882fe8a479c6da04db35a3838bb3cc97a5d8ff880c3172ecb107d4b52702e39f

Analysis

user interaction
yes
max time kernel
900s
max time network
884s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/09/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
memensegratisfree.exe
Size 560.4MB
Sample260925-3e8b4aygpc
SHA256 882fe8a479c6da04db35a3838bb3cc97a5d8ff880c3172ecb107d4b52702e39f
MD5 83239a5b9bdc5a45706639165c1972d7
SHA1 5ea013863c211a9a9afb5c0b80817accb1ce1e18
SHA512 f501c05b699dc8f38f027374df1e6e86490d996af69b8f5f8b25bac01d03621abd8308f459bd6dd133eb46cd739fcfc3dfdd8ebfb1201ba097363919d9f6d0d1
SSDEEP 196608:oZvmxYiT0nquIsATZ5/e8GVQqvUsdTSL5/JCq12Zv6njfvH4ZAyPtg2:hxYBnquPATfRGeqvbdTSLXhYAyl5
TLSH
T17D59D08DD2F4B1BCC53DD43C4C540C16C3797C666B22472A2E56CEE969B30A92BFAB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	memensegratisfree.exe

Executes dropped EXE 1 IoCs

pid	Process
3564	bndA3FB.tmp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2436	3564	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bndA3FB.tmp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3868	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1044	chrome.exe
1044	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 3564	452	memensegratisfree.exe	80
PID 1144 wrote to memory of 2504	1144	chrome.exe	87
PID 1144 wrote to memory of 1500	1144	chrome.exe	88
PID 1144 wrote to memory of 1500	1144	chrome.exe	88
PID 1144 wrote to memory of 3868	1144	chrome.exe	89
PID 1144 wrote to memory of 1100	1144	chrome.exe	91
PID 1144 wrote to memory of 1100	1144	chrome.exe	91
PID 1144 wrote to memory of 2216	1144	chrome.exe	92
PID 1144 wrote to memory of 2216	1144	chrome.exe	92
PID 1144 wrote to memory of 2228	1144	chrome.exe	93
PID 1144 wrote to memory of 2228	1144	chrome.exe	93
PID 1144 wrote to memory of 1072	1144	chrome.exe	95
PID 1144 wrote to memory of 1072	1144	chrome.exe	95
PID 1144 wrote to memory of 2320	1144	chrome.exe	96
PID 1144 wrote to memory of 2584	1144	chrome.exe	98
PID 1144 wrote to memory of 3948	1144	chrome.exe	99
PID 1144 wrote to memory of 4568	1144	chrome.exe	100
PID 1144 wrote to memory of 1044	1144	chrome.exe	101
PID 1144 wrote to memory of 3260	1144	chrome.exe	102
PID 1144 wrote to memory of 3260	1144	chrome.exe	102

C:\Users\Admin\AppData\Local\Temp\memensegratisfree.exe
"C:\Users\Admin\AppData\Local\Temp\memensegratisfree.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Local\Temp\bndA3FB.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\bndA3FB.tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 252
    3⤵
    - Program crash
    PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3564 -ip 3564
1⤵
PID:3200

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97b99c728,0x7ff97b99c734,0x7ff97b99c740
