419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04

Analysis

user interaction
yes
max time kernel
899s
max time network
894s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/NSISdl.dll
Size 15KB
Sample260429-dcf3dsbz2n
SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
MD5 ee68463fed225c5c98d800bdbd205598
SHA1 306364af624de3028e2078c4d8c234fa497bd723
SHA512 b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107
SSDEEP 384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij
TLSH
T175622D45AA2084F1DBA2167034D73A7A67F18E752A2449C347F35D4EEE16307B33A986
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2896	4628	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
444	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134219047925733985"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
912	chrome.exe
912	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 4628	1544	rundll32.exe	80
PID 4576 wrote to memory of 768	4576	chrome.exe	85
PID 4576 wrote to memory of 2732	4576	chrome.exe	86
PID 4576 wrote to memory of 2732	4576	chrome.exe	86
PID 4576 wrote to memory of 444	4576	chrome.exe	87
PID 4576 wrote to memory of 3796	4576	chrome.exe	88
PID 4576 wrote to memory of 3796	4576	chrome.exe	88
PID 4576 wrote to memory of 1192	4576	chrome.exe	89
PID 4576 wrote to memory of 1192	4576	chrome.exe	89
PID 4576 wrote to memory of 2416	4576	chrome.exe	90
PID 4576 wrote to memory of 2416	4576	chrome.exe	90
PID 4576 wrote to memory of 1680	4576	chrome.exe	91
PID 4576 wrote to memory of 1680	4576	chrome.exe	91
PID 4576 wrote to memory of 1460	4576	chrome.exe	94
PID 4576 wrote to memory of 1460	4576	chrome.exe	94
PID 4576 wrote to memory of 2932	4576	chrome.exe	95
PID 4576 wrote to memory of 1448	4576	chrome.exe	97
PID 4576 wrote to memory of 2036	4576	chrome.exe	98
PID 4576 wrote to memory of 3484	4576	chrome.exe	99
PID 4576 wrote to memory of 912	4576	chrome.exe	100
PID 4576 wrote to memory of 4744	4576	chrome.exe	101
PID 4576 wrote to memory of 4744	4576	chrome.exe	101

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 492
    3⤵
    - Program crash
    PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4628 -ip 4628
1⤵
PID:3344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb7ce1c728,0x7ffb7ce1c734,0x7ffb7ce1c740
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,18097157809476117735,15118928382403934210,262144 --field-trial-handle=1968,i,4648101035671023968,2936117347464110833,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,9550627148305825679,14889661356639722983,524288 --field-trial-handle=1968,i,4648101035671023968,2936117347464110833,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2268 /prefetch:11
  2⤵
  - System Time Discovery
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,5368129494365230388,7547565908871575056,524288 --field-trial-handle=1968,i,4648101035671023968,2936117347464110833,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,8920653212348479998,4158145005807593862,2097152 --field-trial-handle=1968,i,4648101035671023968,2936117347464110833,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,10231961798964887622,2429116262456006167,2097152 --field-trial-handle=1968,i,4648101035671023968,2936117347464110833,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4192,i,11768710648155819125,11658983608600124582,2097152 --field-trial-handle=1968,i,4648101035671023968,2936117347464110833,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4208 /prefetch:9
