583a109781e5e1e05ff968ff9cc6d3a72edf9c876113d09ddd126a45ba5f4522

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
reshade client.exe
Size 1.1MB
Sample260930-dkj41sscqa
SHA256 583a109781e5e1e05ff968ff9cc6d3a72edf9c876113d09ddd126a45ba5f4522
MD5 7b867cbf20f4df8c3a38f22bec54094a
SHA1 865c1da9c3416fb776f2c5725d578a8940e99265
SHA512 2e03db99de96b8c7bb1a2a8de0cec6dab41cd4056d853791c26dc4430faef3923e5e1704babd0acd888268dfed776c4e6dafb05b98686d0f9bcdc75b87fecc2f
SSDEEP 12288:Tbs/m0E54jwaFXGc8lEBBBHGBKq2IZwD41vfqItNqdg:TbOVE5ifGPRZwM1vf3fd
TLSH
T10C357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
138	api.gofile.io
140	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5056	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	reshade client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reshade client.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1600	1676	chrome.exe	115
PID 1676 wrote to memory of 952	1676	chrome.exe	116
PID 1676 wrote to memory of 952	1676	chrome.exe	116
PID 1676 wrote to memory of 5056	1676	chrome.exe	117
PID 1676 wrote to memory of 1396	1676	chrome.exe	118
PID 1676 wrote to memory of 1396	1676	chrome.exe	118
PID 1676 wrote to memory of 4148	1676	chrome.exe	119
PID 1676 wrote to memory of 4152	1676	chrome.exe	120
PID 1676 wrote to memory of 4148	1676	chrome.exe	119
PID 1676 wrote to memory of 4152	1676	chrome.exe	120
PID 1676 wrote to memory of 548	1676	chrome.exe	123
PID 1676 wrote to memory of 548	1676	chrome.exe	123
PID 1676 wrote to memory of 1912	1676	chrome.exe	124
PID 1676 wrote to memory of 872	1676	chrome.exe	130
PID 1676 wrote to memory of 872	1676	chrome.exe	130
PID 1676 wrote to memory of 5100	1676	chrome.exe	131
PID 1676 wrote to memory of 3552	1676	chrome.exe	132
PID 1676 wrote to memory of 1908	1676	chrome.exe	133
PID 1676 wrote to memory of 4652	1676	chrome.exe	134
PID 1676 wrote to memory of 4652	1676	chrome.exe	134
PID 1676 wrote to memory of 3588	1676	chrome.exe	135
PID 1676 wrote to memory of 3588	1676	chrome.exe	135

C:\Users\Admin\AppData\Local\Temp\reshade client.exe
"C:\Users\Admin\AppData\Local\Temp\reshade client.exe"
1⤵
- Checks processor information in registry
PID:2492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc86a8c728,0x7ffc86a8c734,0x7ffc86a8c740
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1788,i,18055484495510463289,14646354053495241790,262144 --field-trial-handle=1996,i,11623060715055233248,11128475236875470922,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,2064806441564552654,10588403213034304040,524288 --field-trial-handle=1996,i,11623060715055233248,11128475236875470922,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1656 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,8428452336574871832,7456412842539672075,524288 --field-trial-handle=1996,i,11623060715055233248,11128475236875470922,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,16542130812269069047,14177201390015989996,2097152 --field-trial-handle=1996,i,11623060715055233248,11128475236875470922,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,3643266727854144292,1646464747366938928,2097152 --field-trial-handle=1996,i,11623060715055233248,11128475236875470922,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4556,i,10759656722256300873,15256181246854083359,2097152 --field-trial-handle=1996,i,11623060715055233248,11128475236875470922,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,1612543575543544159,626913012940620393,524288 --field-trial-handle=1996,i,11623060715055233248,11128475236875470922,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5736,i,11158462198652116619,8104451143033368931,2097152 --field-trial-handle=1996,i,11623060715055233248,11128475236875470922,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3416,i,7291780568714199206,1093024465238262745,524288 --field-trial-handle=1996,i,11623060715055233248,11128475236875470922,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3504,i,13636051913860631397,11740835374529180825,524288 --field-trial-handle=1996,i,11623060715055233248,11128475236875470922,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,6530627687885045417,10671923654999304309,524288 --field-trial-handle=1996,i,11623060715055233248,11128475236875470922,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4652,i,2266045710745389231,9607776701414963445,2097152 --field-trial-handle=1996,i,11623060715055233248,11128475236875470922,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3460,i,3611084442827456203,12042038571429401311,2097152 --field-trial-handle=1996,i,11623060715055233248,11128475236875470922,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3588

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 17a2f7181e712ecfe2518d37976cdf0b37a3434ca787a50151c514552da2ff0e
MD5 772d29277da30364af0619fa0ade6102
SHA1 4715aa5f62078fffd8fa7345cf6128892792879a
SHA512 9c2278dd58b42f182cf0fe73a245655b552c91859321908bb1c83e6dae09fd7d55bb6ebd06c9c9ddafb254e8389b51978345b6e95d42449f1ac8f7521881a5ce
TLSH
T12BF044A5C921ECA708FC07592068074AF750136B2680888B3A3D850C8FB123B8689C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6bf61d63e92e8f4ab98ef57de0a619985779683bb34ddd8b9a30cffefa93b5c2
MD5 c1428cbbc0093051710e4c5cbd16802c
SHA1 50e6f0f6d97dc66f2dc1db8eb9b5adb9a8433748
SHA512 73e08f61b31d27c6b3c499fecc9920bc90fe778806d5a94a9f69a4cbee0b969677f4ba16e905b26ad950c32f287358e50ee8eb1c13867545eca5fdd12de68f46
TLSH
T1234174BCED114838EB45563027FA9DD839381A83414B9EBF0102887A7F31FE60EE74A0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 b5aade26194d5f313bafcd7df83e9b3400bffa128e8459a7d0b17415b473a307
MD5 14b9097c1c126e3834b5eee881b876cc
SHA1 2ff473e578b54ea4cc67e9bbe5c287f92b9774c7
SHA512 14c21a74b41e9b5f23472fda1582272c92b6bacc40b3534e01ce5869b55400c16d92ae7c368c4b94a215820fc8fe558ef3bc51a48b4efb2f9c64a1e546aa86d1
SSDEEP 192:DO8uVavb7caz2OjvAjbSMTKBD2/NP5DwaPKI3IzIh3ITlvvipfPzNPSw:DO8uVavb7caz2OjvAjbSMTKBD2/NRDw8
TLSH
T14812CCF7C3D8863DC91156F49B25AF1ECE2E0A58532D3C26C8D8AE4B93E2471D21535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d612849062bab83a3a5e3bbb351a135494c4fbd7980511f41a0df79e8505fc28
MD5 bc6a6f4a6d82ec7d945b8945d5f1563d
SHA1 cd4ddf8848c67dc78091f45ef171d969ebaa465c
SHA512 2402c1e0f97ce44ecc47bb98c94a53974d0eb49bce0dee0d95db83b5f6bc85795943501e8a55c1f47cf36e2715440eeec7223316b885a4c3e54d2c2362693947
SSDEEP 192:DRcGbbPv73hAPRp2m9vHsb+WNn0r0CneI+2qPVyIsnAUgtaJ:DRcG3Hb8XphwE0T2U8
TLSH
T15E32B42DAD20B97B5CDBD22AFA267B57D3F1102264942E84EAFDC93C14E75CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 201391b725f5d81a4d2f221146f3c40aacbea1a1f0ddcdcfae86bcab6d5ae413
MD5 22ee2aa1169b4d73a8ff2a3c94993e06
SHA1 3408087270cf76f97cee73043e07e567200a5fa2
SHA512 ac5f601012cec5a7a5050ece89f547252cb419cfcf66415af3ab1b6ecb2ee981e879a2baca26e529dea3cd9c08c9c2686712b3e8a5446605fd79aefd82a9e188
SSDEEP 192:DRcGbwQv73hAPRp23pz9vHsb+WNnyJrZm2zneI+2qPVyIsnAUgtaJ:DRcGkMb8XghwYM202U8
TLSH
T11742A529AD20B9BB5DD7D22AF9257B67D3F1102274942E84EAFD893C14E75CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 546710b496e5f8272f928d7a6093c798ce61f7dcdbb487536a941ce218d7625d
MD5 5391aff8ffbd4d87b4eb0d33c02b74c6
SHA1 8317c6ed17119256fedd368d229bf3a21ed67efd
SHA512 d643f6ca2bccfcf43f242269c0ef0167e4da08fd1124b3c90f9fd9ca8f9ac250f3c1ab88d3acb214febc3a54d318a6473d1ebe7c08e5e22ff0d077118d167d31
