f926fa387dfbe2cf3e9d08f50c034aa3d6a010d5f300e5aa627ac8b12ad6ac39

Resubmissions

04/06/2026, 19:52

260604-ylm8aadv3w8

04/06/2026, 19:46

260604-yhcmdadt3t7

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roblox_External.exe
Size 14.6MB
Sample260604-yhcmdadt3t
SHA256 f926fa387dfbe2cf3e9d08f50c034aa3d6a010d5f300e5aa627ac8b12ad6ac39
MD5 d9267619a0cc142702ee05a40f102f66
SHA1 2caa3b78844fb169c34fdeedd4941d828edc8be4
SHA512 9cb32dbafe54646531a1262943be55328a60b67366967319b166b747d4c042edcbf4686b4a6e5752eab2f89125c0b47431e100d3581624e88302a67b96519d37
SSDEEP 393216:J0u/flmNP6ly03E16+PQsMQMX8kT+olIDmonw6KySJHGBoXYobEkovI:JZqPQ68xIDf3SJHD+lI
TLSH
T197F6E10CA5B719ACDFB1D5F8592A2217F21678CC0BB45AE357C809E11E527EC1ABDF02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1636	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250760870467373"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 5476	2172	chrome.exe	89
PID 2172 wrote to memory of 2820	2172	chrome.exe	90
PID 2172 wrote to memory of 2820	2172	chrome.exe	90
PID 2172 wrote to memory of 1636	2172	chrome.exe	91
PID 2172 wrote to memory of 4668	2172	chrome.exe	93
PID 2172 wrote to memory of 4668	2172	chrome.exe	93
PID 2172 wrote to memory of 1420	2172	chrome.exe	94
PID 2172 wrote to memory of 4812	2172	chrome.exe	95
PID 2172 wrote to memory of 1420	2172	chrome.exe	94
PID 2172 wrote to memory of 4812	2172	chrome.exe	95
PID 2172 wrote to memory of 3592	2172	chrome.exe	96
PID 2172 wrote to memory of 3592	2172	chrome.exe	96
PID 2172 wrote to memory of 5636	2172	chrome.exe	98
PID 2172 wrote to memory of 5636	2172	chrome.exe	98
PID 2172 wrote to memory of 1580	2172	chrome.exe	99
PID 2172 wrote to memory of 1580	2172	chrome.exe	99
PID 2172 wrote to memory of 472	2172	chrome.exe	100
PID 2172 wrote to memory of 472	2172	chrome.exe	100
PID 2172 wrote to memory of 4880	2172	chrome.exe	101
PID 2172 wrote to memory of 5708	2172	chrome.exe	103
PID 2172 wrote to memory of 4876	2172	chrome.exe	104
PID 2172 wrote to memory of 1864	2172	chrome.exe	105

C:\Users\Admin\AppData\Local\Temp\Roblox_External.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox_External.exe"
1⤵
PID:5304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3376

