hxxps://transfer[.]gov[.]mb[.]ca/branding/support/en_GB/help/wpf/Content/Online%20Help/Home[.]htm?brand=manitoba_gov&context=/help/index[.]html

Analysis

user interaction
yes
max time kernel
299s
max time network
299s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/08/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://transfer.gov.mb.ca/branding/support/en_GB/help/wpf/Content/Online%20Help/Home.htm?brand=manitoba_gov&context=/help/index.html
Sample260814-sldqysdp21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1740	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311939695210961"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1472	chrome.exe
1472	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe
1528	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 396	1528	chrome.exe	80
PID 1528 wrote to memory of 1696	1528	chrome.exe	81
PID 1528 wrote to memory of 1696	1528	chrome.exe	81
PID 1528 wrote to memory of 1740	1528	chrome.exe	82
PID 1528 wrote to memory of 1860	1528	chrome.exe	85
PID 1528 wrote to memory of 1860	1528	chrome.exe	85
PID 1528 wrote to memory of 3936	1528	chrome.exe	83
PID 1528 wrote to memory of 3936	1528	chrome.exe	83
PID 1528 wrote to memory of 4440	1528	chrome.exe	84
PID 1528 wrote to memory of 4440	1528	chrome.exe	84
PID 1528 wrote to memory of 3116	1528	chrome.exe	86
PID 1528 wrote to memory of 3116	1528	chrome.exe	86
PID 1528 wrote to memory of 4868	1528	chrome.exe	89
PID 1528 wrote to memory of 816	1528	chrome.exe	91
PID 1528 wrote to memory of 5084	1528	chrome.exe	92
PID 1528 wrote to memory of 4896	1528	chrome.exe	93
PID 1528 wrote to memory of 1472	1528	chrome.exe	94
PID 1528 wrote to memory of 4464	1528	chrome.exe	95
PID 1528 wrote to memory of 4464	1528	chrome.exe	95
PID 1528 wrote to memory of 4352	1528	chrome.exe	96
PID 1528 wrote to memory of 4352	1528	chrome.exe	96
PID 1528 wrote to memory of 4652	1528	chrome.exe	97
PID 1528 wrote to memory of 4652	1528	chrome.exe	97

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://transfer.gov.mb.ca/branding/support/en_GB/help/wpf/Content/Online%20Help/Home.htm?brand=manitoba_gov&context=/help/index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba69fc728,0x7ffba69fc734,0x7ffba69fc740
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,2907155417187825879,1708706479276197395,262144 --field-trial-handle=1944,i,14965981301475749787,7371113286095744580,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,14899942350289284338,5026586958457260119,524288 --field-trial-handle=1944,i,14965981301475749787,7371113286095744580,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1460 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,5274150421954845407,17206625438026551592,524288 --field-trial-handle=1944,i,14965981301475749787,7371113286095744580,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2628 /prefetch:13
