fa6ea6b6fbd7aa264116a5e7d39481a314478a21a3b58c2587b18e1d921e1cef

Analysis

user interaction
yes
max time kernel
101s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxFFlagDumper.exe
Size 36KB
Sample260507-3bc2sabw2s
SHA256 fa6ea6b6fbd7aa264116a5e7d39481a314478a21a3b58c2587b18e1d921e1cef
MD5 4d0ef5375f821bc9bcff8d783a872131
SHA1 910d40df59ccad92277cd92abfa7480e697e3882
SHA512 04b20e0366176426eb8278fce96d41d0eaad3b272efc8fb131aae25b532212244aa013796ebfdf6f4581d72f42fe5098d43f006ac6d827fa44109aeec2018d0c
SSDEEP 768:mHP/OYDwzRrhD+jWsACFwFSlb20MmXx10olz3aY9:T+6sVuOb20H+uGY
TLSH
T1B6F2282B775A00E8E5B2D278C5925367D376B84403A1B3CF23D1C35A1F663E0A97EE61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2772	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226696299648703"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650218026-1419908266-2856590055-1000\{0F6E44A4-528E-4E4F-9D55-469076ACB3E0}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2804	RobloxFFlagDumper.exe
2804	RobloxFFlagDumper.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe
Token: SeShutdownPrivilege	4664	chrome.exe
Token: SeCreatePagefilePrivilege	4664	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe
4664	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2016	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3028	4664	chrome.exe	81
PID 4664 wrote to memory of 5540	4664	chrome.exe	82
PID 4664 wrote to memory of 5540	4664	chrome.exe	82
PID 4664 wrote to memory of 2772	4664	chrome.exe	83
PID 4664 wrote to memory of 1180	4664	chrome.exe	84
PID 4664 wrote to memory of 1180	4664	chrome.exe	84
PID 4664 wrote to memory of 3248	4664	chrome.exe	87
PID 4664 wrote to memory of 3248	4664	chrome.exe	87
PID 4664 wrote to memory of 3872	4664	chrome.exe	88
PID 4664 wrote to memory of 3872	4664	chrome.exe	88
PID 4664 wrote to memory of 4364	4664	chrome.exe	89
PID 4664 wrote to memory of 4364	4664	chrome.exe	89
PID 4664 wrote to memory of 4544	4664	chrome.exe	90
PID 4664 wrote to memory of 4544	4664	chrome.exe	90
PID 4664 wrote to memory of 2112	4664	chrome.exe	91
PID 4664 wrote to memory of 2456	4664	chrome.exe	93
PID 4664 wrote to memory of 2456	4664	chrome.exe	93
PID 4664 wrote to memory of 2064	4664	chrome.exe	94
PID 4664 wrote to memory of 2064	4664	chrome.exe	94
PID 4664 wrote to memory of 3344	4664	chrome.exe	95
PID 4664 wrote to memory of 4848	4664	chrome.exe	96
PID 4664 wrote to memory of 2556	4664	chrome.exe	97
PID 4664 wrote to memory of 2056	4664	chrome.exe	98
PID 4664 wrote to memory of 5152	4664	chrome.exe	99
PID 4664 wrote to memory of 5152	4664	chrome.exe	99

C:\Users\Admin\AppData\Local\Temp\RobloxFFlagDumper.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxFFlagDumper.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb9200c728,0x7ffb9200c734,0x7ffb9200c740
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,1470235655267934834,7753209290765823971,262144 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,3898431551387531121,10140935737405089743,524288 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1504 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,5788882167455214892,8542058579332571553,524288 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,268610642994330897,17743206566478276643,2097152 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,13505435474201247479,18149788527239998278,2097152 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4380,i,869898514658274628,16235904965409390565,2097152 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3880 /prefetch:9
