fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa

Analysis

user interaction
yes
max time kernel
899s
max time network
871s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 03:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/StartMenu.dll
Size 7KB
Sample260808-dqr2tagp4x
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1216	3976	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4628	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306326765688967"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
5648	chrome.exe
5648	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe
Token: SeShutdownPrivilege	2884	chrome.exe
Token: SeCreatePagefilePrivilege	2884	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe
2884	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5236 wrote to memory of 3976	5236	rundll32.exe	80
PID 2884 wrote to memory of 5084	2884	chrome.exe	85
PID 2884 wrote to memory of 2996	2884	chrome.exe	86
PID 2884 wrote to memory of 2996	2884	chrome.exe	86
PID 2884 wrote to memory of 4628	2884	chrome.exe	87
PID 2884 wrote to memory of 3924	2884	chrome.exe	88
PID 2884 wrote to memory of 3924	2884	chrome.exe	88
PID 2884 wrote to memory of 1708	2884	chrome.exe	89
PID 2884 wrote to memory of 4736	2884	chrome.exe	90
PID 2884 wrote to memory of 1708	2884	chrome.exe	89
PID 2884 wrote to memory of 4736	2884	chrome.exe	90
PID 2884 wrote to memory of 700	2884	chrome.exe	91
PID 2884 wrote to memory of 700	2884	chrome.exe	91
PID 2884 wrote to memory of 5304	2884	chrome.exe	94
PID 2884 wrote to memory of 5304	2884	chrome.exe	94
PID 2884 wrote to memory of 5784	2884	chrome.exe	95
PID 2884 wrote to memory of 724	2884	chrome.exe	98
PID 2884 wrote to memory of 3608	2884	chrome.exe	99
PID 2884 wrote to memory of 2044	2884	chrome.exe	100
PID 2884 wrote to memory of 5648	2884	chrome.exe	101
PID 2884 wrote to memory of 3464	2884	chrome.exe	102
PID 2884 wrote to memory of 3464	2884	chrome.exe	102

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 512
    3⤵
    - Program crash
    PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3976 -ip 3976
1⤵
PID:1080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba548c728,0x7ffba548c734,0x7ffba548c740
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,13484652629021769624,5036861287849545932,262144 --field-trial-handle=2036,i,7438067304912009509,11607045397714367159,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,6249067713078334734,5305852885466934003,524288 --field-trial-handle=2036,i,7438067304912009509,11607045397714367159,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,8816082303656255954,187394616353038554,524288 --field-trial-handle=2036,i,7438067304912009509,11607045397714367159,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,6642780590726800033,10185142700702844570,2097152 --field-trial-handle=2036,i,7438067304912009509,11607045397714367159,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3476,i,6559067788509519663,9084299077637973947,2097152 --field-trial-handle=2036,i,7438067304912009509,11607045397714367159,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,15963176170985529266,10127528231435728236,2097152 --field-trial-handle=2036,i,7438067304912009509,11607045397714367159,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4308 /prefetch:9
