i,16507797872071492603,11125321816320478484,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5516,i,7271709751506507005,4396438714273603225,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5492,i,16090754132855867508,15261991552831455324,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6108,i,18124761738874127349,9311827327380929443,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6176,i,1045117558066315298,11998094713591353949,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6236,i,15338552739514181003,7696746180320644160,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,16239830939026493664,301269799201923186,524288 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,8539060937277325882,4289437045335413615,524288 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,5972200589620572916,18262894688265889354,524288 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4544,i,8118452601521955511,12338674636573364359,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5768,i,18344149126674446878,2687131274355464404,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5376,i,13505356213440309903,9661242514779375897,262144 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3084,i,12890541690415398088,18200540530089043094,2097152 --field-trial-handle=1896,i,1787230130894173847,299532745592394491,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:5880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 720B
SHA256 41c7f416e4bf4ba1091574d825bd1792423453b68bd4339c4b7c65a29183d4ae
MD5 e7470e09977a4c637b1eace624c7e95a
SHA1 52fce48cb1decc35408894c7f5dc8339ebfc5798
SHA512 1486b381326e4e05fa5edef050616694e1a04c276accc6d95c1516bc52fecf5373e9e043d469826257ae28e046802dbe47271f23f9db89ffc86881c41055da78
TLSH
T1F601676648B581A1D310EA3C92C570A0B4FE97740C370D22702D8DB6E6373806418FDB
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

2d89d20d-7ca8-4b33-bc8c-a4cd0891aba5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2d89d20d-7ca8-4b33-bc8c-a4cd0891aba5.tmp
Size 1KB
SHA256 ac7ddbb60ab6818030943126e141bb30b5f571d36361487104e2291d63ec3f0f
MD5 dd78827e26d0ce4a917ec78bfdf7a10c
SHA1 5e4343fd281df7b7b0136d391855452f37779482
SHA512 13d16bfe814d5566744e551b6bdbc4f4ef6a9c2559106e35a83b33e489afdbf26596605b5a01c8185cfd7c27090776198654b27652b4915908e64ad007de4b21
TLSH
T194416AF3C7D4E97D890156F4A7213F2ACE290D18521C3C27D8D8AE1F57E18B2D24015E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 37b58cc6e93bf5ae8d89629dc12e4a9aeced99ec72665a893c7fa35dbe745868
MD5 c4e3370476e381d21ff00e21ad694098
SHA1 0e914c8670f380847f2ffe16427517f556a80a08
SHA512 ceb41d41f9d76cc2a7a111358bf7a32e8449fbc0298290e1c1c9f0ec385dd51501e96f4ebec1cb07afd05dad764d5c8f51e84f4357b2837a27b5fd65283475b6
TLSH
T17571AEF3C3E8953D891156F8AB156F1FCE691924432C3D36C9D4AE0BA7E2972E20065F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 33f65c29cb21deb6f23aefcbc595d9332a605f44e90c991f48495e0fe162c34c
MD5 a831c9f10c161381bc5bde2bcb78ba2b
SHA1 5a02827e02b79433377360eb035d9daaa2aecdd8
SHA512 af550de02005d00c27a0fc3690a21517b0585bc7fcd94bbd1b091cb367423d34d5bfd93f10559b3e27148c8ab606a94bbdec9427cd00a73d7a342f95de9b2be8
TLSH
T1AB818BF3C3E8D52D891156F4AB256F1FCE691924432C3D26C9D5AE0BA3E2972D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 dae1cc81ea8f49200d328f4433f7bffbd40021547e9a594d6e27f0f096a94681