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4672,i,14248045470810321555,85239169565212831,2097152 --field-trial-handle=1968,i,4648101035671023968,2936117347464110833,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,16355836926587360456,18052969681289233463,524288 --field-trial-handle=1968,i,4648101035671023968,2936117347464110833,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,3942127903590049759,13695153978633631742,524288 --field-trial-handle=1968,i,4648101035671023968,2936117347464110833,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,11352969455851083557,11964475509350406843,524288 --field-trial-handle=1968,i,4648101035671023968,2936117347464110833,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,10286809366323140210,10724274874027670881,524288 --field-trial-handle=1968,i,4648101035671023968,2936117347464110833,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1196,i,12373383015510752856,1878301908772745178,262144 --field-trial-handle=1968,i,4648101035671023968,2936117347464110833,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5668 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,434487820999108479,761730416074715811,524288 --field-trial-handle=1968,i,4648101035671023968,2936117347464110833,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4604 /prefetch:14
  2⤵
  PID:4744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d86901f35f1bd9ded0b95931562f323beb34db8f8dcb715ad0d427219856e86a
MD5 5e19ae3c67a5218a6dd48d22eae225e1
SHA1 15d7e4d6274cc633176254258100185a246189d9
SHA512 949f13470e40abfbfa2fcb9077035f817a756cf1848799bef3a5a9ce779cfd6e183aecf341b83d8c74ff0f6c51393e38a34bffd03ceb760a6b3fd5aa6b3dedbe
TLSH
T14DE02BAACC21A9370CFD171964688647E740135B2740485F3A3D830C8FB1637554585C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 82dc7ad668296cfdbaf53ec7bc23b0788352379655218eaf5c07558284a6e7a9
MD5 3b382e5775ac953d6de633226d89a020
SHA1 16f2146e3f5a08b84a35fabe35c659d91a48efa1
SHA512 c82ca6da4c51fbc91af0adbf311d20e25ec26b24fae9cbbb4078a65ddd35faaace36c5ed546be4aa3379906dacc9f9e252481e5835304fbfd8a0afb01b6589f2
TLSH
T192516BF793E4867D8511D6E4AA256E2FCE6D0A14131C3C66C9D8AF4B43E2972D20135E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5d0909593a4074c551dff5ff02346f36027b81843a0018065d363f07539f05bd
MD5 ca154af362e201eac6c145221875e06d
SHA1 b774292d2a9705144a1b97b9f56e3c423f8d7731
SHA512 da843e138f5d780abc2736893c3ea0c7e5439ed0809811b195e88b17b37cc738f6335fce62d19b3474260b282a442a76f4261df15fc4e02e13e84cf735165c31
TLSH
T14A718EF783E48A7D8511D6F4AB246E2FCE6D0A24532C3C56C8D8AF4B53F2972D20164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 38ea41b7842a4edb0cadefe9e3356336a85154fd22068737f20e873e0db9592d
MD5 1ad734da7f563832fd15d3d6c3e88059
SHA1 47b003a3c7f6bd6c0b03d1efa06ff0f14ab99fef
SHA512 0da5a66492a172ce1c25319ea5e47830a23ea6635fea846d2db7ccf07d597e46e97873262304d93724ff82f40e34df690cbc999c78a607d7632b099e045749cf
TLSH
T164718EF793F48A6D851196F4EA246E2FDE6D0924032C7C96C8D4AE0B53F2972D24174E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 62132c0486f13d7503f89b9da81f6a705ecbfe2fe12359bbf52d29a339101737
MD5 4d893fcbb34d263b88730f174ecb87b2
SHA1 c478af6f490af0c910751e41e75110940c89e228
SHA512 e09e91f60b1a34686fa1aac542801954e3553a65293ae775533608b3ed83f8dba6b007e0ae5c0924154000872ee31f41a213c692947edc7aeb821a3d017f6535
SSDEEP 48:YALlqPqyh1qAgyGRaXYfo7zsB4sqFgmzsZfsqeosYvF7gksLgTsHjhhnONzssjs4:DonP7QaIagqFi3eU7+ljhKQJ4T
TLSH
