f066f70fc0da194ec692af6b01006e5705d0f04a695237d4238302b46f2c25a5

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DCK/data/Thumbs.db
Size 157KB
Sample260416-xd8ctact91
SHA256 f066f70fc0da194ec692af6b01006e5705d0f04a695237d4238302b46f2c25a5
MD5 16a1970325f564d2d4a1d8597456f2a2
SHA1 71a4c23873a85506cc336866c02bafc011ed83e2
SHA512 95bca693b40fcdf637a97dcd5f33b80044ee0d2689f65aa11478a288edf380c408eda69e868e61c9f1e4b60b6e3b23ef3393902469c9cdc7170272b684d7bea5
SSDEEP 3072:STfFV6m+jRFJ3+2Dm4XNebbSFSqljs/DkosR:OKRFJ319bODUR
TLSH
T1FBF35C27BB9207D0FC3786FA99265D5192EDFD813990624F3BE076D5E270FD48888A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3980	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134208389140621234"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
32	chrome.exe
32	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	32	chrome.exe
Token: SeCreatePagefilePrivilege	32	chrome.exe
Token: SeShutdownPrivilege	32	chrome.exe
Token: SeCreatePagefilePrivilege	32	chrome.exe
Token: SeShutdownPrivilege	32	chrome.exe
Token: SeCreatePagefilePrivilege	32	chrome.exe
Token: SeShutdownPrivilege	32	chrome.exe
Token: SeCreatePagefilePrivilege	32	chrome.exe
Token: SeShutdownPrivilege	32	chrome.exe
Token: SeCreatePagefilePrivilege	32	chrome.exe
Token: SeShutdownPrivilege	32	chrome.exe
Token: SeCreatePagefilePrivilege	32	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe
32	chrome.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 936	32	chrome.exe	84
PID 32 wrote to memory of 984	32	chrome.exe	85
PID 32 wrote to memory of 984	32	chrome.exe	85
PID 32 wrote to memory of 3980	32	chrome.exe	86
PID 32 wrote to memory of 1936	32	chrome.exe	87
PID 32 wrote to memory of 1936	32	chrome.exe	87
PID 32 wrote to memory of 2204	32	chrome.exe	88
PID 32 wrote to memory of 2204	32	chrome.exe	88
PID 32 wrote to memory of 1812	32	chrome.exe	89
PID 32 wrote to memory of 1812	32	chrome.exe	89
PID 32 wrote to memory of 2628	32	chrome.exe	92
PID 32 wrote to memory of 2628	32	chrome.exe	92
PID 32 wrote to memory of 1860	32	chrome.exe	93
PID 32 wrote to memory of 1860	32	chrome.exe	93
PID 32 wrote to memory of 3872	32	chrome.exe	94
PID 32 wrote to memory of 3884	32	chrome.exe	97
PID 32 wrote to memory of 3884	32	chrome.exe	97

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DCK\data\Thumbs.db
1⤵
PID:3360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:32
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff9a9d3c728,0x7ff9a9d3c734,0x7ff9a9d3c740
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,32111754949975872,12876357004246622431,262144 --field-trial-handle=1948,i,5147704984692733657,9754541048682296307,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1520,i,386303943767056388,13325394995066720224,524288 --field-trial-handle=1948,i,5147704984692733657,9754541048682296307,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2276 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,640334134671447339,155556670470421647,524288 --field-trial-handle=1948,i,5147704984692733657,9754541048682296307,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2568 /prefetch:13
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,18100932925865434990,10983206007388026313,2097152 --field-trial-handle=1948,i,5147704984692733657,9754541048682296307,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3412,i,7785450968050589969,12656112268586963172,2097152 --field-trial-handle=1948,i,5147704984692733657,9754541048682296307,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,16435891187099244991,431812067530106483,2097152 --field-trial-handle=1948,i,5147704984692733657,9754541048682296307,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4272 /prefetch:9
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4652,i,10606091723024458430,541568331509870951,2097152 --field-trial-handle=1948,i,5147704984692733657,9754541048682296307,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,4754128991897370742,6217143985399360024,524288 --field-trial-handle=1948,i,5147704984692733657,9754541048682296307,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5492,i,11762488113969471984,1871388241095752564,2097152 --field-trial-handle=1948,i,5147704984692733657,9754541048682296307,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2200