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,18289191791500157002,6289845189924100278,2097152 --field-trial-handle=2036,i,7438067304912009509,11607045397714367159,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,1226413663302874654,6216242953136439158,524288 --field-trial-handle=2036,i,7438067304912009509,11607045397714367159,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,14126551783449125930,7324986522346660593,524288 --field-trial-handle=2036,i,7438067304912009509,11607045397714367159,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,15633029424527791480,2307032327331756393,524288 --field-trial-handle=2036,i,7438067304912009509,11607045397714367159,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:14
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,5849805759267092934,6385123335533722374,524288 --field-trial-handle=2036,i,7438067304912009509,11607045397714367159,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1156,i,1197837491967978210,16786718797884934498,262144 --field-trial-handle=2036,i,7438067304912009509,11607045397714367159,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,6759636828235666307,9036030786768684198,524288 --field-trial-handle=2036,i,7438067304912009509,11607045397714367159,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4676 /prefetch:14
  2⤵
  PID:3464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fb3bb60c7f43ea075db05c1eb18896dd477715a8e3d2b3af0d2d3a4974e117c5
MD5 c31b4c7cfa1702fca8a12b35a422835b
SHA1 f57e304189a8fca3315d73f9fd059736bbfe1e1d
SHA512 7c551689b19a6d7c00c401a4881d83cd2224cacd01710a1b662b864fe8560942a41aa7db7afc4adb6fa942ff9963e11d25f01f0a6861b2a753bd1eed0119c7b1
TLSH
T128E0A2B9C830E8270CFD1B9C90014F82E304130B2E60881F3A3D810CCFB063B0282C6C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ad58fef1d28730a9cdff3c5f59b9343850110a2fb63a87ef21b63c7233f38f81
MD5 f11bb02cc02c3747e2bb7b89c9ae4867
SHA1 ad5e7a3f466192edbe480536a0ad7623acc9e1f6
SHA512 45062d7a05dfbf19b20ddaf63810d1e738f5218df0a0803c06dc5870061097008ac15b1aa6477d3e15e974d07b409b8e3b6b6f80daf08188c4ccd88ac66ba197
TLSH
T1D051BEF793E4897D861096F4EB15AE1FCE7D0924032C3CA288D4AE1B53F2872D24038E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fcd479500a467937e9ed87640b74bf2ffa12699737925df165e283f28dbabfc8
MD5 e24dd8b96d8e2539af493cf53672b70f
SHA1 38f00b58a591eb9273ff0417ed4cf0f049cd2ace
SHA512 33687f0f07271e8f13e38e00a61f0281153ee0a3cb97722febb3a99a3a5c8df91beb116db634843cb6a2dcea60edf84160378e251942e977fb2b35c5af20dff4
TLSH
T11C51AFF7D3E4867D895096F4EB156E1FCD7D0924132C3CA288D4AE5B53E2872D24178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ce87b473cc3278515fc2d982ddf5b02457ef34e22563a9aaeaf152862084b65b
MD5 ee8ab2a331c46a0433f7dae2c47f51b6
SHA1 0a6517c28e8c7ac63b9c608329e8008ded401b96