T10C916FF783E48A7DC51296F4AA246E2FCE6D0A24532C3C96C8D49F4B53F2972D24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 007d62a4044a9e293b6bf7c85523e1c6bcdde947c5a38767fd6f3c3fd887bf68
MD5 a332de52a207fc549b6e5bc50320a9dd
SHA1 3e10c23ce20022a2ca9b27928826ab0ac261eb1b
SHA512 2210368e6554b7797a7fe884248fbf69599bd5dece7b2123bac116b59229897e27f088662a714f21055451b93f6ca2b65e1fabbc2523c523472004227ca35ed7
TLSH
T1F4818FF783E48A7E851196F4EA246E2FCE6D0A24432C7C96C8D49F4B53F2572D24174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 f9a71c0e8aae967365185e88a0c9a0aa4dc892e5461591405e3adbde62de68a8
MD5 2adf8501d9d91740cb5241b9d5b2e422
SHA1 b0fbd9a1e77e06f56ec4a6b03da6df2def44c8e1
SHA512 6261ed007e4248f28bcaacf85c081f8b53178b6447c3f1400f2d0ff37969b2c6658df412a48d6d2d0c99ecc3109af3a1b23ad15f6ff38268f4c542f3cfcdea37
TLSH
T108F059E7D37D742740B884A72E04F84555B6AC30128064F0DEAA866CA0C16E71B12053
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8c8e61b4568eca22cbd3e7d3273a6c762df89de16c7879858b6574a9070a7419
MD5 3a551ebdb6b7447e237ef284a79f8ae0
SHA1 c25ca23360a87f26f4e16e432ca1c2cc193e8db7
SHA512 b65df3c4be80fac252e26402451737be85687c3a0f67283d97486880e87a4a8cac1364d4830e829c6da5d73e2fa5e4a9385fd8f06ddb6a6bafbff40cfda84260
SSDEEP 192:+RYqFGDtQro2v7shAPRp229AHsb+WNn2z00aeW2bVx1VyIsnAUgraJ:+RYqFDoCg8X92wQ0v2bVxje
TLSH
T17242D82DBA20697B5CDBC21AFD657753E7F2103160941E84EAFCCA2C15E75CD212741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6bc008b84f7b49ff858d3d66f0845e061d7156ec3eb3135233ed39599baa1e15
MD5 fdcd291a7a6e3acf5d697abeb99771f1
SHA1 19cd464f3543ac5d35370224fed4dbcc3ad72e80
SHA512 2ea942bb58192a56fea7edb43a624896d88c14b3ff41a712838d36ab7f5a4d63ceb23858f4522e56e0faa1c2000af29d962e670c8619a28ff78ed6331cc6f701
SSDEEP 192:+RYqFGDtQrAv7spAPRp229AHsb+WNn2z0saeW2bVx3VyIsnAUgtaJ:+RYqFDcgUX92wQ0X2bVxR8
TLSH
T1DA42E72DBA20697B5CDBC22AFD657757E7F2103170941E84EAFC892C15E79CC222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6c09056b484268f344d1e1eee4c2792ec6657c68ecc90cfcadd8ec035498bd3d
MD5 76b928091cd533fd19034ef94fe0bbd3
SHA1 6cf513132c7066dc75bea71840ff4acb31217fdf
SHA512 7cd7ede930ab5572dce35efd022bc5d9291a84251eb342465b5c5078ffd578aa690d6dd7527efe1465f4ee9f60947dc84e8be258c7d5b9e1bceed06917ca08d6
SSDEEP 192:+RYqFXDtQrfv7shgKPRp9B29AHsb+WNnTctSaeW2bVxhVyIsnAUgraJ:+RYqFU3g68X9M2wotR2bVxHe
TLSH
T15952E82DB9246D7B5CDBC21AFD657B63E7F2103160901E84EAFC8A2C15E76CD212B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e3a548bf430585a3c9cac9d556013d49d18bb3ab539c4a7215186146383bc28b
MD5 81b17921608de37950b057fc74957e79
SHA1 7ce68403d767117ca0a604be6104cf411d5a87a6
SHA512 df7b9710031443924f55bdf9cd028d63d2cf588bccf4d53e01dfd6491ca2cf12e4807f53b82188821cbf1878a07661ee1648320ef26d70d96e881f9dcf9161aa
SSDEEP 192:+RYqFGDtQrfv7shgKPRp9B29AHsb+WNnTctSaeW2bVxhVyIsnAUgraJ:+RYqFD3g68X9M2wotR2bVxHe
TLSH
T13E52E82DB9246D7B5CD7D22AFD657B63E7F2103160901E84EAFC8A2C15E76CD212B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 5ab444414a02d4891c7cbb4db3735bec720facb3265bdedc915a68f6beef1cd9
MD5 191a425abbe14997e55d6c34d96395de
SHA1 567b4a799716eb9b3db36abe7163a0aaec1148fd
SHA512 d0c7f690ea61add197a2dbd706250b5de93bf454a11e6e82e25faa2759a36b7158f1e02247d411bcd65234e3d4eb5605c539a97b277b15db18786f9fbc17ab4a
SSDEEP 384:UujAr7KxkXqKf/pUZNCgVLH2Hfgsl+m7pLuLcifmnXODAH+ErU3xWHGWmvhxVtfC:UeAr7KxkXqKf/pUZNCgVLH2Hfgsgm7p/
TLSH
T15D720A677C4C9E770F94CACCD8167A4FADF6024B65E9889583FA982903C5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 dc9eaa6c9a9b8d92d80839a860a84ea21f518fc254c010bcdd0ea425fa044d7e