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,483151681495691121,1680681895278484443,2097152 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,17781156579002671838,2619859451780823882,524288 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5668,i,9589214461040153198,16837881094177007982,2097152 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4672,i,8192038454633684260,15068019653534027859,2097152 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3608,i,8571078218840031474,5767929251381932328,524288 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4708 /prefetch:14
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3596,i,3425863900502410398,1272311816801037838,524288 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4780 /prefetch:14
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3556,i,2549145293900662846,12592644164547452933,524288 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3552 /prefetch:14
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=216,i,17006174846734014847,12623308038789523540,524288 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3716 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4788,i,5374868129777034526,1433353378888960031,524288 --field-trial-handle=2044,i,10840583491052848282,13865973400469322252,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4704 /prefetch:12
  2⤵
  PID:5152

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1236

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 34096748de9cbd495f8260a2a1c978b9e26d46a34cffd7779abd527f95fc0f2f
MD5 1132306e3beb1a5d3120926af71f238e
SHA1 2aecc8235f7b180d535c74ffae865916f4b9f5dd
SHA512 39931a33b91e12d11724e9b1b4607ceddeffe51422938256c777676077b6217ea576a6c37241560a4437d128b2fb31a7b43503d0d87d6396fd937f678912ccea
TLSH
T161E02BA6EE25D83708FC0B6864580701F74507161B41851F773D460E4FB163A414681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 974841aa59cfa0c13c811e88f19e2fbec259b3847bb15fb02aba3eec7d492865
MD5 a1383b41f5c0939a9877ad5ea67dd36d
SHA1 0000eb6c045c8843a904ade40429bda8867794a9
SHA512 ad57f1f1d093845f5a04674c3fcbec026a13a03e9eafece8038759ebb73661a04ceb983c4c6ea061d159a9a3aad6a913e3a5f8791d484cee3c8767dc7e4e2ef1
TLSH
T1CB415268F1E0F051CF75CE3A88620D50B5189A0D140607B7C663FD70B8B3BE36A1B6E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cafbd9eb7cb53458fe4c6a1b764519b7bf553d7ba523d9174eab671ec0fd1ded
MD5 4b78c574dd81e75cdcf9cab948b167ad
SHA1 ff3df34ba9c023034bf9487884b297b5190218e3
SHA512 713c7f5cf75948cedc2300e519219c96b0debeb26a30a77e8ab92f6d477d1e6823749110f08d3b6bda7441ef7f67a3d2bd41c5025e00ff04ffb52c9b97151159
TLSH
T1EC515364F0E0F265CF65CD3588322E50A918990D15061777C2E7EDB0B877BE76A07AE4
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 358c2e204657e884fe610dc275460e164287373c40aee54198db90a33a017769
MD5 99c55490a68c2e77ca1e9dc6613275a7
SHA1 1b02b17f06d7f500a63598f8a212681005b2c1ed
SHA512 9ae762bc68a26faaef21318a7b6d34bbe40d8a0b0adaf59b317b055e62961db0eba5dd86fe026b6c8268c14e8686c00ca947e61390b5d35aa72308a2bfaff8da