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,16648823847836220505,3880003977323299904,262144 --field-trial-handle=1936,i,8511594329232200796,2561730481505979571,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,12030388940776537391,12237370207800068775,524288 --field-trial-handle=1936,i,8511594329232200796,2561730481505979571,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,17739541956109111448,10799184505094810155,524288 --field-trial-handle=1936,i,8511594329232200796,2561730481505979571,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,5442236052691127149,15580820031594524348,2097152 --field-trial-handle=1936,i,8511594329232200796,2561730481505979571,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,4801545458930475402,13689077893055659495,2097152 --field-trial-handle=1936,i,8511594329232200796,2561730481505979571,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4528,i,3657902192858854601,17319545637710108305,2097152 --field-trial-handle=1936,i,8511594329232200796,2561730481505979571,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5308,i,12564477856179562108,6784658522118423908,524288 --field-trial-handle=1936,i,8511594329232200796,2561730481505979571,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,14312692277836854685,6659794152183895865,524288 --field-trial-handle=1936,i,8511594329232200796,2561730481505979571,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,4729368121751495688,4959072378989593855,524288 --field-trial-handle=1936,i,8511594329232200796,2561730481505979571,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,8780356323606391493,13145212154461126068,524288 --field-trial-handle=1936,i,8511594329232200796,2561730481505979571,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5552,i,9442771785552432561,10894029910089721675,262144 --field-trial-handle=1936,i,8511594329232200796,2561730481505979571,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5524 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3088,i,2989829542427462935,14227029265267326038,524288 --field-trial-handle=1936,i,8511594329232200796,2561730481505979571,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3084 /prefetch:14
  2⤵
  PID:3260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ae7bd6881e79009e8b461a61c55e2be6029d7d9df21a88cd80faac6a73467e53
MD5 0a63a8c0bcde8930878a5d6999dbf9df
SHA1 c4d7b67159c51081a7017725b086f58e02ab9f9c
SHA512 afc70ea603208de62cf8ad699853346360953c72bc976dfeddc13887ebc6ffc2ee8ec895a008f36c1253695f668163a8be2d39d47f9bab3e19fdeef65e952ff3
TLSH
T148F02DB5DC20EC3718FD1B5D60645747EB50136B2B40958B3A3C950C4F75A3B4585C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 89c59729ef5ff4620436105adefadea0007eb462c528eb761381045891610663
MD5 9538c65e340ff4a98aac99efced92f01
SHA1 f22ed7e4ed928b51bc2879f3f1c0dabc5bddfc33
SHA512 ae0fa10894f12aaec37f7f8f2a1f583ca4269f7cb896c03aef283f8cc800c679541219d8db9808e50744853ed05daf5094df38269a2b4e5fba99684046928fd1
TLSH
T124518FF7D3D4867D891096F4DA116E1FDD390A18122C3C6288D4AE5F53E25B3D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 49dd1202eebbf04632e1b15eed052609288663c5f645ae53fd14b48d1165de76
MD5 e97b72f6863f6b9090486437d1e4fa87
SHA1 05a685dc732a7f89b6ce932aa26b7142685e6ad4
SHA512 e279363fe205ac966068e6668a356e61e82f589a18963566b449970099b9a7f90c4531b67f38137141e7ebff514788feebbe29b5b4fcbeba2ae28a00641765b4
TLSH
T144518DB3D3D48A7DC81166E49A217E2FCD7D0A28521D3C22C8D8EE5F93E2972D21134E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d3f702ec842ff76271978cd24f0533c349d9ae7d869292744f5df6de00829819
MD5 ee0e4bd352a0d29ea9e3b21f7de300d2
