hxxp://gofile[.]io/bvgG56

Analysis

user interaction
yes
max time kernel
899s
max time network
897s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/08/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gofile.io/bvgG56
Sample260816-vm19ras1bv

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2704	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313736517865380"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
3584	chrome.exe
3584	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe
Token: SeShutdownPrivilege	4188	chrome.exe
Token: SeCreatePagefilePrivilege	4188	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe
4188	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 3436	4188	chrome.exe	80
PID 4188 wrote to memory of 2704	4188	chrome.exe	81
PID 4188 wrote to memory of 3140	4188	chrome.exe	82
PID 4188 wrote to memory of 3140	4188	chrome.exe	82
PID 4188 wrote to memory of 3660	4188	chrome.exe	84
PID 4188 wrote to memory of 3660	4188	chrome.exe	84
PID 4188 wrote to memory of 1480	4188	chrome.exe	85
PID 4188 wrote to memory of 1480	4188	chrome.exe	85
PID 4188 wrote to memory of 3736	4188	chrome.exe	86
PID 4188 wrote to memory of 3736	4188	chrome.exe	86
PID 4188 wrote to memory of 2900	4188	chrome.exe	87
PID 4188 wrote to memory of 2900	4188	chrome.exe	87
PID 4188 wrote to memory of 1960	4188	chrome.exe	89
PID 4188 wrote to memory of 1960	4188	chrome.exe	89
PID 4188 wrote to memory of 4452	4188	chrome.exe	90
PID 4188 wrote to memory of 4192	4188	chrome.exe	92
PID 4188 wrote to memory of 3340	4188	chrome.exe	93
PID 4188 wrote to memory of 5068	4188	chrome.exe	94
PID 4188 wrote to memory of 3584	4188	chrome.exe	95
PID 4188 wrote to memory of 2008	4188	chrome.exe	96
PID 4188 wrote to memory of 2008	4188	chrome.exe	96