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,5906100243766879577,6746846326877617109,2097152 --field-trial-handle=1944,i,14965981301475749787,7371113286095744580,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,16520161852162741218,78715088085157057,2097152 --field-trial-handle=1944,i,14965981301475749787,7371113286095744580,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,1185144427935376142,12058999193649989754,2097152 --field-trial-handle=1944,i,14965981301475749787,7371113286095744580,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:9
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,8056008515130128877,8725950964862042796,524288 --field-trial-handle=1944,i,14965981301475749787,7371113286095744580,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,2326111740793730151,9277311310031224127,524288 --field-trial-handle=1944,i,14965981301475749787,7371113286095744580,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,1596484276121554639,13818938871219493635,524288 --field-trial-handle=1944,i,14965981301475749787,7371113286095744580,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,7624295348917474617,13899520800764204824,524288 --field-trial-handle=1944,i,14965981301475749787,7371113286095744580,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5608,i,163532944117244466,3811672804166220482,262144 --field-trial-handle=1944,i,14965981301475749787,7371113286095744580,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=2924,i,15327081855734118055,16793401075543877312,524288 --field-trial-handle=1944,i,14965981301475749787,7371113286095744580,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5520,i,3343188633305464101,18232542465912927254,2097152 --field-trial-handle=1944,i,14965981301475749787,7371113286095744580,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5784,i,2414637577821057823,13593439735290639044,2097152 --field-trial-handle=1944,i,14965981301475749787,7371113286095744580,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0350faa618939ca9a79a5b445fae525286a15b5299b01e1f46d236160616f066
MD5 9242bc31110aa3002fabc5971c0297c4
SHA1 ab23a11e754462261f0abbb757d920875483a9f2
SHA512 f6295216018657eef5db9aaf0e11a4946fd8c67d96afc35fb92313c1e11cea6de001a0f91a472c05197396918ecc5718b77bc55ec727aa19501cf27a510d8590
TLSH
T105E061B5C961EC2F1DFD175890144786D70223073A51894B3B3D920CCFB163B85D6D9C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 4a0eb11c2cac3baef9bff67320a08b239f0a2e56bfff16c888e37ae492636d92
MD5 f87b22e624af5d10c22f7ca34b4ffadc
SHA1 07cd3d46fa557315fd8774201aa3687596e168e6
SHA512 9f8fe9b7da60f45dcc1954a4157381ec156e18bb2c223b9a90a8ad3f5e29a904a163a1ff78ce1fe0da55101dcb57edb7285da586b77d52b71c5d74f055e13e50
TLSH
T191E086DE53D51512DF68D97754510D54E4835E57B2A5DFE338A00C9501EFAE42B110E1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 94147000f1cfd793449ec3d569b4f9015cb4910eb74e08e3f95b7b2869049094
MD5 ded9f6c87697b0f57af277b57f0fd233
SHA1 ac304fc2a7b98590057877dbdb998223a46abe6b
SHA512 4844b0fa41cde15d359191827800887f5bb8dc7192fc22ded2f2bf5aa1175f435929ebd7dac0f3955b4f1b8c24004d39074400b713e5bd5637eb45e857d559d9
TLSH
T13FE0DFDE53993005DFB4117744610D401C83487B83498FE320E00C9B08EA3A42B210D5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8cf25468e8ed4012ce5e94c48f1dfbfeaaead97691da579ad83f0504ae0b6b54
MD5 491e55f81a7561e9c415ab40b0e2b875
SHA1 3f6b17cdb1e564495746e87a9adffb1e673cf6fd