SHA1 4b643e12b01c5ed834c9b8089ef7c3f0bed76a4a
SHA512 72c5f4a35d88285adca113b7dea2bb57c1209a3adcdd1d6454644c9bb8072c78fefa4e6da42a54340a663eec14d634c5c7c51f6e607bd318b7fd9d20182550f9
TLSH
T10461AEF3C3D4867DC81166F4AA217E2BCD2D0A28522D3C52C8D8EE5F93E2472D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 5bea209244760a6f602c83f10476075955648391a803874c31cede41c475635d
MD5 fe17508e4b811d03b88f2e42567b9a8d
SHA1 623353e15a29b06217540ad52b85e9a566dfd772
SHA512 468b5278d6d592de765cf5c1de31f2d9206784667982a75522537acb889f648264cb01811bc51715295f43d1b602edfd139394d85db996365bfe39ee382d8904
TLSH
T1B5F050E7B77D78A320794AAB1D1478056DBAE434014578F0CE6A832DD0D55E71B02057
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4ca80484108cdf9ff10325306acb86208a4dd76266ea8c454dd64057efc3c028
MD5 fa758ba2fba893686f5d040719c04c22
SHA1 f0d9641b217e462c4406b42394735ec7c3cf4f20
SHA512 95e6e8cb75deea2aaaf26f3999d382d242e9deeccb3ac41e8931eaca80494ae5127799c004fb6e6f87d02376948531cc9cc5e88bd9c8b5b664aa2cdb296be093
SSDEEP 192:MRA3RjQv7A3pAPRp2Y9mHsb+WNnut0XZGea2wEkVyIsnAUgtaJ:MRA3pMk3UXngww0E2Vg8
TLSH
T13B32932DBD20753B5CDFC21AFA617B53D6F9102260992E84EAFC8D2C25DB9CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5563f23a03697a45d4cffb1c2db1e487410b5c7d7b13df42809bf83476b3e857
MD5 9c72f086056fc8d35ee58f11c3d675a4
SHA1 4b9160eb31253c3caee059cb36d08220f9ceedd8
SHA512 8ab1a58ee28d0ba945e0ff0732ada5e635a39394ddaa455bfc4235f09b0a595236223ce77c16b9d0e5dcd44a3234b466e45aad5148187c478e1bc15ff0adbfbf
SSDEEP 192:MRA3Ljvv7A3p+PRpsY9mHsb+WNnut0tMZGea2w8kVyIsnAUgraJ:MRA3Hnk3GX1gww0tN2Xge
TLSH
T1BD42B32DBD20753B5CDFC25AFA617B53D2F9102220952E84E6FC8E2C25EB9CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e9abb24acee39b6884a4d6e6120f624d77bbf00aea1534ae3792054febde4d66
MD5 670e635358a9ce27210eccadd0696f17
SHA1 d3fe1fc79d7b09e829b357e35a661307c56273f8
SHA512 b2db3071931030f7ebf88690623f097e137db71c493072c3e3850872320e4b7441ad053460ca43cef72eddb2b5b1660e242cdf775a229727e6f1675a611dab51
SSDEEP 192:MRA3Rjvv7A3pAPRp2Y9mHsb+WNnut04ZGea2wokVyIsnAUgraJ:MRA3pnk3UXngww0R21ge
TLSH
T19E42B42DBD20753B5CDFD21AFA617B53D6F9102220952E84E6FC8E2C25EB9CD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 037243e15dd25591f860c1c61fd408de2727712a22296996cb394973954ce636
MD5 943fefd4b27513788d68900b258713cb
SHA1 beb3c0cedb7be026513e207a7db456501526e101
SHA512 401fd739432fb06ee9817d0981278e4d4e877195fd12c4e9d14d090a3db3e182ca7c7f1a6259c1dd2d29348c5c3ee988baeb3e5e468a598f4355a0674fd5603d
SSDEEP 192:MRA3Rjvv7A3p+PRpsY9mHsb+WNnut0tMZGea2w8kVyIsnAUgraJ:MRA3pnk3GX1gww0tN2Xge
TLSH
T12042B32DBD20753B5CDFC25AFA617B53D2F9102220952E84E6FC8E2C25EB9CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 183080ab87b58b695e03979ec4d826a874606e28a558a00578c46ede242e7bf3
MD5 39a15f899b72a397b11f40acfbc1cab5
SHA1 54ea4d4be93f1b6a15ebebef9ff229a0e0838199
SHA512 ae62798f9b7b81e80405e993f6a7544bedbadc35071157fe0803ce0777504d53675849ce53ae3c5baed5676cd4fd0e8f6fd749ac3f569ce5cb24b1aa748ea364
SSDEEP 384:FPjxk7KxkXqKf/pUZNCgVLH2Hfgsli2XODxM+ErU3ucHG4YiBknjE:F7xk7KxkXqKf/pUZNCgVLH2HfgsgcOdJ
TLSH