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcaee8c728,0x7ffcaee8c734,0x7ffcaee8c740
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,3060782134929411356,13421486378346559168,262144 --field-trial-handle=1896,i,14713442441578268216,15647883753207441033,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,6202535084958284205,14609287237953026738,524288 --field-trial-handle=1896,i,14713442441578268216,15647883753207441033,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,13070378714988149737,135292574643729632,524288 --field-trial-handle=1896,i,14713442441578268216,15647883753207441033,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2396 /prefetch:13
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,4380166662505128775,14649216611226128811,2097152 --field-trial-handle=1896,i,14713442441578268216,15647883753207441033,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,14690954067463464876,13702302723069279989,2097152 --field-trial-handle=1896,i,14713442441578268216,15647883753207441033,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4284,i,9904846527752547623,14637992398841056186,2097152 --field-trial-handle=1896,i,14713442441578268216,15647883753207441033,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,4863353212754616260,15479076311141204916,2097152 --field-trial-handle=1896,i,14713442441578268216,15647883753207441033,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4264,i,4098254946667986055,12742579614183560976,524288 --field-trial-handle=1896,i,14713442441578268216,15647883753207441033,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4920,i,8976763434383987966,1211553980950179539,524288 --field-trial-handle=1896,i,14713442441578268216,15647883753207441033,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,12558653693009931024,12303393354639113483,524288 --field-trial-handle=1896,i,14713442441578268216,15647883753207441033,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,9938218318094605775,1287096102824623303,524288 --field-trial-handle=1896,i,14713442441578268216,15647883753207441033,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,579015177886903978,1620122772878350004,524288 --field-trial-handle=1896,i,14713442441578268216,15647883753207441033,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,10166684839198304598,6969579564522670183,524288 --field-trial-handle=1896,i,14713442441578268216,15647883753207441033,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:1864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 33ebb21b6a5a5b81c4c2f173a15f24f7047a07e6579b4fd5991b5bb1026cb17f
MD5 f0283617e22b41e481bfa53356dbe4f4
SHA1 ddbaac311aea0d0d85701cdded020850479c3529
SHA512 0883163ddef86f6cff5c936ed4a32daed3ed8427073f03fd721e63be3f70abe3bf1e6b5ca6dcf27e99cb9439aaa7b2675fa524e5aa094f01672f340e35ebb623
TLSH
T14E518CF7D7D8867D8901A2F4AA256E2FCD2D0A14132C3C56C8D8AF5F53E2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dfa90e3414dc5218f230c29e44e18bfdaab172b7368f6b23d4ab7c77ad25515e
MD5 da1c1f662b614c356e414695c63a1973
SHA1 97066f6e6a390b2b9ca3f723b4c64ab39f4d317a
SHA512 6b178d510f498f7a64a152aed3cae8f993aea6ac42cdbbda5d84d3a05c3e63aa4e5cfe5941b496d17fa7b632ec142d7c270cd04aab35f2644fda014408763ab2
SSDEEP 192:qRNrvXdimi6ZJ0PkO5v7HpAPRp2y9DHsb+WNn0c0o6+dkwl+VyIsnAUgraJ:qRNDtimi6akQjUXR5wz0GF2e
TLSH
T10C42D83EA9106A7B9CC6D219FE657B67E7F4103131D02E88EAFC9A2C15E75DC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 df4a118bacac6c2d6f20926b72fc7bd67b6e8597955836b92c0a335e36bf811c
MD5 c798d4675a1b1cd78edf1ee6f49aaf5e
SHA1 8d9794ee3969421a35de5df416e7f208999da470
SHA512 498bec7720b4bcd2145c63957274286d0cf0c18c205a0004b2dffde1d102eb9962978a56cd608f63e84fdb35186a6f8d633e49b95eab5ec883a0608d9250d4f0
SSDEEP 192:qRNrvXdimi6ZJ0Pkvv7HpAPRp2y9DHsb+WNn0c0p6+dkwr+VyIsnAUgtaJ:qRNDtimi6aknjUXR5wz0lL28
TLSH
T1DC42C73EA9106A7B9CC6D229FE657BA7E7F4103131D02E88EAFC9A2C15D75DC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9f97853f6b37a6012df416023f5c3144e490af805885c530d7db87ddb1aefde1
MD5 6279b3ccee73967b704ea504a27e9004
SHA1 8059605161e9f2e513b8a0ea3390b220e10004d6
SHA512 4e03b0de164efe8175631b0f0fb04d873b6ab0be2f423ffd1f1cd899040b58dfc977248a99c2f19e4f8d0a2f8b4c63ad1cbd59a75d180c5feee761d36b3617ff
SSDEEP 192:qRNrvXdimi6ZJ0PkZv7HpTPRpPy9DHsb+WNn0c0j6+dkwp+VyIsnAUgraJ:qRNDtimi6ak5jZXK5wz03J2e
TLSH
T12B42D72EA9106A3B9CC6D259FE657B57E7F4203131D02E8CEAFC9A2C15E75DC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8458dfcb86db96ca009ea2861849425e67e48d8510ff83b8c4ae821ac51cb487
MD5 9a58c7e3218586d1f5a6398a90fbca38
SHA1 f7a1e5756569d50f9d784a1ddc65327aba104f40
SHA512 4e180b72fc8580fa2cf0e8134e3e780b1b0830dbe0aa00775b595236984577c45f526712aa61bb7fba45bf3b9209ad1dd2e8c8a18617fe3f1a68cfc6363b912a
TLSH
T1ABB012D080469501E00202F42142249971689F11AE4A170543E06922C8361508128151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5974f7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5974f7.TMP
Size 96B
SHA256 a1b7f5132cdb74c6a745f135268cf16be34f93c491f1a7785e42433531b68353
MD5 c57e8a0266d2dbb75c3c559b4bf1f708
SHA1 8550a9d08687653d34a292ae614a67b4ec195c1e
SHA512 8b87062d897c3800a3787ee0d624d736e1a679ed492d7c047b1f8bd8bea3661e7deec634e0b66de8315a7afcf7ee94fbcc68630f450fd3a9f65e2c74ec5add26
TLSH
T11BB02280C202A202C08203B03A88C0C83020CFA8C203223282E00A23EC2B230A220020
MD5 SHA1 SHA512 TLSH

