hxxp://cert[.]sh | Triage™

Resubmissions

07/09/2026, 15:01

260907-sdx5mahe933

07/09/2026, 13:20

260907-qle8nsap216

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/09/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cert.sh
Sample260907-sdx5mahe93

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2648	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332668946151377"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
4568	chrome.exe
4568	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe
Token: SeShutdownPrivilege	1520	chrome.exe
Token: SeCreatePagefilePrivilege	1520	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe
1520	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 3296	1520	chrome.exe	80
PID 1520 wrote to memory of 4712	1520	chrome.exe	81
PID 1520 wrote to memory of 4712	1520	chrome.exe	81
PID 1520 wrote to memory of 2648	1520	chrome.exe	82
PID 1520 wrote to memory of 2796	1520	chrome.exe	83
PID 1520 wrote to memory of 2796	1520	chrome.exe	83
PID 1520 wrote to memory of 5640	1520	chrome.exe	85
PID 1520 wrote to memory of 5640	1520	chrome.exe	85
PID 1520 wrote to memory of 2976	1520	chrome.exe	86
PID 1520 wrote to memory of 2976	1520	chrome.exe	86
PID 1520 wrote to memory of 4176	1520	chrome.exe	87
PID 1520 wrote to memory of 4176	1520	chrome.exe	87
PID 1520 wrote to memory of 2044	1520	chrome.exe	89
PID 1520 wrote to memory of 2044	1520	chrome.exe	89
PID 1520 wrote to memory of 4724	1520	chrome.exe	90
PID 1520 wrote to memory of 4724	1520	chrome.exe	90
PID 1520 wrote to memory of 6116	1520	chrome.exe	91
PID 1520 wrote to memory of 1920	1520	chrome.exe	93
PID 1520 wrote to memory of 1920	1520	chrome.exe	93
PID 1520 wrote to memory of 4152	1520	chrome.exe	94
PID 1520 wrote to memory of 2348	1520	chrome.exe	95
PID 1520 wrote to memory of 4800	1520	chrome.exe	96
PID 1520 wrote to memory of 5668	1520	chrome.exe	97
PID 1520 wrote to memory of 5668	1520	chrome.exe	97
PID 1520 wrote to memory of 6056	1520	chrome.exe	98
PID 1520 wrote to memory of 6056	1520	chrome.exe	98
PID 1520 wrote to memory of 4568	1520	chrome.exe	99

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cert.sh
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2deec728,0x7ffa2deec734,0x7ffa2deec740
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,7372750536318917813,10464047990598984217,262144 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,13071648800381623083,6385307154384112845,524288 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,15496374832226177918,9697487907418341904,524288 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2444 /prefetch:13
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,6921105826845498825,3383911878653136964,2097152 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,635763369701585119,10063449928852731983,2097152 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4276,i,12560484954701963903,8440668399038302642,2097152 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,8144202425345583514,3252169542773863368,2097152 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3244,i,14373069375998981927,17667506866770329117,2097152 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,10939961205058691728,10746418514252361742,524288 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5456,i,16949927653966154879,4171772683665614406,2097152 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,549516244802141899,4986191841803697577,524288 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4928 /prefetch:14
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3256,i,16509116917194851424,7084910476695660945,524288 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,280308923621571535,16550127161044264884,524288 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4788 /prefetch:14
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4292,i,3270188375098271080,9844252875982366309,2097152 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3244,i,5808773440457495642,6547127634486633319,2097152 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5016,i,15374203550189155388,4550399117778180896,262144 --field-trial-handle=1968,i,5906845201223964671,5998851942693231202,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4980 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f1ef62f13966fb76ea5766cc5dbcb0c0ca8a304080522e1aa4f8afff4a1e3c19
MD5 e9218517bbabf3eec28bba436674c83c
SHA1 fbcd8b1af8e7d9ee50b8848245de3cb272b5e060
SHA512 4b98b1cdb80078cd6344ab72c164eb3594fd4f620cf312790c5697837e21ec6b2f0e19e9f28060b4dd5f94572d9b965bf37cf2bb44d84a7fccd122ae062e144d
TLSH
T106E022BACD21AC2718FD4B2C61504686EB84131B3682895F3A3C951D8FF8A374A96C2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1f6352e5c464bfc274fdf2337b22dd142d685cee96c1f88cb49832ef8057e03f
MD5 df375ef9809547226ee257e8525ebf33
SHA1 75726715fda7d341cff8063a66d550ab51cffbf7
SHA512 9a53f0d54a29a08439d934f72913b8a62c7a8a03261ddd7ae4424942a11e1b9669f1fc61857c65b2845c815c99aa56231d3b26678c25758d02e5434ebf495129
TLSH
T1AC418CF793F4897E861192F4EB156E1FCE6D0524031C3CA688E4AE1B43E28B2D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8c6d1af8b36467331e1ced88d34d628b91f49b406473c615c8de809f0f6bad46
MD5 3e501762e8b96d970ef1bb8a69f18fa5
SHA1 b806da1578fa742a15113fcb6c7ea355d169147a
SHA512 016a299d34b1e31ed664847ce004210e1843f09fc41040bd618ff1a1e44f6e6845556a879d9ab3f51c6708d6586b305748cb25d50d44fa93a449a74236251848
SSDEEP 192:nRRyJD+yfWEv7lpupAPRp2Kh9fH1xb+WNnOuP2kEP2nfa4LVyIsnAUge:nRRyETgZgUXTR1nP/EP2faCe
TLSH
T16F42B52EFE54693B6CCBC329F9267653D7F5102521D42E84EAFC8A2C24E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a28457940ed4407726327e75a2ae7bb2193972c718df4bc859cb77452ee7c3ea
MD5 2e42101c78851434aafe2970acdf3404
SHA1 8eaa913ca1aaeba2da8535422da12d5a92c23c60
SHA512 87d51b4e7c5d960480d15a1148570409427037b79f0a0f044e3c893b5e32e0a1b7366a3314f91e40ff7875964e3e4cec00d9240e22ba4743347e7f21b5ba284c
TLSH
T18AB0124080419102C40602F45542148C71549F14A70A5B0993E0F972982526080240A2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583803.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583803.TMP
Size 96B
SHA256 d556d01746b906b6ae242e2af447338e7c2a6777a6e18f7f026a10450172b36a
MD5 2d28c93e240fa32d9aa041601e2704e0
SHA1 f5b975fa9bceb8b5d3e822b744c0e9ff7105a4e9
SHA512 d375245688685927df20233da2d0a6050c6c3c6d57e8074b5d57c08211353e543659bd260b7f90fb4d18f1c769620d5e94f75b23d4458713dec729a820e79143
TLSH
T11AB022B0C0023223C80303B0288080CC3220CF20C3030203A2E00A32CC233300C30CA0
MD5 SHA1 SHA512 TLSH

