hxxps://gofile[.]io/d/BocnhV

Analysis

user interaction
yes
max time kernel
135s
max time network
118s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/08/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/BocnhV
Sample260804-trxlpavbmb

Score

8^/10

discovery persistence pyinstaller ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
28	1708	chrome.exe

Executes dropped EXE 4 IoCs

pid	Process
2180	zeogen.exe
1948	zeogen.exe
5004	zeogen.exe
4420	zeogen.exe

Loads dropped DLL 12 IoCs

pid	Process
1948	zeogen.exe
1948	zeogen.exe
1948	zeogen.exe
1948	zeogen.exe
1948	zeogen.exe
1948	zeogen.exe
4420	zeogen.exe
4420	zeogen.exe
4420	zeogen.exe
4420	zeogen.exe
4420	zeogen.exe
4420	zeogen.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
21	api.gofile.io
23	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000700000002865b-137.dat	pyinstaller

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1708	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303339035978342"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2428	chrome.exe
2428	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe
Token: SeShutdownPrivilege	2428	chrome.exe
Token: SeCreatePagefilePrivilege	2428	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe
2428	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2168	2428	chrome.exe	82
PID 2428 wrote to memory of 4276	2428	chrome.exe	83
PID 2428 wrote to memory of 4276	2428	chrome.exe	83
PID 2428 wrote to memory of 1708	2428	chrome.exe	84
PID 2428 wrote to memory of 416	2428	chrome.exe	85
PID 2428 wrote to memory of 416	2428	chrome.exe	85
PID 2428 wrote to memory of 2244	2428	chrome.exe	86
PID 2428 wrote to memory of 2244	2428	chrome.exe	86
PID 2428 wrote to memory of 3788	2428	chrome.exe	87
PID 2428 wrote to memory of 3788	2428	chrome.exe	87
PID 2428 wrote to memory of 4992	2428	chrome.exe	89
PID 2428 wrote to memory of 4992	2428	chrome.exe	89
PID 2428 wrote to memory of 2172	2428	chrome.exe	90
PID 2428 wrote to memory of 1936	2428	chrome.exe	94
PID 2428 wrote to memory of 1936	2428	chrome.exe	94
PID 2428 wrote to memory of 1056	2428	chrome.exe	95
PID 2428 wrote to memory of 1056	2428	chrome.exe	95
PID 2428 wrote to memory of 760	2428	chrome.exe	96
PID 2428 wrote to memory of 764	2428	chrome.exe	99
PID 2428 wrote to memory of 4860	2428	chrome.exe	100
PID 2428 wrote to memory of 4168	2428	chrome.exe	101
PID 2180 wrote to memory of 1948	2180	zeogen.exe	106
PID 5004 wrote to memory of 4420	5004	zeogen.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/BocnhV
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff9873ac728,0x7ff9873ac734,0x7ff9873ac740
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1780,i,10375858884885604284,14691711099765009634,262144 --field-trial-handle=1844,i,6756058207780381765,13701800207436691969,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,3995942828296389033,15263496076274268282,524288 --field-trial-handle=1844,i,6756058207780381765,13701800207436691969,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,5001881577376914244,16669145440817265181,524288 --field-trial-handle=1844,i,6756058207780381765,13701800207436691969,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  PID:416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,10102219723521515690,16020008814858852045,2097152 --field-trial-handle=1844,i,6756058207780381765,13701800207436691969,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,3192487661465723772,2934206306612761972,2097152 --field-trial-handle=1844,i,6756058207780381765,13701800207436691969,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4380,i,9555160082312913807,9469878459828912703,2097152 --field-trial-handle=1844,i,6756058207780381765,13701800207436691969,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5256,i,18443225359371037840,16777337997157640560,524288 --field-trial-handle=1844,i,6756058207780381765,13701800207436691969,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5372,i,3427790653088619688,13953983191833194178,2097152 --field-trial-handle=1844,i,6756058207780381765,13701800207436691969,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3228,i,854141238594610113,7885775630160966164,2097152 --field-trial-handle=1844,i,6756058207780381765,13701800207436691969,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,15948779623513690904,585673041946266117,524288 --field-trial-handle=1844,i,6756058207780381765,13701800207436691969,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=500,i,17103636898282187007,11257329156025198946,524288 --field-trial-handle=1844,i,6756058207780381765,13701800207436691969,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,1005611164563522227,9823419317997386213,524288 --field-trial-handle=1844,i,6756058207780381765,13701800207436691969,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,14857419646988588518,7316727946177109951,524288 --field-trial-handle=1844,i,6756058207780381765,13701800207436691969,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4836