Submit Download

e695130a-9604-44d5-9a7c-7e9e93f252c1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e695130a-9604-44d5-9a7c-7e9e93f252c1.tmp
Size 649B
SHA256 8d9da7d01f0db36e27281b29849bc503cc2dbf39e3b7bb69dca60340433054bc
MD5 280f97fac43f0966bfec79bf9830f0dd
SHA1 98847f5a080b3c12f50c1b7b591ca703a84b3ca9
SHA512 8afe6617aab78caf2266937ab93a645004623bcecc04dfdcd21004c3527bfe7f5dfca97f2e3eea4d7d8f66bb5baf0baa334446ce2b008c8ec0b267a60361bfaf
TLSH
T11DF028AAC921AC371CFD1B2C71A5074AE760132B2B80995F3F3C920C8FB163B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 273KB
SHA256 0f1ce18e8f2b67901af5d6bbd4c1c22df650d4eab3bb60779c1478e6c6b2d033
MD5 edc377b5f3fc9d8baeb66b03bf59bc3e
SHA1 365e323eebb1c6dcf0a6759358ac356ea786ccf9
SHA512 1f27e5b7381de0d205a7203e17abc7f757e0457e951a2ee117b57876d21ff5d5290cf0a9fc6a08551cd9ff7938906de486dde072a58e0ad21b5a3b3d4448f7ce
SSDEEP 6144:3ykCCgkzBfdo5ZG1LO08idTXdm7Rkm1tYpBeh2BAoe:i/54Ndo7Gs9im9oBGcAoe
TLSH
T1BB542336EE60797788B86B6DE04E150F5DF2CE6ADE44DF1DCCE81A4423CB8825A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 2ae57cde7c77ad81358afe0e839e6bb8839eb7745293cc60b391c932227cda9a
MD5 e216b8230b055eb77c5679cbfa9a96c2
SHA1 9d9b917c5387a23e797ffd692b97f0cd5cbbed20
SHA512 58bb64d13da3a1adc56c84c811cf9af7cfac825f8cb2f1a7624166b7b212f551e7c69b36d8b807769262839aa19d260eaf5dcaabda1e64814a21305f4bc298bd
SSDEEP 6144:FBfdo5ZG1LO08idTXdm7Rkm1tYpBeh2BAoe:FNdo7Gs9im9oBGcAoe
TLSH
T19D342335AEB4BE3E88B86B5AE44E0A0F2EF1DD7ADE00DF0DCCD41A4413D65951689E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 ae9095ebbd7ec05d9cc15a62e805f088f9dfbe1b33e460e7bf7832ec39f943fe
MD5 2ca4db3234d99f469e2f6c521d3af56d
SHA1 860b8a1ba8418f5a6cce60657524ee69368c0098
SHA512 e37931ac83ee7e5f0a0b7a6d65731cc9d99baff200ed4f13d547d7eed7e6296f53113f42e6a9a32eb1db56b09bab3a62c8e5f967c7cb5b2320c0b8a12760fb31
SSDEEP 6144:wBfdo5ZG1LO08idTXdm7Rkm1tYpBeh2BAoe:wNdo7Gs9im9oBGcAoe
TLSH
T128341335AEB4BE3E88B86B5AE44E0A0F2EF1DD7ADE00DF0DCCD41A4413D65951689E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 89c148543a592c661a8be5b107497414c78dc23c10ac1ef68c2a3fbe5e4b5bcf
MD5 2adc1d7811f519d5e8fbecd7a7236997
SHA1 060e9a51958e5cc63d756c90a27ea000a15eb5a1
SHA512 a0960f8142c87af14ecc6c44580db23e59797bfad669843fc17bb7bdf328be28b8090174aa89eb23f04b950a212431edf5221a6f266c5be6e5154816e553d064
SSDEEP 3072:pGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:Im7Rkm1tYpBeh2BAo+
TLSH
T1E6C3122B5D71A97658B5B74EB08D0B1F1EF14DA6C930DE82C8D86B0477F67CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download