SHA512 173030f856aa1c011919452bae8cab49706ee4f388da22ce3dd63b525d0209f3b01be93bdb5bdcdcc3bb8acd5c24cf026d49dca054b32f80ec2d4b991d11eb9a
TLSH
T1895189F7D3E48A7D855196F49B256F1FCD2D0A24022C3CA6C9D4EE5B53E2872D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 5e9f5c787452671c0174156fee46e67007b387ad7ecf4ac3a9e2076b4490dbc6
MD5 e8ad6005ea598e1dd54a6f14a8fae0bb
SHA1 81f435ad4c90358514edaac8a425350e3e32044c
SHA512 84e2d2866a1d958aaacffc45980d766a382abe2a2faa46cbdb7054ef6a7b21a73ce3cc1cc185636163198a0bd6bdadc9ee4d5f6632c8d5ba48ecbf4d4cc90422
TLSH
T17BF059A7D7B9B06310F949AE0D047C0A7DB6A43605811CE1DFAA817DE0D24E31B02457
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 560803dd2ba820604bd3e231e1c3b8126340ec582bbc51c3b5a1e48e8f6c05ab
MD5 7bb9d2882b753064881bb21737c32986
SHA1 33b4d0a139e84aa6e218e3af8d847aeafafa8b33
SHA512 a4c7238506f3ca59fdac5f62072a4ec6c6efcaa8a1daaac1c01538431c2ac28ccb863e19806cdf708e293bb8dd96d7201a1a03bb4aa5892c6473b75d165aeefb
SSDEEP 192:GR+bItp77aJ0Mv7mpAPRp2n9EHsb+WNnax0zkuYgP6VyIsnAUgtaJ:GR+bc7dYaUXAaw40wuYR8
TLSH
T1F442C53EAD14653B5CCBD229F9267B53D7F6103220D51E88E6FC9A2C29E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 73479802dcb07292d3e2ab66370a62e262edb15211fa790dd4922397d508f410
MD5 67ee809d8bc2a3b10e51bf9a2f12fbd4
SHA1 4cec1b16a859f0e4743f8e2f58f2e4cb53ed1dcc
SHA512 7cc8e6bdeff0a0702afe9ccd539aec54f3e65efe194d1884997bf367cb9da8a822862d52bb7c6b48c16f566f99366b07d05224754a01685fc165b09f48857526
SSDEEP 192:GR+bVtp77aJ0Hv7mpKOPRpDln9EHsb+WNnax09kuYgPDVyIsnAUgraJ:GR+bp7dPacQXDJaw40iuYAe
TLSH
T15552C63EAD1465776CCBD229F9667B53D7F5103221941E88E7FC9A2C29E76CC222301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 092b96876db795c982786c3058673527256273cc8e74a1795737143c5c77a0e7
MD5 5cfab50bea825ad8da0bd0e42062d999
SHA1 5302d982579df132eb9c37d3771f3ea25dcbba57
SHA512 1ee86beb586718c5ef5b84af10254bf59d801334bcbb158bcf93551c28d99048239d3d14c7e674162e6c304e3f43e4ba62c9d5d97e45bd950a1cb52a6b879998
SSDEEP 192:GR+bItp77aJ0Hv7mpAPRp2n9EHsb+WNnax0LkuYgPFVyIsnAUgraJ:GR+bc7dPaUXAaw40YuYUe
TLSH
T17E42B63EAD14657B6CCBD229F9267B53D7F5103220951E88E7FC9A2C29E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 78f2b9e9ebc08798880cb4679beee8aef2e584a4e9691c5edb1c0165ca1273af
MD5 f3fb909317ed06709bfdddf6e293f823
SHA1 f9840b19b75e8120807aa0784c1bde6154aba029
SHA512 4bd189ef0e2f72445f5af07954ee4d6ebdcc450090a92b283a2c281a3cf530c9eff525dfd48ea12519fb7f49e455434598bbe11f388dcada8c12c9ada348e50c
SSDEEP 384:7NjnO7KxkXqKf/pUZNCgVLH2HfgslOv7pLuLcSjZkXODnq+ErU3BHHGu/n0To:7NnO7KxkXqKf/pUZNCgVLH2Hfgs8v7pU
TLSH
T18172E9A76C4C9E370F94CACCDC1A7B4FADB6024B65E9886443FA582503D5ACF114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 89676419e0afe62beffc974cf3dc4464a2b63aa3dc316e68de6efb0ae24bcf10
MD5 3c922098acf1c69b00b5dd082e26ec4d
SHA1 d8f2bf7dee430261f96ad31cb752081d055cbe0a
SHA512 b181b76db5707d0da629810424f326fe4fff9c127fb9037c638f654c6e972110ba1c054602e58eb1f03ecc3b0f030e24d368614b4c5a2db5d7f1442eb52452ed
TLSH