MD5 fbc9ee11c09f923f7e74ab3b3ec5dbb5
SHA1 2a4df09916b320455f9caeacce039abc7544e324
SHA512 32a624626aace9592945f3ffdb069c396b358ddb9cf71d124a40e702b1dd7135ac3fed039525d46492f906716b596212e842e4b00090582dcaee45305e1bebba
TLSH
T140B0125080415502C04303F5158A44CC31149F348706130253E86A76EC263A18218191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59071a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59071a.TMP
Size 96B
SHA256 a1ae8ca1ff65b5b4ea6d5ce00b8c7289e4dc4e66c244a07c483e7145539792e4
MD5 e484f9ec1fd99598632d6de975b9d01f
SHA1 d96afd647482049fee1af97c327fc9e9c79ff640
SHA512 8f753d9dbfb460414378e4bac0a63fb76937ea60fe65d5917a47e71736a6677a977bd3a464c5f9eb27b9dc1b1861e269f0ec785e893ff0b7dc33e419adaad867
TLSH
T190B0025DC5027616D44203B12DE5D5DD71A4DF7AD703133396E05BF6DC29671C625170
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 87e65d7041ec63634c149016cc419f51207952247fd96a4ba69e62b5f72f7326
MD5 9defd47cfaf61be89fb41b8bdcc7e47c
SHA1 009c45cce4f7cda22467ca707ae0aec46dec73fb
SHA512 7acedd84938aeb408496ccb14758ab5eac53dd7b6307e8d2e4c0e1b334feeffb4550b50c69e50ec81e92253631c6eaf3e4c722cab7213e510e43126a37bcd7be
SSDEEP 6144:My7Zqtznz1mHJhtDI/J66MJ0++JjcMW2VcVLla:My7ZYnpmHtI/J66hOMWja
TLSH
T1BA14224956167DB9B3B9170B6017DE6D48E38D4F240011FC63C6AB0B16BE787830B9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 e959a5b5c70f4d90ce6681a96848d88b904fc293fbdbdd33b585bd116185367a
MD5 b711f65e86c5488ce365e2803c844ea2
SHA1 848a52269b6ad6934080f90593152673923f8389
SHA512 6178b5f187f350b1524689fccc48292d06c6b0610dfdbcf15ffb2f11523d22399da627c217e95239586b66bb2efe56105fc2cb81d11a2e648e218258e476854f
SSDEEP 6144:Z27Zqtznz1mHJhtDI/J66MJ0++JjcMW2VcVLla:Z27ZYnpmHtI/J66hOMWja
TLSH
T15314127965176DB9A3B9160B6113DE5D4CF38E5F240021FC63CAAB0A167D68BC30B9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 6d49293d9b91d73527b5175fde56d0018bb449664ca32ca0107c0e4fdd9accde
MD5 cd4ef6138848839cb9167967782ef5e9
SHA1 4efe6d45fd192bf393ef762a26858ff2d07b1a19
SHA512 13fd2e877d7701fde63563f34f230d77e953e7ac3d962c403c5861d71df617b3ae69337052e066adbb1a28154f91a73c7b5ab7131311fc592746b2cfb0e396f5
SSDEEP 6144:Z27Zqtznz1mHJhtDI/J66MJ0++JjcMW2VcVLla:Z27ZYnpmHtI/J66hOMWja
TLSH
T15814127565176DB9B3B9160B6113DE5D4CF38E5F240021FC63CAAB0A167D68BC30B9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 a47287487f5a28c558fa205d6f609312d3cea29fece46f58f0524b38a0edef3f
MD5 2757a921d96a9b4c61122eea5f32c69a
SHA1 e3ad14df1702c0ec4edb561cf6a5b86cdc1bc5dc
SHA512 f50579bc0c96da4b7b5828fa021aa78f1bfc89fcd71babfb95e3015627afa4f53ccc13f0201a0c4399d17f9398bae40cfa4a027ef752f577995a1f31ab5dba25
SSDEEP 6144:Zy7Zqtznz1mHJhtDI/J66MJ0++JjcMW2VcVLla:Zy7ZYnpmHtI/J66hOMWja
TLSH
T18514224956167DB9B3F9270B6117DE6D48E38D4F241011FC63C6AB0B16BE787830B9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 9f7b2d760746ba78a26fb28d1c3140434deb6a47fb6e8fce06f60dc80c81857a
MD5 53d4c9f2fcfd173ee94b2bfbc2ac9cd8
SHA1 183600bbf1eeb746c97a39c3a0fa9c1b56c2d62e
SHA512 b8faadb413a901a86221f35bded7b1873a615d77f0a2676ebf44237ffc5c0a48f6766d842e5986ba93e7325ed20c7c338d7fcd0c1a6d8649af5075e8d58f47a1
SSDEEP 1536:4LBP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:gp++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T1479312B9991E7D79636ED396A0079CAC8CD3DCCE151051BC30C76F0E14BA3A3A35B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4628-0-0x0000000001090000-0x000000000114B000-memory.dmp

Download