hxxp://roblox[.]com

Analysis

user interaction
yes
max time kernel
900s
max time network
895s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://roblox.com
Sample260701-wpyr3sds21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3920	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274028015325637"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{4E121752-3C40-4D87-8925-D93AA93E9DA1}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
3104	chrome.exe
3104	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe
Token: SeShutdownPrivilege	1684	chrome.exe
Token: SeCreatePagefilePrivilege	1684	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe
1684	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 5080	1684	chrome.exe	87
PID 1684 wrote to memory of 3920	1684	chrome.exe	88
PID 1684 wrote to memory of 4524	1684	chrome.exe	89
PID 1684 wrote to memory of 4524	1684	chrome.exe	89
PID 1684 wrote to memory of 3148	1684	chrome.exe	90
PID 1684 wrote to memory of 3148	1684	chrome.exe	90
PID 1684 wrote to memory of 3992	1684	chrome.exe	91
PID 1684 wrote to memory of 3580	1684	chrome.exe	92
PID 1684 wrote to memory of 3992	1684	chrome.exe	91
PID 1684 wrote to memory of 3580	1684	chrome.exe	92
PID 1684 wrote to memory of 1928	1684	chrome.exe	93
PID 1684 wrote to memory of 1928	1684	chrome.exe	93
PID 1684 wrote to memory of 984	1684	chrome.exe	95
PID 1684 wrote to memory of 984	1684	chrome.exe	95
PID 1684 wrote to memory of 4984	1684	chrome.exe	101
PID 1684 wrote to memory of 4984	1684	chrome.exe	109
PID 1684 wrote to memory of 764	1684	chrome.exe	110
PID 1684 wrote to memory of 2468	1684	chrome.exe	111
PID 1684 wrote to memory of 4748	1684	chrome.exe	113
PID 1684 wrote to memory of 4364	1684	chrome.exe	114
PID 1684 wrote to memory of 4364	1684	chrome.exe	114
PID 1684 wrote to memory of 4856	1684	chrome.exe	115
PID 1684 wrote to memory of 4856	1684	chrome.exe	115
PID 1684 wrote to memory of 1076	1684	chrome.exe	116
PID 1684 wrote to memory of 1076	1684	chrome.exe	116
PID 1684 wrote to memory of 4628	1684	chrome.exe	117
PID 1684 wrote to memory of 4628	1684	chrome.exe	117
PID 1684 wrote to memory of 3104	1684	chrome.exe	118
PID 1684 wrote to memory of 3440	1684	chrome.exe	119
PID 1684 wrote to memory of 3440	1684	chrome.exe	119