Submit Download

cdd8333c-0c8b-496a-afc6-1f08769501aa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cdd8333c-0c8b-496a-afc6-1f08769501aa.tmp
Size 17KB
SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
MD5 5d35f09b8c86835fb4877dcd0cc40e4a
SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
TLSH
T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c70ecaa9d7644b9bdf9b5a013519c06a9b556158b50edb0649c9b3f776c70ccc
MD5 6466c09b874a582a2b830a33814f12ca
SHA1 129f3d93493621553c2e5526f84c073877a7b03e
SHA512 66cffbeda7c20d99f19c9d0ccfd47adc88f1f70510e35fb213876bd6c86a381e4119d3a7b63945c83f93d5a1fd6b08456f58499680c3cbc164a5142cceec1d03
SSDEEP 1536:Ou3ueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:veDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T1B7C31212CEAACE9BE4E46C79E0C513F3AEAD4F9527F1B9428176A4423DCEB441391730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4d16d0b745bae133a3f7ae558b2e969cdc4c6cd78ea2f34218c4abd046ff2d2d
MD5 81f5bc661b3bb3dab2c34cf6569e0a75
SHA1 8bdc666f2b37dbe8948f8701aa5c462c6fa38797
SHA512 37b1c8a27c65553dbf2cc78b49efd6cde5770d1698df5195dbab7f5b4ca15929d0d6f703e804c9c45972d376706f08a129606fefcdb1fb41edb9ef290c9497fe
SSDEEP 1536:Ok5ueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:fwDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T1E3C31212CEAACEABE5A49C79E0C413F3AEBD5F9527F1BA424176A4023DCE7441395730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4a95a96ee4597dc667652f4af71df1bf87c23867ce5ada8f0cd826837244ff0d
MD5 16451a1c8a99866766839cdc431aa213
SHA1 2dab337fdc60676bf9f72b4ee8948b8be77bb660
SHA512 5fb4e86e4ee227a7542dbb94020ec0ecd763029c72f3c9e51ad959ec37e71393eca3fc4b8a98b692ed24783032d80552c8862da6d2ad6c8093e0e9a96afb99db
SSDEEP 1536:n6ueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:VDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T117B30212CAAACE9BE4A45C79A4C413F3BEBE5F9523F1BA424166E4023DDE7042395770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9f596def338f19bd57937b264a46d54c4160332cd8c1a7ec265197a8805125e0
MD5 4cf3864d388714d642e84b2c4f381805
SHA1 a1b21dbf849437898c43108cb3d7ee6aa2ff5dd0
SHA512 0b2a50ecf365f2f3ea2c384e0b5e14f6e8cdce47b5b30354614effa60af32abb8913304416a103d502fa3afb6fc40721060e7e6acaa37ae1ab03661992a7fbe4
SSDEEP 1536:zk5ueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:IwDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T154C31212CEAACEABE5A49C79E0C413F3AEBD5F9527F1BA424176A4023DCE7441395730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download