hxxps://roblox[.]com[.]py/users/5578985539/profile

Resubmissions

13/06/2024, 14:30

240613-rt67sssfrd10

13/06/2024, 14:20

240613-rnhl9asdrb10

Analysis

max time kernel
44s
max time network
130s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://roblox.com.py/users/5578985539/profile
Sample240613-rt67sssfrd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1860	chrome.exe
1860	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2108	1860	chrome.exe	28
PID 1860 wrote to memory of 2108	1860	chrome.exe	28
PID 1860 wrote to memory of 2108	1860	chrome.exe	28
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2488	1860	chrome.exe	30
PID 1860 wrote to memory of 2308	1860	chrome.exe	31
PID 1860 wrote to memory of 2308	1860	chrome.exe	31
PID 1860 wrote to memory of 2308	1860	chrome.exe	31
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32
PID 1860 wrote to memory of 2628	1860	chrome.exe	32

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://roblox.com.py/users/5578985539/profile
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef78f9758,0x7fef78f9768,0x7fef78f9778
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1208 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:2
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1552 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1664 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2140 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2148 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2836 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:2
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3176 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3312 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2304 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3048 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:8
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3336 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2672 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:1
  2⤵
  PID:2904
- C:\Windows\system32\msdt.exe
  -modal 262522 -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\Admin\AppData\Local\Temp\NDFD182.tmp -ep NetworkDiagnosticsWeb
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2440 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2660 --field-trial-handle=1352,i,14974991192430699131,16682373211890436898,131072 /prefetch:1
  2⤵
  PID:2216

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1436

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
PID:3504

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NetworkDiagnostics.0.debugreport.xml

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061314.000\NetworkDiagnostics.0.debugreport.xml
Size 65KB
SHA256 72647c6a61ca3c92a9430038091fa231b61537398a897297d80b02986591775a
MD5 77be50aa62a2d58020adbb0f1c2d63d7
SHA1 9cb8dc04714f11c6264e5464640a14fb1a22e7f8
SHA512 0d85ea47c611197f14f9edb08b700a903338c9cae271c0537c54bc4687413c5de0260fc22ed48cdf8b58fabf5ff00b4902e99b985a289868b1c4d38939cfa3dc
SSDEEP 384:s992bq8Hk1Ro8qN/RxGOA/zOA/wOA/5OA/H/R+LdA/bLdA/oLdA/xLdA/lCLdA/P:sH8HD8wj9QDLhIq3IsM
MD5 SHA1 SHA512 SSDEEP

Submit Download

NetworkDiagnostics.1.debugreport.xml

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061314.000\NetworkDiagnostics.1.debugreport.xml
Size 7KB
SHA256 14f40490e1ccddb5b4166d69e9f8e7d67503c3bc3325fa762b881dabbe003897
MD5 847f35e1e87d2dcfe16a2cbb86be422e
SHA1 17256cd9fe0bcc54d2df0a27896d405e927c2082
SHA512 7b26d9060819ab2075bf76bb094d9abbd0439585e43d4e8ad995a7850d00dc832991cc9be4af985d8d1edfe300c2d5c27c1b0e88554a2d4f103d70413371c511
SSDEEP 192:segelbX66MS6MuYRDGJ3NGc66MS6MpbSPV:se9lbq8HlOo8qN
MD5 SHA1 SHA512 SSDEEP

Submit Download

14505e3b-c1bc-460a-8ea8-d02edcf9a0eb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\14505e3b-c1bc-460a-8ea8-d02edcf9a0eb.tmp
Size 142KB
SHA256 15d2a8a52dfc1b1adc437b392ba33ee8c0cdce239d397381648fc87f867edef4
MD5 5bfc6cc7eed78da5a3f8ff656568cf76
SHA1 6160a301e7bd4ae11a15b1ebf8cbe335613741e5
SHA512 e3647971019de18a253cbd1077134e38164eb002e35ba6cf28e3e30bed0e5592ee91ec41817a1669280a6bd16dad1b3374e25637c9ed507f9293738f986f1928
SSDEEP 3072:lagafI7yWKuQ90N9+8vZVyB3GB1n4qyTEQmfef0M8Rum:lavgOWxy0NjZ314qyTEnTRr
MD5 SHA1 SHA512 SSDEEP

Submit Download

000006.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
Size 16B
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 fa07267a7b8f3e829ad451c290998a1b558a144cdf0b0034866c9c85e8561c8c
MD5 db3b08de7bf6c21ed128843f76eba30a
SHA1 10613538191a1895d6455d8ec3331f39a3b28cb3
SHA512 b3feb629f2074d718ca5c7f55b7a926d9baf9444c845f731a171a3fb97cee39587e593456d6e03c828fedf3f4e6677b8e4c07293ef1ddb0ad07f92babfe134bf
SSDEEP 96:mR1IKIo8ieMd8iZRy7Di+6Msmde9IOHlm5dwjVhYtjEsXt0/cg2Vup:m/Ia8syy+FI/otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 b197270c07e07daa9e0efcc29dfada10672da833ac20df36d558c0e8bf3176a0
MD5 aa8d85f073f090ddf1bd9ea01f103ddf
SHA1 dfcc1aa9121127976bb71e7bf437d0c89882b261
SHA512 7e5f44974b0e9736f0b08fcb26705143db3dd002aada46e6ae4d84dc3aa70a109ea2ef8bd2c138924a302784477f70660b14fccde04df87fd2970c3f889f3cc9
SSDEEP 96:mR1IKIo8ieMd8iZRy7Di+6MsmdeiOHlm5dwjVhYtjEsXt0/cg2Vup:m/Ia8syy+F2otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