TLSH
T1FF51BEB3C3E89A7D890196F4A7242F6ADD790A14531C3C56C8E8AE0F57E6CF6D21424E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 dae99dcf858cba5d31e6f9ea944500fc8b61c192e134e2f0346f879861bf64dc
MD5 e24dfc564b883c9c3e7482dbbf8f2469
SHA1 f74ae94e81b33e3d9b63a7e6c0e983d79b0fa792
SHA512 cb6b36b64a7185d63bace8ce599bc0863f00ca359f62858e1e5edc84c7118eacd0ea3b3627a77ef56e7e11139f95abf64037acf82e0bfc0ed0daf0be20f1cc18
SSDEEP 96:DM3D7EaIabJrGJBJYJ7hGMgJgfYJjRJi22JSJou:DM3D7EaIabJrGJBJYJ7hGMgJgfYJjRJb
TLSH
T1E8A1ADF783E4C9AD861196F0EA156E1FCE690924031C3C76C8E4BE1B93E2572E20179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 34874c640ef2ed48f9cb3d174e203f4fd30768d2d16ca2ddd742a05764ae2082
MD5 9b2c2bfc5cb9c83afa34fd30962704a3
SHA1 eba19091bb19919f0811493b899d4fcb94867079
SHA512 4167a35b2c0f0c502d4a6f49cabff7665b9c90d16e99739c71728b30590abd993ed0c55b93166285f14d8eaaa11693fb9f3599030a6fea6b9ab6da16c4b19ced
TLSH
T1EE51BEB3C3E89A7D890196F4A7242F6ADD790A14531C3C56C8E8AE0F57E6CF6D21424E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dfa1a76198cc29a8f5f038c1df220387663ea5036834b7d9ab0511675fc9dee9
MD5 28eadb74992a69a6c0ecb858508e607d
SHA1 7a07e27f3c42ecfbfc0c6aa10511187fd3c1bf87
SHA512 04f4677e95d773502e62ca574b0e4406daeda8a6c601f59f3c63e79e37cdd65aff7cab69c682b7cb12e272766e35b296d8914ebd15bf167794832e3787d5ff5d
SSDEEP 192:zRsgUXHbF/Jxv7gpAPRp2uX99Hsb+WNnI2tGs2fbCwEkwZNlaVyIsnAUgtaJ:zRsgO7/hsUX5/w1n2DCvnla8
TLSH
T1B042E52EA914B63B6CDBD219F922B717E7F5102124C52E88E6FC8A2C18D7ACD7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b05679d766db0cc07f6cfadde345916f20e3b347d7d0d97d244752f059ff9d19
MD5 392933831fc2f99a63d8394eeab10974
SHA1 6602ad5c3ca2c15f3047221da15f32396e74330b
SHA512 9107c9eb2a5b0e66564119fe0e852572785d5450ffbcec015527836f13641e70a365117fd3a8b3b06a92780bc5585e2e49bd07beaee589c60815055aafa2da35
SSDEEP 192:zRwgaXHbF/Jxv7EpZ4PRpjquX99Hsb+WNnI2tjJYNbCwEkwZhlaVyIsnAUgraJ:zRwg07/hArKXjd/w1bY9Cvzlae
TLSH
T13E52F72BA915BA376CDBD219F922BB57E7F1102121C51E88E6FC8E2C18D76CD7213027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5a29930eb062237b8d46ed84524a2be9932a664c61a88c9e39c7a5287be4e8be
MD5 47ceed696c34a7bc414eafdb91f2a6d2
SHA1 15cb59457d527df707c5cd355514527a3d123aa9
SHA512 786353984c4697fce08ad825c20545be9f4d74dd929650badd2b67da5a0afbbeea399d5f0c277bafcc33d0a47592c7372eb8bcbc7590e4926e6d0239914b2a03
SSDEEP 192:zRwgUXHbF/Jxv7EpAPRpVuX99Hsb+WNnI2tjJYsbCwEkwZnlaVyIsnAUgraJ:zRwgO7/hAUXK/w1bY+CvJlae
TLSH
T10752E72EA9157A3B6CDBD219F922B717E7F1102161C51E88E6FC8E2C18D76CD7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82085f58435b7b7a260780dca3ee69a48427de11b3ece82d53af0d56f36fd555
MD5 92547e8f34c99d1b69c0e1d957604d80
SHA1 4ca5a2d93853b96b7fc565a0e16045bbcee47e58
SHA512 aee9857bb3f81b98b9310e49ebca2773ad80f91201f0efac2260b404123571baef569acba1d144b7aa20664020dd07820f3547f4604d3bc6c7d155025f48eb07
SSDEEP 384:V3jBM7KxkXqKf/pUZNCgVLH2HfgslQwl7pLuLcifTuXODBU+ErU3bwxHGak5Je0o:VTBM7KxkXqKf/pUZNCgVLH2Hfgsi87pL
TLSH
T1DE72FA67AC4CAA370F94D6CCD827BE4FADB5020B65DD886883FA581903D5ADF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 35d3da1da7c4eff91c5a0c593d4e369c770fe795f8295bd86424c091dd62ce81
MD5 b2832ffa1af18ea25dcaca65277b48dc
SHA1 f8422cfdce41acd9008b7eb2827729f399c91b6c
