30ac13bd317d364b3fe4ad42bc45ed418fbe4acac9aa8f376a8a5fcea964bd54

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/08/2026, 20:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DBDCheat/System.Text.Encoding.Extensions.dll
Size 15KB
Sample260807-zshrtaaa68
SHA256 30ac13bd317d364b3fe4ad42bc45ed418fbe4acac9aa8f376a8a5fcea964bd54
MD5 2e2fb3d8fb17d2b9f858cddd8cafa12f
SHA1 4d4c81e30bb1c91dbce44c2a6950ed47bab7c938
SHA512 fc1b6f58c966fccd78024edb2add0edd8d37dbdf919e2ec1e1396d0a431b52fc0bae1d80755ca06a441b0192341afc7047325858585eddeb9babd00d69606d47
SSDEEP 384:7Iv0XhW6YJWa2mNDE2GdC0nWQgmHdpNEx0LSofousWu4BkCw8+:zUnhDGE0nSmHTNEuLSoQuS4f3+
TLSH
T114725C798F6496A2FE669F31D8EAC611ADB5B6C0AC42DD0B204805CD1F037A86F7073D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
31	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1012	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306100425711243"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1588	chrome.exe
1588	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe
Token: SeShutdownPrivilege	1588	chrome.exe
Token: SeCreatePagefilePrivilege	1588	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1620	1588	chrome.exe	83
PID 1588 wrote to memory of 876	1588	chrome.exe	84
PID 1588 wrote to memory of 876	1588	chrome.exe	84
PID 1588 wrote to memory of 1012	1588	chrome.exe	85
PID 1588 wrote to memory of 2520	1588	chrome.exe	86
PID 1588 wrote to memory of 2520	1588	chrome.exe	86
PID 1588 wrote to memory of 3340	1588	chrome.exe	87
PID 1588 wrote to memory of 3340	1588	chrome.exe	87
PID 1588 wrote to memory of 5588	1588	chrome.exe	88
PID 1588 wrote to memory of 5588	1588	chrome.exe	88
PID 1588 wrote to memory of 3852	1588	chrome.exe	91
PID 1588 wrote to memory of 3852	1588	chrome.exe	91
PID 1588 wrote to memory of 2276	1588	chrome.exe	92
PID 1588 wrote to memory of 2276	1588	chrome.exe	92
PID 1588 wrote to memory of 3020	1588	chrome.exe	93
PID 1588 wrote to memory of 3232	1588	chrome.exe	95
PID 1588 wrote to memory of 1704	1588	chrome.exe	96
PID 1588 wrote to memory of 3164	1588	chrome.exe	97
PID 1588 wrote to memory of 1132	1588	chrome.exe	98
PID 1588 wrote to memory of 1132	1588	chrome.exe	98
PID 1588 wrote to memory of 3500	1588	chrome.exe	99
PID 1588 wrote to memory of 3500	1588	chrome.exe	99
PID 1588 wrote to memory of 5664	1588	chrome.exe	100
PID 1588 wrote to memory of 5664	1588	chrome.exe	100

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DBDCheat\System.Text.Encoding.Extensions.dll,#1
1⤵
PID:4464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fff0e85c728,0x7fff0e85c734,0x7fff0e85c740
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,7113941508341558516,11260974880774702048,262144 --field-trial-handle=1968,i,12628111243349608224,13362161343161353112,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,632269005209247580,3990751430203743381,524288 --field-trial-handle=1968,i,12628111243349608224,13362161343161353112,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2276 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,12472175317606566954,1888544807313328564,524288 --field-trial-handle=1968,i,12628111243349608224,13362161343161353112,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2404 /prefetch:13
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,12111670950398441325,2651603385948912063,2097152 --field-trial-handle=1968,i,12628111243349608224,13362161343161353112,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,7755751432162019240,12816327939645881405,2097152 --field-trial-handle=1968,i,12628111243349608224,13362161343161353112,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4504,i,1137038831201395454,14448120823713147343,2097152 --field-trial-handle=1968,i,12628111243349608224,13362161343161353112,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3992 /prefetch:9
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,10382674107444852733,3023363787953172155,2097152 --field-trial-handle=1968,i,12628111243349608224,13362161343161353112,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,16848960324273043137,11074940210126742784,524288 --field-trial-handle=1968,i,12628111243349608224,13362161343161353112,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,14576056055774547848,17185597957858817757,524288 --field-trial-handle=1968,i,12628111243349608224,13362161343161353112,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,5413511134845137456,4252046529465561733,524288 --field-trial-handle=1968,i,12628111243349608224,13362161343161353112,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,126155713989612057,16326641221589668707,524288 --field-trial-handle=1968,i,12628111243349608224,13362161343161353112,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5960,i,12115612364120218158,8259709736546720867,2097152 --field-trial-handle=1968,i,12628111243349608224,13362161343161353112,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4772,i,9800217706041871098,17505081470622509096,2097152 --field-trial-handle=1968,i,12628111243349608224,13362161343161353112,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3316,i,11696280618068242910,41589516379864947,2097152 --field-trial-handle=1968,i,12628111243349608224,13362161343161353112,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 500de31c94451fe7d33e6a3274bfec6a22eacf90cb8586580656bfd82fb9c803
MD5 c12bec3ecc6f17d4be064ea2e8fca354
SHA1 0530b588aee360f0f26991fb447adb1f4736878d
SHA512 f8f8500adf2249c153c9ecccb580b5404e0d6c89afefe4abb0efed5146f2aa08a1d40430678278a31816671e94a4b2f52a95f37c89112f3392fe4c370b377b1d
TLSH
T14DE061A5CD21EC371CFD871860105741E74413173791891F3A3D961C8FF46375159C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d607bca6bd36f41387faba905b69ae9254c49e26198ec2f2a660a352b13bea3a
MD5 d9b9e99687a621d1a24adb4ef4cf8f9c
SHA1 a918aa4930ca2056ec5460180070421dbb6444ab
SHA512 3f787efc90c738b784a94173d3bcc16a3f09be16319ca97db2b3a98e191680fd3bb7ef9455fa2f36b1451858d7767ffcebc9320d6a9762035aebb687f4cd04a1
SSDEEP 192:vRv+I+wuvXAv7lpupAPRp209fHsb+WNnPU0yJeLAEVyIsnAUgtaJ:vRv+U+cZgUXzRws0DB8
TLSH
T1FB42C62ABE14653B5CCBD31AF921B743D7F5112521D41E90EBFC9A2C28EBACC2217517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e0132e0b7e16d78968bc719a52a69f49ae175f7b1a5d3103ab148da02ed8a86b
MD5 b51b4635fd8cf5f770aca3ff8d3198d8
SHA1 9bce90f85369a4e1856b350edf24ec15f1103c23
SHA512 5f6c9911b1f518e6560e6ab503460332518590eada946c74e4a6025f7ce404bf76f97288d7dfeba64adb28293c9ba5d1d8ca7c0819d988827c059f23aeeb3ede
SSDEEP 192:vRv+I+wuv5Dv7lpuhAPRp209fHsb+WNnPU08JeLAcVyIsnAUgraJ:vRv+UC7Zg8XzRws0Jde
TLSH
T1F942C52ABD14257B5CDBD31AF922BB43D7F1112621D41E50EBFC8A2C28EBACC2217517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
MD5 5d35f09b8c86835fb4877dcd0cc40e4a
SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
TLSH
T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d67f83c88fdbf03e479058d7ae2d73b04c0d54caa17cf6495272906e79bcb5cf
MD5 a10274f1f6d1f3b34adccc0063563a04
SHA1 2176e90208015e0a9b85a710a4266204b0a1e86b
SHA512 d73434197e0fd93c20f198ffe01be3d031b28079cf90d35a56e9fcceb7e6d5c74f8bb10c957b6b15010596bc4900a40776d057cf5af57c25bd9744ed2d3e3581
TLSH
T173B0124090016101C05202B0154258C97124AF10D60E170143F0B962C82D5B68015050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e3ee.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e3ee.TMP
Size 96B
SHA256 d08d079c6e9f394a91206b29104c43db2a6353589c54045ebc3fc87b71289b3b
MD5 97bfc5b3974f74049e07b793e073adf9
SHA1 8e6e91c221b260a7f55f6ab6d024ae34d03170aa
SHA512 270bc73252b5353089fcd7080f5f93913d47dd8508ce2826f5c6be4b9f7bc9f0f034e10957c486d690d84869799dae987f8aa430765861741b46138d438d7fce
TLSH
T125B0025DC603B212D04B03B025A595D871B0EF26CA03122396F21F6ADC75A715565574
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 4142f8b89a8bafb84b6d64b3a2736ce511218bab1345cca84b337f0301c0ad97
MD5 f36216f8e05d2f39d2d8af140a22c5ef
SHA1 e7701ba2a9cc64c2622d2de607f20edb4f082181
SHA512 ed1893ad0a40a76c74eaed420b575a23ebd11df5bfbf637753bf64c2d813ce1bfe69a4a30697691e774cac55960a5350b5a418c4701e25afd816ae92e9121020
SSDEEP 6144:TxKcvfHpY1X0AkL69mn8lN/9n9Jppf+zfAk3Wbhj:tKwPyX0Abk8lNVbgfaFj
TLSH
T151342310CCBACEABD4C89A3BA0E667F67F75999427E56483C290B6853F4D71063E4334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 c6aa2539f4adb5a5441471ebe7d28fe4ed2036d968cee7366d0015b7419fd0fa
MD5 9105974a68d40235d763aac7a6c8c571
SHA1 7ff175fd73b93c29eb7f57fbdb2a55c03f91c6b7
SHA512 81caf42b9c4aeed4b400f179831a9a1e2d72077aacd428677b4df1c91b175af7835effdd83db938edc4849c95c41a7e85996a091f99372186d5e10fde6996aa1
SSDEEP 6144:OxKcvfHpY1X0AkL69mn8lN/9n9Jppf+zfAk3Wbhj:YKwPyX0Abk8lNVbgfaFj
TLSH
T16B342310CCBACEABD4C89A3BA0E667F67F75999427E56483C290B6853F4D71063E4334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9f6f5ed155adb8fa4c1044ec78787b8018fc1165c3634e3907755625d1f14bf6
MD5 93763ae493fd0b50855fc31c55496771
SHA1 efb313bd19019242317a547efbc6ae4d546859fb
SHA512 13aa169f0569b11eaea1fe77ac0fe4b65bfb2e25cb7f4b12005676d8ff233e6b7d756b2b5b59b2faf71ed7bb72b958fab32ba0319d340508593f5bc6a8f75a7b
SSDEEP 1536:nYueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:TDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T130B30212CEAACE9BE4A49C79A4C413F3BEBD5F9523F1B9424166E4023DDE7042391770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download