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3316

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
1⤵
PID:3560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 132a6b414a4f60b6090db386987414ecb748e973c4ab7daa2d3ea86555e2b8af
MD5 4b4ca017f46770fe72b9d77f866bd26b
SHA1 bb7faddb48876b23ca325bbcfe32a510e28aeb81
SHA512 727f165ecee9b5db4959281d08d21403fbcac7e3896470e75c8fa6872f4ef55ac7c011eeeadd96a8197e3fc99c7077ed46048b011b5d3c7b5af56ca7fe5cd008
TLSH
T14BE02B9BC9719C2709FD4B1960604746E651135A2B50595F3A3CC20C4FF1E2A854696C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 bdc04c77adb6049cfb1262a1a2933c6fbddca6b378696ae2e89d5102c72ef513
MD5 24de5fbb74bbb68d96ae64b43e4a3dcb
SHA1 3d954800215c107309280adc07abe6692172740c
SHA512 c14901e31d2fefe0fc881d988a7d19608e97c378c7b659038b9dd5030d1345b06cea9784b1a9893335bb6c39732fd2bdbf249013c21c6290ad1300b0cc3ac4aa
TLSH
T1E1D0121B91A3D406C7D05BF3F5114BD0E7E61D6608A00AE38DC3D4585C165B9947114C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0cd1d51994446009e539a1baf12b7be471e8834b649355853e039a6a2b466dbe
MD5 14354502a3802be224260ccbd3fc21d0
SHA1 c7950770a6b0ee1ffd443d7d1a37ddebc24106ff
SHA512 980a3255994ac7f1c7a909a2f6c0e2dfd5dc543e664764a7b272138d20888e3819e889fa3c1dda9fb7711c93ec99dffb56520cc0167887c15dfcc61396ed85bc
TLSH
T161619DB3D3E4CA7D851196E4AA252F2FCE6D0A24131C3C66C9D4AE1B53F2973D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 685B
SHA256 305b5d58a643e414131e343f0f4be2e857eee0c82a9a6bab9e9d8d31528bf0a4
MD5 6800fd09afbdbd37f1b33ea3449a798d
SHA1 4ea3ed9132fe0e182314facf62ea69e935a0b19e
SHA512 5b92fac3ae692e02af2b7da6836ccd00a5ca756d20e073c1dea7784a6de69a7f357409701a171cae26e726321f3b780bb1152a84ed58b06fc33a7127b87a125e
TLSH
T1C101FEA7EBEB7C2710BD497B1D04BC8628F2683116C160F1CFAA412D64C64F71B06003
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ee46fa25ee78b83ba15b7a68792f5b6f5726412d09dc9599091bd7898b20f20a
MD5 a7ed5639c081910763a90fdb29f4c97e
SHA1 8876e48b1b47ca78684ec2b2d352f45084daba69
SHA512 2b1b152ee81f9ef84753b7208a496ec191153737139dd58541dc2a8908a38b04ca12bb040342da8ded63c7dd539d614019dfc0b41c32233d63d0cdd1611ed713
SSDEEP 192:sOR2NY7wMArT2uv7HYpAPRp2I98Hsb+WNn6SdmH2OUaEaESPyIsnAUgtaJ:sOR2NeKEUXT6w/dQ2/7aT8
TLSH
T19642E72EB955757B9CCBC32AFE22B767DBF5202160942E84E6FC8A1C14E75CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2328ea9073549adab02fe99e0127dcb5999d2517b99cac1f85861fd5d1268867
MD5 40aba898dc4efcd9988ec53e06a8b15c
SHA1 af8b73cd37e29a8d0b68b474702174d179201fac
SHA512 1f184dc588afff9f591e8a55398deb52c19ccb2c739739b1384e2a6da49836e5a8171b750e21fad998d39b550d8f4906b846178327f24be8db946220ec5b5a8f
SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLuLcif3yXODVw+ErU3L5HGcHRXD:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pq
TLSH
T1D172FA676C4C9A770F94CACCDD27BF4FADB9024B65E9886443FA981903D5ACB010A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a5d99761a4f56061dc0f59320e183b72bf71b9e69e34c3c808e0f85828929a58
MD5 cb3f0bed49365060cffbd7128eee240e
SHA1 4c3316d44988dc64bbd3f5394cb476a96133512c
SHA512 646d3eb5cc7d4933d7c1510d087db3a621ce42044ac20e09d2762f40a3d4bbea1c21c1fa2f741d73e2a0b514ad04f4e0a2902b608b3b18b72abbf104c1ec5e3d
TLSH
T12DB01290C0C2A900C02301B45243148821449F14EA051312A3E06971982A1F24115161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a16a6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a16a6.TMP
Size 96B
SHA256 2838c1363e6c74506eb2bb8301e14a891dc097ed6232ab136458d6629441abef
MD5 2ecc008c4e415818439240e67112c23b
SHA1 d883dd270cec133e8e83b14a3e60deebc0291715
SHA512 1cb59b2bf730e6a694c3b74503ea45ab68fbc0bc9d6222ce27137cbc9926b7a651abbe8c405e0fefa4b292184f41f17607ca00cad8f278729e61019cca724004
TLSH
T141B00256E103A352C84267F06A95D6D8B561DF25C703221AB6E41A7AEC256708A25D60
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 f1dfe44163a28b6cf919b74be6ffdcc0e6b92c8889523939d3738f95d2adadb4
MD5 1db49380928cfbd3b2d683f3759ed50c
SHA1 9fa64dfd85c7fcc868dfc9c528cc4c7d8aa5166f
SHA512 7b6aadd28bc664a79888f487a1e5edf82bc4ec1b009e3475bc1c73c34e4f924c193ae9e88ae533c002fa9c6302916d63610b76939f1d86262093e9b107f99044
SSDEEP 1536:wSCP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:+++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1D39302B9991E7D79236EC396A0179CAC8CD3DCDE151411BC30C66F1E14BB392A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 f07b894506266446b76b2c2ed3a8d3fbfe5aa0ad59a5bbcb6461175d54619a35
MD5 0bbba216b3ec42aa061e458159d6e99f
SHA1 62bc05706184059dbbb82db76c976c7f1bdc516d
SHA512 bfb0db6297946ccd9994c8a922ce4692cc1879a5eed78b57273f23ab0cb3b89352e91ee332f9af1b2e2ed21f0aed26e68084b4419938518c1faf134d044666eb
SSDEEP 3072:RGiTSxbps+GUnWCVSzxUKTAeXeitkeMA/SJrso1+++J3qUQm08KMWF0bFTcVHr6X:R3Ats+tWCVS9nMAa+x++JjcMW2VcVLg
TLSH
T10A142391D50E5D77B73AC391601B8D2E0CA29C8CF5186BFD61CB4B520AEF382974E9E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1516-14-0x0000022DC9090000-0x0000022DC913F000-memory.dmp

Download

memory/3360-0-0x00000149FC6D0000-0x00000149FC77F000-memory.dmp

Download