C:\Users\Admin\Downloads\zeogen.exe
"C:\Users\Admin\Downloads\zeogen.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\Downloads\zeogen.exe
  "C:\Users\Admin\Downloads\zeogen.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1948

C:\Users\Admin\Downloads\zeogen.exe
"C:\Users\Admin\Downloads\zeogen.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\Downloads\zeogen.exe
  "C:\Users\Admin\Downloads\zeogen.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7e1e3c905924a94729fa0e85975f2ac29dd5903703e58c0e774828ce72a65298
MD5 31c5e5f6dc132ef6a40b41c0faa8a9cc
SHA1 62759a86c640d11cbbe8703e3b62e389940b11c9
SHA512 889e796282167565a491b36f05e8934e482a6a0e464626c0c578fe50671685d08ac2f443cf992c5e43bd9e69de8a1ad856158e50470ffaa48618a15f17127b42
TLSH
T14FE0ABEAC812EC2308FD07281088A642F250174B2A41C91F7A3CF40C4F71B7A4542C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 acb0052dbcfed805e799eaf53a1e08ee139eddbf1dfa7ba274693efff0c7ec0b
MD5 fcdeff60ae0ee36a6c31e0d6f769209f
SHA1 786db551348d90660febe272678467b24d1191eb
SHA512 4363c757c3ab3fa6181f7506542b3ab5bd5268ba2eb2f64189b3a478548435d753b4e927d7df7605ce08bed1e0dadc5d6d17cc3949fe68d0a4cec7b79e1815bd
TLSH
T17901ABDA49999295C7E82A31A2E6B1A2F43FA72303030FF15001FFBCE428B812064358
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 918352a5938185a52f38e6ffc4597e8570bd1b0c0b4de478a85798b7ae88a419
MD5 b60dbf67f701b7126799bfbf36025316
SHA1 184ed90aca5db5cf3f80e7fcee2f3ca233fd8e30
SHA512 2afd8af1701674575e79a224456c577f7dc99f9ba0e0b5db5b92762024f38a3b6689132b031a050badece58e5eab7eae454a45bd9363cf95ed3cf0ab23cfe5ea
SSDEEP 3:MsEllllkEthXllkl2zEkl50y:/M/xT02zn
TLSH
T1884404447FC00405C50010304031C3F04370F51005115F7334510513DCC7F501C05004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bd165628e09c1aaf70fccf27a8b8f51c96cfb1d3d9a0b8e100744fd3164f827d
MD5 7fea2df0060db1f0fde7052cb80103bc
SHA1 007dc1b307a37ab7cfd63d501fa0026abe1638d9
SHA512 b4879e41c226635127bef35709c5327e1d8e79b33fa94156df7fa80b3299ad567c2a4de41a39883f9f875e5adc1ebfec3d0492d3ec5dbc8137a5d83809b8b2f5
TLSH
T1B1419BF793B8997D8A11D2F4EB156F1FCE680524432C38AA89D06E1B53E3972D14474F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1024B
SHA256 fe2004bab25054778f7ecaee427f198a92101cd69a0f13d446cd977be6cc6fb2
MD5 eb3d64a4cb4291bbb815b712a4f29de7
SHA1 eba2e8426346fab7733f53b191b15ae0e49a978e
SHA512 821f032460a2930757c35ebdc2d80e3b88953582b38aa078f2c3681ab25f5af004e1081a30d62eadcfe472576098d7e37bdbc4f29d0905f8c1eab6a1ddb18643
TLSH
T1B611AFA3977D785B603D087F2F08780E3CBBA432068168F9DA2A816DB0858F71B07017