T1D6B0120180016101C04302F01182549872185F11EA0A2B0653E06A66CC252A38035050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b5a71.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b5a71.TMP
Size 96B
SHA256 e6cad89eee6003ce89a371da75df82c966614f4efe10b52f97cab2d997c18eea
MD5 889e3404dceab122f4f986a25bc6fdbb
SHA1 32b69deacc216218e19d6a1b49102f20785cb559
SHA512 0ce993d88dc68e36b9b7604e27296430fd48fcb54d2a7dc92e50347fb9e11b8028e28f4532ae6a7c5eb0948e33c7d49aa881371c1f31c7b11ebd7afbc520a019
TLSH
T16AB02228C002A202C02203F02CAAA0E83028CF20C203020EC2F00F3ACE2A23000200B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a6118d3dc0cf8186ea5d2fce1964db96ebecebea4cd05970b6410a6002c06141
MD5 cf9a70be930e67d8e4f7b71f96093a02
SHA1 18d162380762f0fe18b53b96b901846abb45ae22
SHA512 ebe365ea8095e9187b6d57f5190bd8dad6fd813458534267de08711144576227c34c440f16ee805e4096109f620ba5f95367a9fa466570a221bfcd745124d06b
SSDEEP 3072:3NGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:3Em7Rkm1tYpBeh2BAoi
TLSH
T1D6C3123B5E74E93B5C75BB4EB08E0B1E1EF149A6C920DA92C8D85B0437FA7CC1A05974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 a6f85a1ea37dafd0a70f82ee4c85ac397f76be27bfd09d815eab44838d6b6261
MD5 5ca081b0556e67a367297a45da4baca1
SHA1 6e6087d30529d445653a0fa1304108ae94ec523f
SHA512 0c563cfee07d1606a96e38922a0299b30248e2ca8e767725e213db1fcf978a9b93df0e590e8b73d78602f12c78f2e7204a4be8ec6fabb74b2c3c97ea52957c18
SSDEEP 6144:bC+SY2cepgzImfqQEzhSrjm7Rkm1tYpBeh2BAoB:beXKzfqQ4Y29oBGcAoB
TLSH
T1DC3412628D71AEF345E5B70E704E1E0A1FB1C69AC448CBE6D4D84A0C3BDABD8195DE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b2c0dfe6cc8f6476fdd03847adb834c5888c632f47631e953401526ebcc8463d
MD5 6ff169a1b1488a708cc53b31d902ac52
SHA1 098f45fb110921a7491b90539f976d9ace1bb9e7
SHA512 bd7871ec042fcdcad22061ed8072b7451269806b098c2d2f423abc28d90c42cff56e575be78086f93032e8222e6b59580bb8176e82e54272a17b0d88d0c64844
SSDEEP 3072:LFGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMT:LMm7Rkm1tYpBeh2BAoT
TLSH
T139C3123B5DA4E9375DA5BB1EB08E0E1F1EF149A7C824DE92C8D85B0437E97CC1A09934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 279KB
SHA256 9c6db6b2ed0fd1f644429097b6c29f03bff3812402cc39046043efc3e9896fe5
MD5 4601656fa1996620132e2d3a27181d30
SHA1 9bb381495b98a8d0bee665428353601e94d8b721
SHA512 bb1b90aad643afeec9e4622bb44e0b52fb501a2ce6e39bb0610cc32e646f1d83b3953916b5e28090f47d643125ed9e0833d2c9dc061852097c9b3063f66dafdf
SSDEEP 6144:bIu6Oi+SY2cepgzImfqQEzhSrjm7Rkm1tYpBeh2BAoB:bapXKzfqQ4Y29oBGcAoB
TLSH
T1B45423728CB1AEF70DE5A70E704E0A4A0EB1D697C40CC6E6D8D85D0C36997D81A5EF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 6cb5a3ea61367801dc71fb895f641edff26248bfdf3e32a97d9735aab45eabce
MD5 3ffa2ef090b127f605e91e3c250cf3d8
SHA1 8d88f1085f220b931c6ba7e08f163b8b93415885
SHA512 e9a09db481273118382b207ea010954d877d28e72336f00b61d6e6947e880a391f18dd6f46810d7be8e0e9b096978d9bc51b648a754b5d3f7fd5a5523d3cb032
SSDEEP 6144:/y+SY2cepgzImfqQEzhSrjm7Rkm1tYpBeh2BAoB:/uXKzfqQ4Y29oBGcAoB
TLSH
T1E83412729C61AEF345B5A70E70490E0A0FB1D69BD44CCBE6E4D84E0C27DABD81A5DE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download