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gofile.io/bvgG56
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbef8ec728,0x7ffbef8ec734,0x7ffbef8ec740
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1992,i,2675346682133496882,8282642346287630432,524288 --field-trial-handle=2072,i,14054434720355224502,12591720480928827437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2172 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,11427311307640192726,8799256422016533871,262144 --field-trial-handle=2072,i,14054434720355224502,12591720480928827437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,13293937781361522837,10938682822317609312,524288 --field-trial-handle=2072,i,14054434720355224502,12591720480928827437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2524 /prefetch:13
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,7775359144444546720,16680746476934467907,2097152 --field-trial-handle=2072,i,14054434720355224502,12591720480928827437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,10060201470800598373,2694388359800393431,2097152 --field-trial-handle=2072,i,14054434720355224502,12591720480928827437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4064,i,13166839629125152425,16248666837028897556,2097152 --field-trial-handle=2072,i,14054434720355224502,12591720480928827437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4028 /prefetch:9
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,5527658015548664033,400066268524456441,2097152 --field-trial-handle=2072,i,14054434720355224502,12591720480928827437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,16623643976709296342,5784428584320396650,524288 --field-trial-handle=2072,i,14054434720355224502,12591720480928827437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,7079050574089266126,17980692320964759965,524288 --field-trial-handle=2072,i,14054434720355224502,12591720480928827437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:14
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,6291534084937971068,1201312961569128198,524288 --field-trial-handle=2072,i,14054434720355224502,12591720480928827437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,1796262814168763434,2513188146702851955,524288 --field-trial-handle=2072,i,14054434720355224502,12591720480928827437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=740,i,18214669490879458917,12479944918741865578,262144 --field-trial-handle=2072,i,14054434720355224502,12591720480928827437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=744 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3124,i,13926202077339175445,15144040331292151655,524288 --field-trial-handle=2072,i,14054434720355224502,12591720480928827437,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:2008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2e2d8d8a-f674-4c1e-9de1-af9477fe8f0c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2e2d8d8a-f674-4c1e-9de1-af9477fe8f0c.tmp
Size 13KB
SHA256 122733a657f154c217a65d3f8b26ac705a44c5a27e1c9f5fac5fc76d2929f68c
MD5 69db03b4e4045e3bd554e25667f47524
SHA1 afa7199aa75e9525c04a276af96e1007862836f5
SHA512 22890961415f227c171f2ecab9f63312f8b350e147a604a8ca4d1c892c4a7719b4c56874ffc908f2818b0a5975742cc10ea40264480d601601db05e34edba66f
SSDEEP 192:qRVtWpoKJv7lpXPRpzQlb9+Hsb+WNniHQFi2ze/Kkw8HExVyIsnAUgE:qRVtgJRJXW0wcb2C/K3E
TLSH
T12852E86EED10697BACCBD229FE167B53D3F4202125A11E84EAFC892C15E79DC311B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6dcf95ff6778187dd2610631a5d314b6e2cf1ad0724916a491d66979f223b803
MD5 601e1c27c4bd295450665ff58117415e
SHA1 ec7f2a6cd634c49f4cfce7756e34f6e10bb92265
SHA512 fbddc4db3bad99260b6c1cb3f0906ce840e48e5998c4dcb1e652fbdbebb57c813d515e2ccbb30323b4b4b635490b90304fe9e4272fdac6024451fe6c6bc42368
TLSH
T1E8E022B9C961EC3B2DFE1B5990640A86E71013073A41998B3E3E9108CFB1E379A95C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 888B
SHA256 ebfa1257d6f7d55e35e40540bcf2806e84e1acad2d39b3dc930dfcc0a68fb842
MD5 4021ff2380bf275d3f98a5a3f08c4fc9
SHA1 351e0ec044a28121e7c3aaeb276c4822325e0c46
SHA512 045ea5c5e277caa8e8dcbe7b3d605d95b304aa6765146edd0077f5bcf3172c652c6bbf55bc2e4192d862ba01ae182932f14754d5db46a766d856f031d7774fad
TLSH
T1F211C9A121250321DF40C2B468C484A97E7749C28B137C6E83B80FFDB621BF521F7193
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1be16357418c1739165a33c3d9e5abec244b3ae28d69e449f4495299984e9a4b
MD5 e001a29be58ca12545575f2455426660
SHA1 88a6c836d45be300ecae446e94c8972312c0c985
SHA512 dae3904984bae663958394fce4b3f192d49d66bcdd2edac8f59579a73f4986df58da2f7e362f487dbf0cebb89c3849412e71587d824e9a67b0e60c08c4d53f4a
TLSH
T14E41AAF783B4957E8A1192E4EA156E1FCE690524132C3CB689D46E1B93E3872E14078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fde632f2c3b1ef923472fb78c0daa51a20ca239d720f0199259e63371fb6cafc
MD5 74489e55fd3c3d13788660f3375e609e
SHA1 a43754ff4f56ac9c946f63afdffd8e338b367e43
SHA512 275247523549df12a8dbe3298824574f1acb935c033918fdb0981066bc4b3392ca5f89d605c128d13df8401df310f7918288388b34bec0abab1e0b81bf9a1b34
TLSH
T10041ACF783F4857D8A1196F4EB156E1FCE690524132C3DA689D46E2B93E3872E14078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ca81eb4d6d489c8c44d5f3de42aa5418c5dbfd05bbab1163a110b555b1dcfa12
MD5 2bfd2a78227fa246d30660928b2244a6
SHA1 4dd8e9bff8c68ab2bc854486d00675ab0366c63c
SHA512 6c39031ff6c58241183e7fa56c9f850c1b37bcdd74e9bd15efaa94615d483360af623a5c1f76920e2c62dde6e2ae76a81e9bde0a689ff0e5892e1e49ea626d66
TLSH
T1684199F783F4957E8A1192E4EA156E1FCE690524132C39B689D46E1B93E2872E10478F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 ffc360853463f0cb49b19e581d923474888deb19219932a9cd5e7642ed0e76b9
MD5 e710bc82e3dc2a454331c1f1020abead
SHA1 e87207c4e5811bd9d7e3ead9eb9e8ed0141110e7
SHA512 26be95c470afc937c5d5050383ea2d4281154db5009f722a31688f4b09e4f3010de5a10b346efd5386e880deb29d33153f3367e72869d8d972ff45d3c07606b5
TLSH
T18C014793E7BE7437117DA9AB1E85780A2D79B83202816CF5CFAAC17C90C14A31F07483
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4b0f396677ac8bcbc10cfe00f0afe5848453d9cb3c12a860116cfc78945ef3c1
MD5 c4a54fd85393f0cea28a345db93a27a7
SHA1 6f6a8089877885c7f150199ae2a3050855a89240
SHA512 2dc1509bab2436c82abbc22fc7b736550c1ab37e5df8bab56dc43d8ed61dfe23e9071e3f4eae9c755b3d5cee251e46eaa2c302729e8f673623fac70cca389e93
SSDEEP 192:qRVt6poKJv7lpAPRp2Qlb9+Hsb+WNniHQFi28e/Kkw8HE2VyIsnAUge:qRVtUJRUXR0wcb2d/Kue
TLSH
T17442D66AEE14697BACCBD22AFE163713D7F5202131952E84EAFC892C15D79DC311B00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e9ab89aa8950afb8d7dfb8847d7f8d60314f3b2f38d943fb67af0e1d3b22c290
MD5 bac83003f8a74e0ca7131df8962f09bb
SHA1 beeb820fb7d9f94af916b0d47c171a95eae936f9
SHA512 7d2153d1bc19240bd432bece627a9d6c78a067bf291836067cdc9ff62e410d222bee467b00e6553aee2726e827730d9f47cd060d97bac4f51f1c3fc79ee2ab49
TLSH
T12CB0120080016321C04716B012433488B1145F20EB0E5F0663E06A72C82A261C024050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589778.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589778.TMP
Size 96B
SHA256 ce196699fe7951be1aa7c4983941329db2c3649e2c77b3519cface3ece204b57
MD5 b5b19324e19efef664670a619f3e3627
SHA1 1c6bd85113d37df52388070a81e36bf1c54ba2ea
SHA512 203d250adae83559cf89a9888aa566297ffc6facca8e92d85b3e697e9dece54287d26f447989837ee04e585d906f53c014d30c905034fc1d2d9a055628f089be
TLSH
T160B02202C0823202C00303B022AE8CE83020CF28C2030323C2F02A22EC30AF0C03A030
MD5 SHA1 SHA512 TLSH