SHA512 137d44a3ee05a61ca2f893a4d0739bc66fa057a86612325c9987871e1a096b39be45d5e4caaae73ff6821cb4e7b526a459aaa9b5d899865062da99c75a070482
TLSH
T14AB012918402D501C10302F411C604883654AF14D70A230653E06972DC3B1A14114561
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d85a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d85a.TMP
Size 96B
SHA256 815e8e5af575ec3490f7c1abdd9d9657409944bcb3b3c4184a711b1c6f571317
MD5 280f2cb13c8c9a58a9393fb233d976f6
SHA1 46795637bae986fc81c74e797771ff42366f89fa
SHA512 9099c5e93c0dde3a23e3f709b38d9d0dce1b99ce0c805c253d0b49a53e2ac370f493ce53c487747f71ca9894c54fdc25932badbd7ba660f1d487a8a96c15c997
TLSH
T145B0222BC002E302C08303B028AAA0C8B2E0EF20CE030202E2E00E2ECC3C32000A8030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 cea860cf17e2e9eaa493975439080b13d205fa29986cf30d0022cfda44f0c2d0
MD5 823d1e4aeae4d84ce497a72c8dc846e0
SHA1 de0cd9776b97015b1ccc408e104759c4b899c01e
SHA512 365db37585856a543edded0b3694d877ce6b7a0846a59e1de8f02f441e69f553e4385ef6007b2c369e080751970ef1126f2120c21e9673cb559861d342e15209
SSDEEP 1536:ub+P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNJm:B++J3qUQm08KMWF0bFTcVHr6zqm
TLSH
T1D39302B9991EB979636BC296A0179CAC4CD3DCCE111055BC30C76F1E14BA392E31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 fe3d450496421109824a408336e06d1d132e61ae003feb34e32c9f1bc41362ee
MD5 226d1c0c78d0557364f5c3d748d83834
SHA1 e5ad301ef6c45f080dde62d8f3b0a293f61d8ddc
SHA512 e76fa3820cdb41763eaa402e6118b9236cd6eab16917e8371b6ba2f9a6440cda057395fb55a5410aa4a7ca80c7fd8e61a1919d0ca677098c7a61c476af7e4dfe
SSDEEP 6144:zlRUhDlUtHJhjkeM4CT++JjcMW2VcVLjT:zAhhUtjO1OMWtT
TLSH
T1951412BB480F6FBD6B6AC2B5B00B4D6C8DE388DD147060741096BF4E35AA753671B43A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 264c01b567c47f920f710058baa801bd51ad6a7f3058e1a51b264d1e0fb71d44
MD5 7d144993e58af849b377f9cec2c9fc97
SHA1 931f7c7816cbd9a57cb15e39250b69a5569a62f4
SHA512 e5e2a3942c5a7930b861c94de52c24ba33e4cbdb5f83777b59b0b2d4f270566771f71449303e2829b58224e482b3ae2ef3334a2b516cc22bf4ee48bcc24ef4c9
SSDEEP 6144:Tsw4tO91M2w6DflRUhDlUtHJhjkeM4CT++JjcMW2VcVLjT:gwQW1MnQAhhUtjO1OMWtT
TLSH
T1F14422F3440E3EBD5B1AD1B1A00B8E2A9DD784CE84B465742096BF4F398F6636A07476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 a5cf78a0a31c4f9da6d6f1270d8e7a64ac97f98e0053aa918611c7af5d007be9
MD5 aab1ce7f4a20f533f5d811fa1b253f1e
SHA1 94f66b055e5af33c6e311d123fd05c41262fb454
SHA512 626830c4b81feec5c34098925792563801fa900bfa1dfea3cceec40041134a772b9913eea950f0a0b021de0f2e64434552a25d5553bdd7ae6d3a40febd2f3b98
SSDEEP 6144:8lRUhDlUtHJhjkeM4CT++JjcMW2VcVLjT:8AhhUtjO1OMWtT
TLSH
T12B1412BB480F6FBD6B6AC2B5B00B4D6C8DE388DD147060741096BF4E35AA753671B43A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 20KB
SHA256 a5efebfe63dca7eb1a7502a2303f67ad9a26ddc0f506a81f9f31c7418452f05f
MD5 a1f5573f4865b2106d3dd318216232c3
SHA1 0fdd015716c7dd0b94eeabe152b6811bd9ca9fd6
SHA512 b282f85af3a25f01f09142725e637e104df2b1332a41ca9e865a77bd93069915c2b6c7199b0b0a28d0fad7a7d9eb7f86986c6542501ed0e45ca0a8c65f09736c
SSDEEP 384:ZJWJaVca12krtuJfpmXmlJVjeQ8RJoZyghCjUF/Wd5Psm5E+GDa50mUYtc33+YXX:X+aVcWrsl8RJOyg4jUF/89E+GDa50mUV
TLSH
T11CA25A743AF50759F3B29F749EF1A95A643AB866AC00DB5D0122028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download