SHA512 c6cbbf1ffc79ab4d74004c44661a7610f1f8cb9a739e0316ea1ff00e05c1d172e1777328c1213bc651d7acbde39b76f82808e6f78cec7bcdc04b956af70906ae
TLSH
T18B4167F7C7E88A7D890092F8AB196E1FCE6D0E14536C3C56C8D4AE1B53E2971D20158E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 93c9de02837d73e6e098db10b45a7ff5e1d5bab6209ceb410f4eb835f9883d31
MD5 2e3550f6312bcec7afbb9eed1ed7df84
SHA1 9712a8650ce2df2575c4c75537239867b2111015
SHA512 d12355d1a69796cbb241a5f2456b4588e5b4aebf0a8bead6826202a452830736f68857ac53ab6049027f7ed4d7a7c92fd8d80849884a95ee8460628702c775a9
TLSH
T15F41ACF783B4993D8A1196F4AB156F1FCE690525532C3C6688E46E2B93F38B2D14068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 96e6073244e8a8548ff0c6938c4ee2ea37705be39f55ce25b13bcb66085dbcd9
MD5 4b5c0825aa729333284b7295f04b73c5
SHA1 96938cdd3fb90adde4e088fe9129eebc0c170a05
SHA512 397b40a284a9cb92c39964a2414709a82d9adc04380822b2e8cc45c263a913f7e137cb5fc43342e3fbb4c7d539e544d55640c85a741fee361b13ba5d8b500675
SSDEEP 192:qRkP+cT4LarRlv7lp5PRp5bc9+Hsb+WNnMTGo/goSn2qgkwNRVyIsnAUgE:qRkPOkVRLXe0wUlgj2qgpE
TLSH
T1D652D87EED11297BACDBD22DFA157B13D3F4102125941E84EAFC8A2C18E7ADC211B15B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 acf55874e6b1982dcecf1b250ba743fb6805a2b29f0cb309b1131fd734677c07
MD5 a340950831e513614f22f9f9acc32d7f
SHA1 861423ab574f5663f3ca6abb81ffc23464a4ccd4
SHA512 f67122ae0a8716ef195adb0ef979b833a9b89ea1bdd43f852f41fa92534cb9ee9d9ee10432c8fcabe6279241a0b2766ff6318a87b329317a8a0a7e16bc704681
SSDEEP 192:qRkPAcT4LarRfv7lpAPRp2bf9+Hsb+WNnMTG2s23Sn2qgkwN6VyIsnAUge:qRkPsk3RUXE0wUI2Y2qgAe
TLSH
T18542E87EEE21293B6CCBD229FA157B13D7F5102225851E84EAFC892C18E79DC311B05B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d000e37389e1f80d47379a36d73cd5438425afd69f65ef618fceaa809ca52319
MD5 11f7f65aac5613a65638c295bd147fe1
SHA1 24ed9f03c6cfa827d4bb3d6790881551a9655b8b
SHA512 6bdd6aed56be6cb6b9b17101b941b11600b0df712a6ceb787c9c449159c5ad9e8f3cb1d8bd4ed3c75cd7c0a3c0b98e4c298ec1f3681d6ced8c135e2a946a4710
SSDEEP 192:qRkP+cT4LarRfv7lp5PRp5bc9+Hsb+WNnMTGIOEYSn2qgkwNRVyIsnAUgE:qRkPOk3RLXe0wU0Ez2qgpE
TLSH
T14852E97EED11297BACCBD229FA157B13D3F5102125941E84EAFC8A2C18E7ADC311B15B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d2e1c31a98df00bb4f79fe3a112ce50dc6af194e21824df4cd870cc84f86767e
MD5 7157f31463a128b0c65c3a64e3f70421
SHA1 755cac54853301cf006ff49b7c346b63f8ba33ff
SHA512 a0666bf75165eb983a1c79d3996f232ed25719079aba9d04675715aa1a50dc83245bae6ae8fb0fc33fe8ecc5ab5930fa25a8df8ff859952bbb16825349db8642
SSDEEP 192:qRkP+cT4LarRFv7lp5PRp5bb9+Hsb+WNnMTGo/goSn2qgkwNRVyIsnAUgE:qRkPOk1RLX50wUlgj2qgpE
TLSH
T10952D87EED11697B9CDBD22DFA197B13D3F4102125941E84EAFC8A2C18E7ADC211B05B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
MD5 9365e110646fce4577746230e9396c69
SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
TLSH
T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 78e58023aad51fc3f13023148c7dab369c899862059432756b6f364999219edd
MD5 ba40db6c6f6d8b3d11705ac47fd0370d
SHA1 0a5ce368230c09f241fbfe7d592051177503e776
SHA512 928a1dfdceaa03cd83b4238f893905a0eaf91d566e2a133335c0389ced5669985378a6466ded7604af7cfdb5c1bafd196aa450ad411ac379f6de0b0156c73b57