SSDEEP 192:DR8cBzGbwVv73hAPRp23hlPK9vHsb+WNd3yJrZm2UneI+2qYVyIsnAUgraJ:DR8mzGklb8XlhwOM2J2le
TLSH
T1EA42B529AD60B9BB5DD7D22AF9227B67D3F1102264D41E84EAFD893C14E76CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d06e9dcc212f97b735a198103d4efc9d66a1510a9b06d63ea32d40888314b19a
MD5 50926da9b1151a2c75acb5ea7a343993
SHA1 dd079a7343433fb5ca5f291ffc6b5a06321ec706
SHA512 36751b27f32233e5ce785ed81928ceb1d81cd2cab9fe5e31f6d656d6a8f5cad2dd62fbda320f930a3fd88f7043a45f34b0f7c07a9725d83fa13e47e847cef448
SSDEEP 192:DR8cBzGb/Vv73hMPRp23hlyK9vHsb+WNd3yJeb4+Zm2mneI+2q+VyIsnAUgraJ:DR8mzGDlbIXKhwORd2v2Be
TLSH
T15E52C82AAD60A9BB5CD7D22AF9657B6BD3F1102264D01E84EAFDC93C14E76CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ed03d269d1d03ec0b09de46e3112f1d03c20d9e1830bdd2751b62e5ef0ab12ba
MD5 715c85ff4d95f6e72a869a395905ffbc
SHA1 fc11dd9bc379ef665bddd8d8c6589189f21f9828
SHA512 1a46bbeb1e4174d4477a10084f5cd7224e8c69013b5c09cd8b7bc1077554653abe5ed316abdf3b7a4d88700631afce772a8d79110f86ff87bb4a24cbe3e53e3f
SSDEEP 192:DR8cBzGbzVv73hAPRp23hlPK9vHsb+WNd3yJrZm2UneI+2qYVyIsnAUgraJ:DR8mzGnlb8XlhwOM2J2le
TLSH
T18B42B429AD60B9BB5DD7D22AF9227B6BD3F1102264D41E84EAFD893C14E76CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 eff4472df129bc4e2b803cc39a1ba520374d3b607d22cd6393104a3be124b9c2
MD5 8607790a422ecb522e4c0dbd3b269b34
SHA1 e5c7ec8f685c74ebdd01a67f0e763209d8676d75
SHA512 27cdf461b3cdb01cf1d4a2f802f426248ba3f5fe8ed4c31dd046a71cdb0f38b25a10db78f318bacc40577b31c54a1cd046ec06e134194cc0934ab8961d501a55
SSDEEP 384:ftjDu7KxkXqKf/pUZNCgVLH2HfgslHEXODDK+ErU3gbHGVQoiTCGY:ftDu7KxkXqKf/pUZNCgVLH2HfgsdWOHH
TLSH
T120521927A88C9A7F0FD4D98DDC176F4FACF501576568486852FB9C0803A6BCA114E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 a6c10525de86ae3430b54e08bdb8d0f2d55eadcb0cb56a3ab1c954b63cb00e7e
MD5 e99caee54fead1fc7d1e81039411709e
SHA1 5700d7d92dad53037d4552afebbba8abb3e41d43
SHA512 1fbbd9e78aaf6dc1ea7a707df0baefd838bd5f08f3b289ac7c20763f7a81f7f941d67ad54a128800e20b092d7b45a91b72f7dae2e715efcac1109f44592c490d
TLSH
T146A002D905554781C18143B5A3C611D43317BA641B475E4558906144EC991434115241
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 0e10a032c1105afe7f5cb03c07f6e0094101d5a054a37b637005be27864908ed
MD5 2c1bb8e1eb299dbf606388dcf136d7ef
SHA1 57201e9643011363b5c7c51fd07b5e81453530fd
SHA512 0cbebfe2a050d06390b8e163cb0fc0fb54ae37dc7519005f6667ff484f8f1930051bf61816c8de5cce145a7ddb4941fb50d1bad90e6f1e705e06854d1793eb29
SSDEEP 3072:D+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:D+hFD+7t56OD9ZfSApprZ
TLSH
T1E9D31232AA91C8BBC9BC6541B197A300DE666CED45DE3A09444A5F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 9dcf6eb5411829b6d6a440037691413680a73c51d2831a99c9a55dcd4255f3fc
MD5 a4141653d658e4e065c5a53ec2735a3e
SHA1 11602eb876047323667c5090bedc56991ca6e7f6
SHA512 7c6e758388f4fc046543bbe6549acbe99a0f49e13df4cebe86a9e3ee31fe01cce270d31157c097c1005d5c59665f86aed22180431cb9696e00aa81ec2ab2c34c
SSDEEP 6144:8czVGzAqV3t5k2qzecZNV683POn+hFD+7t56OD9ZfSApprL:8czVOPV/3lcZ760PyyFSXD9ZfS4h
TLSH
T1C84423337E59EDBBC5FC6241725793144E7AA9EA81DE2AC4002A3F4B809B49D1353A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 87d35e8c5754f781e97ea0abb9d3e83d07cb02bec58532cc797633d7967aaaff
MD5 b1452fa963d16844e5cad4728d17f3e2
SHA1 943ed13d52eb6d4ed4b8a80e7b91b2a6092c5630
SHA512 67baab367b8242fcdd9cd7bcbc3b34ba4666ad3313c580600c4f59a484ba4bfcb8e4b493640d7a480c064d3dc43b5f9807e7f15195f423fbf3c97051b6e684b2
SSDEEP 6144:odzVGzAqV3t5k2qzecZNV683POn+hFD+7t56OD9ZfSApprL:SzVOPV/3lcZ760PyyFSXD9ZfS4h
TLSH
T15C4412327D19EDBBC9F86341724753188D7AAAEB81DE6EC400292F4B819F49C1757A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download