000007.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Size 16B
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 140KB
SHA256 1fdc05bb2cf753d9aa6c7afe5e0e0192fdf80b3d4c822514dd73912dc31a3db3
MD5 ab528f6f896af0f24c00510a8a452e41
SHA1 edda5008d99b7872f262144240fe3da34633ab71
SHA512 ae95f92e05b1c2673a0b0dfa49ed89190b8e797d0d74e4ce3c7c7f20701f92608b8d1085a8a07cc0946e252b5626378c735e30a004d0297bd45a3e7c2acbff2f
SSDEEP 3072:3igafI7yWKuQ90N9+8vZVyB3GB1n4qyTEQmfef0M8Rum:3ivgOWxy0NjZ314qyTEnTRr
MD5 SHA1 SHA512 SSDEEP

Submit Download

NDFD182.tmp

Path C:\Users\Admin\AppData\Local\Temp\NDFD182.tmp
Size 3KB
SHA256 4e9c29d67389a4ab13bfb0d3a4360de6852c9bdfa8b7a1a4cda2b5c8a099d657
MD5 666f8de303f629004d8c5192b919de5a
SHA1 4d79659106c7b29d22923884680295c4882221cb
SHA512 b20c57cc1fa4f4084f5729b6b413131fc8c8e3270c624a552ef777e354d11c79a79a3cc1e9919a47c21dda63368f22f5eac555a911ed1d1cff22edc4aad9777d
MD5 SHA1 SHA512

Submit Download

NetworkDiagnosticsTroubleshoot.ps1

Path C:\Windows\TEMP\SDIAG_b6119c74-e6bd-4b75-a450-4db924525ce0\NetworkDiagnosticsTroubleshoot.ps1
Size 23KB
SHA256 935a231924ae5d4a017b0c99d4a5f3904ef280cea4b3f727d365283e26e8a756
MD5 1d192ce36953dbb7dc7ee0d04c57ad8d
SHA1 7008e759cb47bf74a4ea4cd911de158ef00ace84
SHA512 e864ac74e9425a6c7f1be2bbc87df9423408e16429cb61fa1de8875356226293aa07558b2fafdd5d0597254474204f5ba181f4e96c2bc754f1f414748f80a129
SSDEEP 384:XlSoNnCiXTq6rZTvxlBNexnKmh+sudfByHNQGJ:1SoWh3uKiq
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartDPSService.ps1

Path C:\Windows\TEMP\SDIAG_b6119c74-e6bd-4b75-a450-4db924525ce0\StartDPSService.ps1
Size 567B
SHA256 d19677234127c38a52aec23686775a8eb3f4e3a406f4a11804d97602d6c31813
MD5 a660422059d953c6d681b53a6977100e
SHA1 0c95dd05514d062354c0eecc9ae8d437123305bb
SHA512 26f8cf9ac95ff649ecc2ed349bc6c7c3a04b188594d5c3289af8f2768ab59672bc95ffefcc83ed3ffa44edd0afeb16a4c2490e633a89fce7965843674d94b523
MD5 SHA1 SHA512

Submit Download

UtilityFunctions.ps1

Path C:\Windows\TEMP\SDIAG_b6119c74-e6bd-4b75-a450-4db924525ce0\UtilityFunctions.ps1
Size 52KB
SHA256 886a625f71e0c35e5722423ed3aa0f5bff8d120356578ab81a64de2ab73d47f3
MD5 2f7c3db0c268cf1cf506fe6e8aecb8a0
SHA1 fb35af6b329d60b0ec92e24230eafc8e12b0a9f9
SHA512 322f2b1404a59ee86c492b58d56b8a6ed6ebc9b844a8c38b7bb0b0675234a3d5cfc9f1d08c38c218070e60ce949aa5322de7a2f87f952e8e653d0ca34ff0de45
SSDEEP 768:GaDgc60Ftok2UMeV6HQEqEVBWMBIRe9HdNh5BIW6Mk7svkxtFPuAQ35:V0aUubKcW6MkcYu1
MD5 SHA1 SHA512 SSDEEP

Submit Download

UtilitySetConstants.ps1

Path C:\Windows\TEMP\SDIAG_b6119c74-e6bd-4b75-a450-4db924525ce0\UtilitySetConstants.ps1
Size 2KB
SHA256 de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f
MD5 0c75ae5e75c3e181d13768909c8240ba
SHA1 288403fc4bedaacebccf4f74d3073f082ef70eb9
SHA512 8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b
MD5 SHA1 SHA512