TLSH
T16FB0125080017641C80207F41942249C71649F10B60A1B01D3E4A9228C293908918050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58771f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58771f.TMP
Size 96B
SHA256 596844f0f85eab7e9dbdb0f6cae520ff6a11fc74f7b1593a7e2b137113a20a54
MD5 a743e937b7ce5696f88610df17299d7b
SHA1 d421af6ba0fe3a2ebe9aebd92cfddc2b5771185a
SHA512 ca380ff6ad1a55c3bb94cc23c2eca563cf7951ed4e9386d85af130ec96d4bed90546d614004c4b84a97ed8c1ad16f639a662e1807cc0fec8ea2dd98c87fc1fec
TLSH
T177B02288C2022202C8820BB02AA080C83820EF30C2030303E2E82B22FC3822032202B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fb787f173ff7d31c577f26fa6acb2fc1dd11f1e099dc0490cbf1eeab194fab8d
MD5 5d43378867c9e2e2da078c17d36a1022
SHA1 9d0387e5de06a3f019cace979668858aafc6a9f3
SHA512 fd1dec880d95819cd65b4f4c401dd90b6fdd4d25b1580fc7f896d505df13e5eebcbeaa846c76cb779525c5097cbc65f554b8ab3388fcef87a756006e90e0aaf2
SSDEEP 3072:XBRGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:XBAm7Rkm1tYpBeh2BAoa
TLSH
T118C312375E74E8375DB9B75EB08E0B1F1EF149A7C920DE92C8D85B0427EA6CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 02eaf7921cfe29eb5943f0121c749c7ab53ac1d58c2327bd05d91009e44a78e8
MD5 a6a4bcbbdbf7aa85ecd7fbaccb5e6d76
SHA1 1e1d29098baffaf1e60dca8ae5d204281c26e82a
SHA512 422c1f0838ecfbf4e2c94f1761ceaa5cd0e63c5643cd3d056cbbe574d8b5aba52f32aedf75f00240dd0cd23c8f5ac8a71d6667014ec046dff247423fb1954d42
SSDEEP 3072:X54lGGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:X5qxm7Rkm1tYpBeh2BAoa
TLSH
T1D1C312379D74A8775DB9BB4EB08E0B1F1EF149A7DD20EE52C8D85E0423E66CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8b60e233f068452acb7327f9ee237d68b12efe34407840dbd511b067edef2c73
MD5 c03afcec8b20a9d6aa08f13dcb9b6cbb
SHA1 271c6bdf07c29d74940a1f4684b798de81d0d73a
SHA512 7f6f1cde96cd28be0751a663a3105ce26fd5ea09da2aca6f672853fd63877c39ea21dc87c03881c294589529b03f64767a3f211fb9f31731b49f59f35d80bc60
SSDEEP 3072:CGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:1m7Rkm1tYpBeh2BAoa
TLSH
T101C312375E71A97759B9BB4EB08E0B1F1EF149A3D920DE82C8D85B0427F97CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 72eaa9963491d9365fedf50c120c87aec3b689e5b5b85f77e8501c89d7b318e1
MD5 edc7c56aed09a57ee4661c12142c9c5e
SHA1 4f94dd2b74bc862dffeb58ee50ff6ec89c8bd0c4
SHA512 bb625fd5059b7a4e906346396f1c8ff7109074ad9cce3fe15a6d76c9cfc3d71dca53edde24c8b697a4daeb368a83440b3dab60bd4d5af4caed299200581540cb
SSDEEP 3072:X+RGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:X+Am7Rkm1tYpBeh2BAoa
TLSH
T12CC312375E74E8375DB5B75EB08E0B1F1EF149A3CD20DA92C8D85B0427EA6CD1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 da948ba215f38b222baaf743f717d9a161af07f4ec280d5f627251ea66e7557d
MD5 b8c2936ef4fd4bacaca9aa0d719a17b4
SHA1 c92e9eaa46a0066b0c4fc48ded6be6beae10f0fb
SHA512 85b204a2ab30d0a0c33cafa2622a162ac46396b2400e1df7b7141164ce98a5f73f3524f91d17051b4e2443209f5457321629b7e401a2bd14cbe1ab0dc0218dd8
SSDEEP 3072:XB4lGGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:XBqxm7Rkm1tYpBeh2BAoa
TLSH
T182C3123B9D74A8775DB9BB4EB08E0B1F1EF149A7DD20EE52C8D85E0423E56CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download