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cbaf71b2db4819bb841369826c69c36c7aa11f84ed9789c24c0f6fa0d42c5f77
MD5 e48682cda75899466b9ac691451b3851
SHA1 a57b2543d11ad194deb89a7abb9607060bf8d86a
SHA512 c06fa2b2635d155ed58db3fd0d6810f39a10adb0f7220642c9a8fc8e06931dcfb255c4d87e051830583bb4999af909fcac155f938b9e15888b2c97c2b2cfe9d0
SSDEEP 192:ERKuYI/CKYl9Qv7TpAPRp2v99Hsb+WNnDYP5kDz2Ykkwt2awVyIsnAUge:ERKuT6DM3UX4jwkPeDz21N2a0e
TLSH
T19542C73EAD10793B5CDAC22AFA667753D7F5202126D46E88EBFC8A2C15D75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 160449b3d8b28f6b9b3b12aaccff2dce80974577dca6133217e8b2c2d8fe3c19
MD5 f18299b2bb16676907911a6e0d33199c
SHA1 59ae19fa5d86923e7b45702572f5a773a4eb87fd
SHA512 bc9f61bd9154fd8b57069f47466b4c52b485f5f108802435c6963efade317f80a8429b7b2c924aeb02896e44c33ce5dd93a5fcc1e931b734aad4b3c2f9c4337a
SSDEEP 192:ERKCYI/CKYl9gv7TpAPRp2dlB99Hsb+WNnDYP5kDz2Ykkwt2awVyIsnAUge:ERKCT6D83UXOjwkPeDz21N2a0e
TLSH
T18C42D73EAD10797B5CDAC22AFA667753D7F5202125D06E88EBFC892C15D76CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 eaf9eba7304984bad30cac311978237e731fe9ea12447f8ed562da8c8f8c53d8
MD5 ba72510175c7933a6e0dd08584186757
SHA1 08cd142a03dc6fc3bb6e742a7adbe4edb527b2f6
SHA512 19792cf5782f8a4b58524b19ec22af51029363df4660ef18f2b5f1ccb82b5739c89f956cc4ad66c328f62ea473f3dc56a3290d03c25b86303621e27527321426
SSDEEP 192:ERKCYI/CKYl9pv7TpAPRp2dlB99Hsb+WN0aLDYPZkDz2Ykkwt2a5PyIsnAUgE:ERKCT6Dp3UXOjwloP+Dz21N2atE
TLSH
T1B452C82EAD10397B9CDAD22AFA667753D7F5202125D06E88EBFCC92C15D76CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 347d73ba7d38af83ac3d460ce8c2dd97cabdd4c55b65412cd8b887fb45b65b38
MD5 871109c95d991c94717364d65631baf0
SHA1 fc56f3d2f1b22d07cb19c827684bb9fb264712aa
SHA512 3ade27ac0b79ef313d66bfd054d6fd2751cb9827493acd598ed9e782f0d4fcd111331893c5c70bec25cf3d8785027f9de5a781447cdf6e3bd8e08cdce6002844
SSDEEP 384:IijUn7KxkXqKf/pUZNCgVLH2Hfgslk+n7pLuLcSjijXODUL+ErU3gRnHGmvcrBv0:IiUn7KxkXqKf/pUZNCgVLH2HfgsK+n7D
TLSH
T1A27219776C4C9E370F94C68CD8277B4FADB5025B65E9886843FA982903D5ADF010A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 aa20238ab62b62b3969d96495ef4f680d63b153fada22186526bb92e80f7ee2c
MD5 0614036caaec72eeed92779aca10719c
SHA1 eaefc322054b07def681be27bfbdb59eda649e59
SHA512 e6fbe93874987a32692c5c04072a10432d6a6f6b65772b8a46ffab475acea2e6c3b10a345ea813f568ab0248ec3a8141a8852f9ffe74d50e96600607fcb246db
TLSH
T133B0124080419641C45346B461A624C8B12C9F20D70A174143E4AE62C8251618028160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585b89.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585b89.TMP
Size 96B