Submit Download

LocalizationData.psd1

Path C:\Windows\TEMP\SDIAG_b6119c74-e6bd-4b75-a450-4db924525ce0\en-US\LocalizationData.psd1
Size 5KB
SHA256 944186cd57d6adc23a9c28fc271ed92dd56efd6f3bb7c9826f7208ea1a1db440
MD5 dc9be0fdf9a4e01693cfb7d8a0d49054
SHA1 74730fd9c9bd4537fd9a353fe4eafce9fcc105e6
SHA512 92ad96fa6b221882a481b36ff2b7114539eb65be46ee9e3139e45b72da80aac49174155483cba6254b10fff31f0119f07cbc529b1b69c45234c7bb61766aad66
SSDEEP 96:cM95mw/9nwbgDwlwn0iYveuQzRkkwj0pD+Eij4FvJG5B9c1rO4L:cM95ZklGeKxGfw
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagPackage.diagpkg

Path C:\Windows\Temp\SDIAG_a4f03889-c24b-4782-b78f-195951a72566\DiagPackage.diagpkg
Size 152KB
SHA256 cde728c08a4e50a02fcff35c90ee2b3b33ab24c8b858f180b6a67bfa94def35f
MD5 c9fb87fa3460fae6d5d599236cfd77e2
SHA1 a5bf8241156e8a9d6f34d70d467a9b5055e087e7
SHA512 f4f0cb1b1c823dcd91f6cfe8d473c41343ebf7ed0e43690eecc290e37cee10c20a03612440f1169eef08cc8059aaa23580aa76dd86c1704c4569e8139f9781b3
SSDEEP 384:UCBU0j+j+jfjgrj+jmd2mD2kyEPttbkcL5Efoh7DfjhUfohpq2fjhMq0fjh8f3hw:S0j+j+jfjgrj+jmzh/i
MD5 SHA1 SHA512 SSDEEP

Submit Download

results.xsl

Path C:\Windows\Temp\SDIAG_a4f03889-c24b-4782-b78f-195951a72566\result\results.xsl
Size 47KB
SHA256 67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c
MD5 310e1da2344ba6ca96666fb639840ea9
SHA1 e8694edf9ee68782aa1de05470b884cc1a0e1ded
SHA512 62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244
SSDEEP 768:hUeTHmb0+tk+Ci10ycNV6OW9a+KDoVxrVF+bBH0t9mYNJ7u2+d:hUcHXDY10tNV6OW9abDoVxrVF+bBH0tO
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagPackage.dll

Path C:\Windows\Temp\SDIAG_b6119c74-e6bd-4b75-a450-4db924525ce0\DiagPackage.dll
Size 478KB
SHA256 d2ff079b3f9a577f22856d1be0217376f140fcf156e3adf27ebe6149c9fd225a
MD5 4dae3266ab0bdb38766836008bf2c408
SHA1 1748737e777752491b2a147b7e5360eda4276364
SHA512 91fb8abd1832d785cd5a20da42c5143cd87a8ef49196c06cfb57a7a8de607f39543e8a36be9207842a992769b1c3c55d557519e59063f1f263b499f01887b01b
SSDEEP 6144:cZC0lEOC2Us6eEyAc0jbJYOjlCLHUZQsxjuaJ7oSEvcdfSc0jbJYOjlCLHUZQ:cZFLUe6vJ/wLIvavyfEvJ/wLI
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagPackage.dll.mui

Path C:\Windows\Temp\SDIAG_b6119c74-e6bd-4b75-a450-4db924525ce0\en-US\DiagPackage.dll.mui
Size 13KB
SHA256 030191d10ffb98cecd3f09ebdc606c768aaf566872f718303592fff06ba51367
MD5 1ccc67c44ae56a3b45cc256374e75ee1
SHA1 bbfc04c4b0220ae38fa3f3e2ea52b7370436ed1f
SHA512 b67241f4ad582e50a32f0ecf53c11796aef9e5b125c4be02511e310b85bdfa3796579bbf3f0c8fe5f106a5591ec85e66d89e062b792ea38ca29cb3b03802f6c6
SSDEEP 96:Y5lvlJmdYVotzW1xcFjPe/dQTVO/aaakBLQ9/5HgVqz+4ILRv88fR/CnGEUMefh7:YjP1xyexE8eoR4EBH9gWRRTW+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1700-455-0x0000000001BB0000-0x0000000001BB1000-memory.dmp

Download

memory/3504-462-0x000007FEF3940000-0x000007FEF42DD000-memory.dmp

Download

memory/3504-461-0x000007FEF3940000-0x000007FEF42DD000-memory.dmp

Download

memory/3504-456-0x000007FEF3BFE000-0x000007FEF3BFF000-memory.dmp

Download

memory/3504-862-0x000007FEF3940000-0x000007FEF42DD000-memory.dmp

Download