MD5 2f0a41909a440a854b574529515c2f53
SHA1 f91b621c1f2fd9577fd95587011296ffc8e60b8f
SHA512 0b39baba1f1b1403f254923d340f039473efffe7f5a0e51e516abd0b579a0400269e0caa52efbc29d3a4dc61e4e2a5aac692f9bd3a7b435ba4400605b899a549
SSDEEP 192:pR9FPUov76vAPRp2glY9ZHsb+WNnauQbD2RPGUkwKPFVyIsnAUge:pR9FM0G6XCbwbQ2R7Qze
TLSH
T13332932EBD19697B6DCAC21AFE257B93D7F5002231A42E88E7FC9A2C11D75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 191a3142274ed8aebbdf4ee9494960b6bf4db2eeac6f80cadb7ec7db54ffa9cd
MD5 569bb72355429c70d3cb7b6333459093
SHA1 6a6de402ca03336ebc3ecf326982a16601470823
SHA512 6b0bafbe750f2aa3cd01eb4bae1561301d1cfe5cf0e06f17d8c39113e767301f7ae9ee72f9a2e4398790f4cf4a9341c85169cc3494bde0ad1af121a013cb8374
SSDEEP 192:pR9FPUcv76vxPRpZglY9ZHsb+WNnauQGR6eeswGUkwKNFVyIsnAUgE:pR9FMIGRXbbwbFejUzE
TLSH
T1A242B62EBD19697B6DCAD219FD257B93D7F5102221A02E88E7FC9A2C11E76CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ace7f25b81fc4a82ee687975819ebd50c07a2d0e9eda369caa22ad4970e05d59
MD5 b8701f952344e56212a2fd2ca8c6c89a
SHA1 e216bc27273cebdc995a4592c8915f0947229b0d
SHA512 3b2a5e6b3d07939ced40b90ab6fb251844665177f2807a965033b01c13335ff624e2affc9eb0d6f90d31de6d0640a837f6037c7590c547f6a016bdba9595baf0
SSDEEP 192:ZRSFPUcv7jxPRpZglY9ZHsb+WNnER3GR6eeA8GUkwKNFVyIsnAUgE:ZRSFMIhXbbwwMeAiUzE
TLSH
T1F642A55EAD18697B6DCAC219FD21BB93D3F5102631902E88E7FC9A2C11E76CC321B117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b2e759481ace048220d3dd37144522182d87eaa3daa3462895ce33d1d33468a7
MD5 e5fd62f717dc7f85382b9f498ef49b70
SHA1 ff2e75ba60674c0f46e2992a09a6c8ba495eb69d
SHA512 eaf0812840063c66f80eb2f0ab08be24733122853badef72340585f7ce3183986b7a2d26a853b529f099f815ab584c2191d16da60f4f8f0dbe114aae1822ba22
SSDEEP 192:ZR9FPU5v7jxPRpZglY9ZHsb+WNPAv1ER3GR6eeqiGUkwKNFVyIsnAUgE:ZR9FMZhXbbww+MeqoUzE
TLSH
T1C052B65EBD19697B6DCAC219FD25BB93D3F5102221946E88E7FC8A2C11D76CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 debefcbab2eabfe4fa47e8d3dbe923d1a26f3387b8c78377d45b348d5f824e8b
MD5 bf79518e8c225b781109446d4a03e1d9
SHA1 686c417deed93305bdac3b2d9f8f92429218cc86
SHA512 5b1e50969aa0198725bafc3e67b790efcc84c94c48f6ee7527524af35b61161dbe20e43cb6222a57186f96abecb906d61d3723602e20e700a43407ab1f7eb33c
SSDEEP 192:pR9FPUWv76vAPRp2glY9ZHsb+WNnauQbD29GUkwKxFVyIsnAUgE:pR9FMiG6XCbwbQ25+zE
TLSH
T13042A52EBD19697B6DCAD219FA217B93D7F5102231942E84E7FC9A2C11D75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6489277855a5d6308a162d793f727919d4b1d029863f5c1d14cdda5681ef15c2
MD5 f67929e2a3eeaf60dbe7060a37801316
SHA1 6b350956840da5aa704478a111e806e7345fdefd
SHA512 a49c0e2f6da74d6e448b370764ea54f1081ad80e210e58cdef2b64cd4ced8aad038a4aca7a49102ceeab72c63353fe80942381ab881229c89a14ea1b77f21003
SSDEEP 192:ZR9FPUcv7jxPRpZglY9ZHsb+WNnER3GR6ee3GUkwKNFVyIsnAUgE:ZR9FMIhXbbwwMeDUzE
TLSH
T1C542C72EBD19697B6DCAD219FD257B93D7F5102221A02E88E7FC9A2C11E76CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 9cadfe649db211251961abd5aa98a6e627e971039fc67e690052e383f7885981
MD5 13f4de481965b71b545277fb18fcaff3
SHA1 4f7743199235a69e2e1a78458995bafc90ce9f1e
SHA512 5818e0b0c2d52aaf9e64a335b94a1c3ed1cbdc11c67a3d0e54cfbeea668983fd0842e771d4efdef8e4e602a9fffe01a096cf227397e4f5684e17a109181ed1bc