SHA256 66cab11a11f161656321e8e09f70a79c1d6953000ef9911111a6fde8b1aeceff
MD5 129921e642b4a49a4770565519b39b95
SHA1 a8bb419103e26b005fba653018e49c1d606521ed
SHA512 28c144e11566a9f1ae81d4c0762639e5b8123b7cc68ef910cab026f893772dae70a124898f8668a9f734c0730b7167f58e0ae88be4de6eb932e1472aa71160c6
TLSH
T1CBB022C2C00B2202C8AA23F020C280C83030CF20C3030202C2F00B2AEC203F00A20030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 989064ebce876bdcc457b4ece3aa033ac1e89b3be97081f2917e52c9b4a09108
MD5 342f570e45d97b0f5e8b42c0858787cb
SHA1 4395c451217ee178d94e3ad75e09aeb2cd66f5f7
SHA512 abd1d4b3c7007744db31ab05730dc4337b5cf092da6b9b5ced0ab158322fbd6fdc80ce22b580aea02cade570dac66678476e6181302597e5bce7e70648d52c20
SSDEEP 3072:Ix9w3LffUnBKU/F8enCW3iyVEXGey0cB12:Ixa3LfqBZqenbyyVEd1cB12
TLSH
T174B31221E4A6FF6B9275572AB50F93295CD148FB44E1E788443C2F19E0CA388EFA8D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 aa909c49beb751f3425ad5d7047b1377de9dc622e2cd2c09fc949d9499ff8ec1
MD5 07f7cc8fea80004272a06c5f94ef25b7
SHA1 c69d00112b4d526960ca4dac2de1a32778b4eb54
SHA512 fa955a5a76eb79cfa08cd349b07df73d4abf32cf5a714f669c00132788c82c135d369f38e970c9bb60fea0220b4eb42ecdbf0a9655a14fe91434a4b0046904ed
SSDEEP 3072:+xMw3LffUnBKU/F8enCW3iyVEXGey0cB12:+xf3LfqBZqenbyyVEd1cB12
TLSH
T1B6C31231E4AAFE67A2A55737B50F931A5CD148FB44E1E788443C2F1990CA388EFA9C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 90e9a37e434588cea568090345694c2d2c74e3cf160e68abb3779dc79900f326
MD5 1852eddd8bb14dd0c97d7126500bb630
SHA1 769bd9355cde37f4b6328f363bb7ad13396d95c7
SHA512 0e8e37ae5d420747cc1f5934e59c473e3dee58abf2efa488e2c51018ebd5a7d0020b8490127e1d4615f12cad3e7e78e9263744e17a712c8061460ccb44cd8863
SSDEEP 3072:fxpw3LffUnBKU/F8enCW3iyVEXGey0cB12:fxG3LfqBZqenbyyVEd1cB12
TLSH
T154C31231E4AAFE6762A55737B50F931A5CD148FB44E1F788443C2F1990CA388EFA9C45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21802\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21802\_ctypes.pyd
Size 124KB
SHA256 11daef02afe45d9f3987bab5c2b6ef75b2b6f6f79704c45675d532f090f14b8b
MD5 38d9d8ed2b7df64790150a2a523fd3b9
SHA1 a629c8e76136fa5678c758351e2dcff5324f51e7
SHA512 7a37a98bb9824680e3f0030e0db795f9eab1cc4d2b6605e4f6c37d432b4de0642481dd7b6c6f0e53264f2d940b4800555ab0d84145d7de35f4a65a26ca100fe8
SSDEEP 3072:ys51kM2JpMk49dWZKrcsaIopJfrZquAAIZI5QP1y:tnkMoOwCcDfrZgAIg
TLSH
T11BC35A1B339400AADA678178C4B35F17DBB2B412472187CF0294C69A2F637E27E7EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21802\_socket.pyd
Size 78KB
SHA256 a611e9b4f4e5fe67e945b771d79cf15c48441ecfa11ce186cec9bf233dc20c0d
MD5 0a6c6fd7697e4c3757014fa6bf6dd615
SHA1 f14f79831b8b16a7b31f4c7f698317c023d446f9