T13752F827684C9A7F4FC8CA8DE8536F4FADF50147A168093856FB9C0903957CE124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 eec596540ff7ca3215b744c3c7acc085835fcaec92459727276b98e9f8707f4b
MD5 275ba5666fa681bbc7dca66e5408ddfc
SHA1 a860d1790bce4c4ddc78ef43f4b5d516f3b3adda
SHA512 eda5360aeb5f1fa2a13a3b343920f24edf8591b263f1c3b821f648a6a6eb29bc8cc4708ff236dbfdd19ad189f76dd55ac0524544fdf8f2059f393bdd726e9b6c
SSDEEP 6144:4tEVjEfT5CCL9A7taB1o3wxluaQpp310nStt4fLJ0L6nGJxi3bzqapJjD:DNEVLBARaBWeOh+StWXUx8zvpJ/
TLSH
T1024423F1D980FC6A8BFBDD9125292D250FB2D59488CE786409F1CC861ADBE614E27C73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 b458213df7fbb17d7ce488699f778105cc1f86f136a65f1c5d7c00837d86cae6
MD5 d346a8b7a78413ca5115b37330a5c411
SHA1 79c222ab261078be2d028cb5588221fd0bdb85d7
SHA512 936e7861ddf5a83998beee96715283a8cadbb4f68f53fea5748a463dfdb73838b32722797bcc01b3b2a336aa356ef69cbdd213f362ea62155bb56f3e78817aa0
SSDEEP 6144:Q3tEVjEfT5CCL9A7taB1o3wxluaQpp310nStt4fLJ0L6nGJxi3bzqapJjD:ZNEVLBARaBWeOh+StWXUx8zvpJ/
TLSH
T1904423F1D980FC6A8BFB9D5414193D210FF2E69488CEB86819E1CC855ADBE614E27C73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 017ccb498701cbabb5b3c9777e7e217fcf57c97dcd1864f69afc585809e88e37
MD5 e756af5ec2b6e7cb993527c687e1a639
SHA1 9b6da2a5845425b3ecd2eac443ad136e492e1857
SHA512 9d619a10d311c5d4a5a09e5ebe3413425941b04d7def45f596ea5148a6595c339ef3cfeb2f8ed4f1b75147623e135a45190676d2c41c8743ab4d81b031fb538d
SSDEEP 6144:btEVjEfT5CCL9A7taB1o3wxluaQpp310nStt4fLJ0L6nGJxi3bzqapJjD:eNEVLBARaBWeOh+StWXUx8zvpJ/
TLSH
T1954423F1D980FC6A8BFBDD9125292D150FB2D59088CE796409F1CC861ADBE614E27C73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 d6e617c2b6719972a5e7377cb103fe4e99552096acd3553f9427afb6bd9add0a
MD5 89de6966741749f94351ec8a1300ce64
SHA1 68cd2ff415823ac7ee2ea395c90a32ef08382805
SHA512 feb21606283f2c177f1b69f8f5e9ed98831221ebf05629df4d25f5ee7d51547d5f587502b9ea99d9b645238ded1299daf1d91ab261174753a2af7b256b072851
SSDEEP 3072:fH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjv:Nt4fLJ0L6nGJxi3bzqapJjv
TLSH
T1B1D312F0C1A06C7ACBB7EE8145755E948E71D5C689CDBE2405FD8C18068EA750E17EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 ae5919406ea75f08d323787fa97d3ee7bb38920f93a1ddca89ec0b3065e99c0f
MD5 ac9c39ed700d17212a9fad3bcaa6064e
SHA1 3169c435c0b583614a005159307f64bc271bef50
SHA512 fc8c250f80b675456f3d00966e5e14699cdde8b190a99272d1c2d2867533a50e6dc8225a9782ecc041d068a162b04207c7f410e672066b3c22134977e3106773
SSDEEP 6144:M3tEVjEfT5CCL9A7taB1o3wxluaQpp310nStt4fLJ0L6nGJxi3bzqapJjD:1NEVLBARaBWeOh+StWXUx8zvpJ/
TLSH
T1074423F1D980FC6A8BFB9D5414193D210FF2E69488CEB86819E18C855ADBE614E27C73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bndA3FB.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\bndA3FB.tmp.exe
Size 599KB
SHA256 11e50f88499ead9da9d4b0b6c062651181f28df1bf1078c5d69bdf55a836b370
MD5 212d6f0d9e544c346f8dae39d0acd06d
SHA1 5b84c04a9c2f24d7eb911b452b1d4db045db0f82
SHA512 9c588fb30d487e13c88e500f35285ed071bcd544231b049410a31beea01810b7915c758a26e6c57013a04e46dca7cab3486c1b231fdd48d736d8e1050d7e1cad
SSDEEP 6144:kraXZLrtHteAO/MkeIdtuE5dqkBfyboyZV:kmpHepjqkBfybZV
TLSH
T189D4F5233FA5DD98C1187D3A69F18737B7368E250D4605237E123F339A71DA8EB92684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download