SSDEEP 192:ecv4K6WE7KxkXqK4I40pUZNCgVLHrKHfFKslEYUWXzKD/ls+ErUkKN9iBWepdsrq:ZvjNE7KxkXqKf/pUZNCgVLH2HfgslGWZ
TLSH
T1DA32C727A88E9A3B4FD8D50CDC166F8BADA542937678092493FF9D0403A57CE114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 41KB
SHA256 ae71ede582c1dfd48e853f51272b614f3408ff3ae7a80dfaa80db9689fc9cadf
MD5 cb437860daf7a970d7d2c53e2aa309d9
SHA1 0818df688a5ff9c8e931b4f6dc0922a0ee0e755a
SHA512 596ef61dafe1e4dae516f9c2d5ea3f2d126c3a9c6006895bab4eb58775c334b4127607f9c3c63a86fa275ed41a0be82ecab6887a9c4db0538bea625555f596ab
SSDEEP 768:gT22OdM0i5YMYk4uCrNB9JrYhIWCg0Soa+YzskbyGmF8JlclGCm:oq+pjsNVr8IWf0S+YTbJ8SlclK
TLSH
T1B513E1A1ECDD5C7E4A2859DCBE03BD63CAB446FB2A057784E3D17E49006A3CD5707229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 08229b6bc0991be0d2428802fcde7af1525fca80b8d9cf7637ebd7639053f1d9
MD5 dd45701de50132175ea8e6d035ecdc92
SHA1 4ea8117028015ba7cceeb3f32ff29f840458fc5f
SHA512 3eda41a6fa81ca81f6abbf59af87c4b138c43f1172d753c58578c557470773145ed49524a3e7515abcc27eb1a9e46233c0c390f591971e1ccf49788373f9d7b5
SSDEEP 96:mbJ0d+x7oIU1fXfBVv1LvSl8h4otop5EQ3D2B69GGfvLXsHCR1bRNC39ISMVNj8p:mt0G7/qff/iU2Hm8vLsHCR1bu8qp
TLSH
T14DC1F975985D9C275EF2F489F1022A53CEB9609B6910BF18EAEE1F0801E76DC1383573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ead59ab41dd35520b16ea7aa2fe2cda47707fd2921453435af2164e711b34eeb
MD5 478b46ffd7494914885a849289d8ab9e
SHA1 03ebea640ef11042ad4d3e9a36d72f280634b6bf
SHA512 081e2d14c06759147014167c0992592e4bf6466416eab5111aca52837818123adbb9f95f022db94af2a61dba05689ebcfcdb77b7c7b4ca0296676cbdf986064a
SSDEEP 96:mC0d+x7oIU1fXfBVv1LvSl8h4otop5EQ8D2B6XGyvLXwqxwz/6M8R1b0j9IiCLIL:mC0G7/qff/iU22mHu5x68R1bUF
TLSH
T1FBC12B71E86D6C375AE3E449F5022A97CFB5519B5A10AF58EEDE0F0C01EB1EC1382532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f636974de1e9f0a58dab86a5928e1719b4649f8b9dd1d2e10b8634ba044b6f84
MD5 fcd70f0d00166afd09980cfcde38d6a5
SHA1 9fee9a46614b55a69597200a658b21e9ba65a343
SHA512 53d32133f2401b0a74c4f3d408b13ec4ae46079932833435ec2bd183e69ec72336172e0c0f3081fd0b3e27bbe17fc87f5c7e291fd77b83e9a626f17e1912dd30
SSDEEP 96:mbJ0d+x7oIU1fXfBVv1LvSl8h4otop5EQ8D2B6XGyvLXwqxwz/6M8R1b0j9IiCLo:mt0G7/qff/iU22mHu5x68R1bUF
TLSH
T124C12B71E86D6C3756E3E459F5022A97CFB5519B5A10AF58EEDE0F0C01EB1EC1382532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ddb284dd6570966feb953ff2eee5107560cd91e05271c03da4592fbac1352e6e
MD5 9b79c8c49d42fca71859cd4e39c9092c
SHA1 79f2c60ebd762f7762d0b5c199511e42f0ab34d3
SHA512 5b8d17f050aa56d39825d96a6300e8b6e77bea6207f5cf6c98b6dceef38cc5a9501a2e5293f29e8ec0bd2022057f486ff1cbbd34555d3ef82d7179ab912aa1de
SSDEEP 96:mbJ0d+x7oIU1fXfBVv1LvSl8h4otop5EQOD2B69GGfvLXsHCR1bRNC39ISMVNj8p:mt0G7/qff/iU2cm8vLsHCR1bu8qp
TLSH
T1F3C1F975985D9C275EF2F489F1022A53CEB9609B6910BF18EAEE1F0801E76DC1383573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e8e41df79ecc2d19f23a9673cc880d9f514748b216266b3469aa9644d7de59f1
MD5 07ca0e3b1eed9bd28d001ac2c4137889
SHA1 043301ff162cafe973feaf48373540a7836fd3d5
SHA512 b22c20c457d1ef168f72bbe599ead6a0e4e3695241bfbaacabdcd5d69835cb16a471e82bfe6e9c1f3080f85f9c5dc4d0105d5748d8f8160a819539d2ee0a10d3
SSDEEP 96:0C0d+x7oIU1fXfBVMLHRDotok5EQdD2B6nGyvLlA1ZbdOv4a:0C0G7/qffEDUD5mvcA1Zbe
TLSH
T1B0A10B31A42D5C375AB2D489FA426A53DFB960A76920EF44E9DE1F0801FB1EC1343923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download