SHA512 f5fcfede06f0f81229b946f803b6e292fd0c909191f3c2a82ca317ff7c2e08d1ea98aa2d11ec85edd5449994a2a7c61318a15d47806cd761e25739494f3e18e6
SSDEEP 1536:GBCJoimjxvExWxAm9/s+++pJj1XmrpZxP4cZI5Qw47Syo:dai6lfAm9/sT+pbmrbjZI5Qw46
TLSH
T1E4835B01A6A051B9D673C0B6C6678F23F7B0F4801394A38F5164DA6E1F23782AF7DB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI21802\base_library.zip
Size 782KB
SHA256 5449b83d63a75a618e4cd2272324cde2e61d496739ecd7c30ab2e6fd0d9b29d1
MD5 37e2b50a4192ab7050b734ebe78148f2
SHA1 1e00d03a54bf0ab67b9540c02af4191b00ada77a
SHA512 a7df4cc841aa114bdebc48b70d6a18e4db660427cc6d120344830f88630b9497d225e8fcbbf3d4d81c0f9e310c326d90eebd97abc97bbbad9c6d53d6c8feb974
SSDEEP 24576:TK73aOmQcosQNRs54PK4ItwVwHLfVEpGLSCU:TK73aOhcosQNRs54PK4IL0
TLSH
T188050840BAA25ED7FD09F27D412ECA1C0A6A5239DB49D103794FC3983F4B3E41E36A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21802\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21802\python39.dll
Size 4.3MB
SHA256 f4609ec3bbcc74ed9257e3440ec15adf3061f7162a89e4e9a370e1c2273370a1
MD5 19e6d310c1bd0578d468a888d3ec0e3d
SHA1 32561ad9b89dc9e9a086569780890ad10337e698
SHA512 4a8332c22a40a170ea83fc8cfd5b8a0ed0df1d59fd22ebe10088ba0be78cc0e91a537d7085549a4d06204cbe77e83154a812daed885c25aa4b4cb4aca5b9cc85
SSDEEP 98304:Grk4ZPyKFv2bwgdGGtudvURuHRMXIwzXT:GrjZKKFehdGGt5XlXT
TLSH
T1D4267C22639411A4DAB79477C5278706DBF2FC502B20E34B41A4BAD52F73BA316EF706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21802\select.pyd
Size 28KB
SHA256 cd31f9f557d57a6909186940eafe483c37de9a7251e604644a747c7ec26b7823
MD5 196c4d2f8bdc9e9d2dbcce866050684c
SHA1 1166c85c761d8188c45d9cc7441abfe8a7071132
SHA512 cb9a02530721482f0ff912ca65dae94f6930676e2390cb5523f99452174622d7e2e70cafaf46e053f0c3dfc314edc8c2f4fd3bc7ea888be81e83ff40d3a30e78
SSDEEP 768:g2YyAU1265whJBHqgORWZI57GZYiSyvwhT:v86Gh/KgORWZI57GZ7Syo
TLSH
T14DD25C52AB6464D6EA638170A8D15F0BF83475174710C3CF2369C26A1F227C1BFBE3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 550766.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 550766.crdownload
Size 6.6MB
SHA256 43717d6c756379b64d7f8289e2bcd7a585ced7fcde720db6171a190de648dbd2
MD5 c6c519e43407eaaaf240077f1e8fa418
SHA1 d5b20223f96619e997ab58d5e98cd10322a2abd3
SHA512 db7c66076db109c245104b90e82cf9bb2773e9d501501e752bf91fd3b59b03f2d1c33afd1f86f558f2930f4aa80a2a2aa449ea4d4a588bf12b06cd3d2fe870a6
SSDEEP 196608:8T6DSL2Vmd6+D0JJVAzDaku99mEQcy6d/AyfRL6:PSL2Vmd6m0JJVAzDakArZd/Ayf
TLSH
T19C66334477403DA6E0BB1032CC518132D537BD266616C9DB87B889626F1BBF26D3AFE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download