Submit Download

c3aeb32b-ee1a-479a-ac83-81e8631340dd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c3aeb32b-ee1a-479a-ac83-81e8631340dd.tmp
Size 17KB
SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
MD5 9365e110646fce4577746230e9396c69
SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
TLSH
T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d1b27ab7ab5eebf8bed3341c56bc946b2851e858aa4ec439b36d8a50cce96dd7
MD5 74ffa59610e78fe405be38d6bdea286b
SHA1 fe20a166fdcf1d6688850d255a12f66cbdf58dbd
SHA512 05a1e7d0f1ff7cab6e9b938754653f463c69a505d3210339d88474bbdc77adbb27e7cfaa31ce1f4546a4a2e5f5379e41cdbcb011ccea33209bcd5945f1ad3a31
SSDEEP 3072:dGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:0m7Rkm1tYpBeh2BAoa
TLSH
T1BDC312375D74E93759B9B75EB08E0B1F1EF149A3C920DE92C8D85B0423EA6CC1A09A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 530a07fef96473a59f7771c428ff211c8707011871f8d61876b93f9c1d9e24b2
MD5 3e311b48eb7941a62870c7780a9ee5e5
SHA1 302b56c20e6b2f17e64beba8c511c5b8ce66efe8
SHA512 2cac1f2ae5c3115c0f7b119a7c1381c2d0c368389bb407fd7f9a64fce2a484482bec9e11cc21d86d2e16eaf4eccfd90242bce5a609ca29d7a99dfe3ad8fa6375
SSDEEP 3072:yGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Fm7Rkm1tYpBeh2BAoa
TLSH
T175C312375D74E93759B9B75EB08E0B1F1EF149A3D920DE92C8D85B0423EA6CC1A09A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7bfd78dde620a9ed1ebab009f67c0ca738c21ec1ff5672074f7a9ef903c7371d
MD5 b77d4a4aa84a6aadcbafba5ae8fc311f
SHA1 aba972d1fa43707f6e616fb399dbfb930dfec4a9
SHA512 8df3272d50ef20b5d2ba51b5d93bda5749789e28aa3aafb2a16cf117c3d32ba4d46d8d018afc90cb29479a3418457e419b49416aeb8ea6b3d21aa7c4dcece018
SSDEEP 3072:bPGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:bem7Rkm1tYpBeh2BAoa
TLSH
T19BC312379D64A83B5DB9BB4EB08E0B1F1EF149A7DD20EE52C8D85A0423E56CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 953ee98e34c80c7b64ee8608cdec7199674c105ef3a4ee268e87140f1654fadb
MD5 2da020098658e78388ed97b1ec6f6dc1
SHA1 6bcb3634e6bb4b5c04ebdff1820c0d0d797fa7c4
SHA512 801755a620536db0b9c3d7173997f918eefbf3a316d73e190e13975bc32be8c139a5774d47e4bba8c73630dbd4f9dc6d7864a37f92844bca3efa682e2eb7c6a6
SSDEEP 3072:DPGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Dem7Rkm1tYpBeh2BAoa
TLSH
T16DC312379D64A83B5DB9BB4EB08E0B1F1EF149A7DD20EE52C8D85F0423E56CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8755b2f87dc8453678d8aa24713a8a0c3e2ce4aacc3838b4ea03c4466c82853a
MD5 e5490e72127acb714b548f777329e1e8
SHA1 67788ca8a5e0b440bdf0efaeae1c532cebe61ad1
SHA512 9c354cab46f660f9942a31ecf4f95e62287a49fc6f84128f906913b843c36650b95afb6730c15fa33e9182a8fb868e64435b89bdf1f912c13d3055fe1d5a950b
SSDEEP 3072:mGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Rm7Rkm1tYpBeh2BAoa
TLSH
T1C7C312379E71A97759B9BB4EB08E0B1E1EF149A3D920DE42C8D85B0427F97CD0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download