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffa4b8c728,0x7fffa4b8c734,0x7fffa4b8c740
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1916,i,3535469661319142392,14648269849831887546,524288 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,5502206371712691506,11584878301943680888,262144 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,4312964481681916303,9061773729131523868,524288 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2304 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,6356844541469923539,8232016604812768673,2097152 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,4713151519406723503,14420461255416264703,2097152 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,9391728315535978892,10180795246450641080,2097152 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,1357248923278985341,9327875927854393954,2097152 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,17011545677771212737,6954483990492100139,524288 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,2476996776737481386,11308645182843123390,524288 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,16688094806689602395,789420586761954069,524288 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,7807634297277286684,11227796818072420199,524288 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,6946059688976107256,4356525613495572139,524288 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,2781969977067355157,10847432206148625360,524288 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6496,i,12435416011097496835,1192773895619697691,2097152 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4716,i,13563981055055869285,6105888619971958910,2097152 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4828,i,15655554542530603558,13587900896523739412,2097152 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5752,i,4873282997799616145,4416098509723519939,262144 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,8599431619630688981,7062025057773868026,524288 --field-trial-handle=1968,i,13064632719178736866,6264378707206071354,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:8
  2⤵
  PID:3440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5ea47d11-e5f4-46bf-9518-a80e934d4138.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5ea47d11-e5f4-46bf-9518-a80e934d4138.tmp
Size 12KB
SHA256 b4dd84d7fdeddb69305ac5ab1d4cad866a6cab959fb735eac87c4f5d774e4035
MD5 74c5c7d79e88980ef7e008a4e9be0be9
SHA1 78b4130761706141fdf7d7377d812b12f4848ca0
SHA512 9e05bff65c216b040227a0c54e43ae5f6916fff92cd45898238f200ee2f04e33cddedf835fca1871bb36d3054cd0d8e26ea0a65e8f43cbdb37b91b533cfd5b50
SSDEEP 192:FRWPS7q9kSyKUmv7MF+pAPRp2Bt9HHsb+WNn3GIK+22zk4HVyIsnAUge:FRWPqikX3SgoUXa1wWU2YJe
TLSH
T1C842B56EAE15697B6CCBC229FD667B27D7F1103221D41E84E6FC8A2C06E76CC211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f2ce66c8666a7a20eb5542b1fa76c84cd396c15bd2cebd53133b97f09d097c9d
MD5 cbe86efa8467c20f05ae58818e4f66bf
SHA1 e42115f9adfd140008721dbf6575788650724544
SHA512 5856a1f2a8a7041e54dcd460f7297da2a56c2177106544187f150656dd7690f6d3ad4cd418b557baa2247d35514ca16470bff597451ca2840a4bdad1eac82a09
TLSH
T117E02B7AC922DC3728FD1758B4A94745E64123172740980F373D810C8FB477B4296C5C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 7a6205bd1043d7fca7f42a50e91b22d8633fcf45e250b5d49b0a5bb79eb64f63
MD5 abe8658b62d515bc1a31d84ef505ca4e
SHA1 f729c950f5dcf781d6fa9d8069e0a3aba17900fc
SHA512 bf0fe0b4c042d9e5b5a1c7006ea9c3f7d89937d42011aae76b773dbfb7d2481f2db144e98dbc40897f4a1c59b43689d8a232240c748b25ee1f48e05abc867c06
SSDEEP 48:Us+NGv8Kb6/+Amqo5GYGcN/RpQCV+vS0YiwhwAx2JALxWW4Ryu+iPOfWsIHNpdOC:+RdFCUY3VV+vShoAubPUIHNpdsrLIhD
TLSH
T107B1CCB263C39378EFBE51FF85F82E4DE023D91746828B475C2244AC9CE32C4A621306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ffd6e28f1fa9087cafcc84f01d481ff01df17e82679b7c0b6778eacacf6006cd
MD5 7f7b743847710c78c605522ad2f276b0
SHA1 ef7c6307338f024374399bc2be3bdb306e8a7109
SHA512 138c500ca19763a3cb7ee9528074881e25d22b43e1fb32b9fe43e9367ed33e66a1f661e9d28330b3e843b870daddc08ab40b60f2ae7c55269c7f16f8426d5527
TLSH
T163712935A7C3A23CCFBE51FF08F92C8DE163C95B96021B4B8C66886D5DC32D5281231A
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
Size 347B
SHA256 c236a4030488dae2be678e3a3dfb0254ecc389f68e23118565e509d04cc924ba
MD5 7a80e6ce1569989e076be52d3c3871b1
SHA1 e3ebfda858669286328beb2352c099df3e9cc0f1
SHA512 0aa04b69cc09ddb923bded9cd0ee7eb7deb3657cd78924537d092f7393810400f29958d4afe5c3419ae4555f5894ecf3231d673c6fad6fafb472b2361c9e9c02
TLSH
T157E0686886C8CA5F208080A7653C774F8AD6651EBACDA8814F01E42020CA408A5E82F1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 1c25a6c4845ba9cd8e76f0c628ff7fbd6557c3dc58855052c4fb75854768778d
MD5 52e831647b5904d97684139570def459
SHA1 6d39bcd2607c41ff70678285a144258bab310cbb
SHA512 d6a1c203ec194205df85972b05d06ee3931d6e0e541bc882fc8c5a1bd3f8dd57e3fec49c8566181f8e97dcbc77ca5b444b54f0e24b55dc56e306618085bb9df3
SSDEEP 192:Du+Bwv1UPaaIEd9NAP09t5aiHEZHjuM7sHxfzeHNgUnZup+ujhnbHy:DbBwv1UPaaIEd9NAP09t5aiHEZHjuM77
TLSH
T155E16EF753B1C96D9A1696F09A09AD1B8F580530071C78B6C9E07E1793F3672E201B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b7af38a7be0980565f68a3969344e81d88cb25b9afbe243a175686d75130852b
MD5 f4ac3f775f19fd949fe4d8873c1bef34
SHA1 8ffe01377900ad9698d27f1f7cc8e762e642d648
SHA512 b5cd19765add428876f2032fa616ea6e7040d133ba06e1a99c1ccaa329af1c31c4678516687b41859454031b4ee5dc62f61788ceb4e9df130c953e21c8926e00
SSDEEP 192:DM+eOPnqhaaIEd9NQP09t5ZiHEZHjuM7MHxfzUHKcUnZupsHujhnay:DFeOPnqhaaIEd9NQP09t5ZiHEZHjuM77
TLSH
T111F19CF753B4C96D9A1696F0AA19AD1BCE580530431C38B6C9E0BE1793F35B1E201B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 e49ed5d40642ba33ed6291843737a2c3ceb0f6391d4b2518d5002fa9eb574836
MD5 b9d3babc17c037e5129c11b25dcbb6a5
SHA1 1c60d74307854b29e67a1d8ddedb7721c71c4d03
SHA512 2a769d1ecdc1971668be3df7343dd20bd6bf6264ba18844c99948a55685893f1afc3f887a60095385e1d1893dbf6bf812301caafad86ef16d7a2775e49466def
SSDEEP 192:DM+eOPnqhaaIEd9N4HQP09t5ZiHEZHjuM7MHxfzUHKcUHnZupZ:DFeOPnqhaaIEd9N4HQP09t5ZiHEZHjuq
TLSH
T1C6F19DF353B4C96D9A1696F09A09AD1BCE580530431C38B6C9E0BE5793F35B1E201B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ade91a47ccd601869a2b186f8c3ca7a85a940bbaf8b814e135467c84beca1dbd
MD5 b371287fb6be70d6f3969c6543d46ad2
SHA1 77c472b2cbbd5703bbc9156f62b079c78eec2016
SHA512 5e68c6db30bcd8e6874e0fd3cfe2e7679a23a0c733365561f2fb8be4fd5e53e2a92f67cccb28c38bed6765b7879bb59a74777e4e5e90f7f927757143dd10cc82
TLSH
T1404148F7C6E8897D890196F4BB152E1FCE2A0E14576C3C5AC8D4AE0B53E2875D24068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2bb897d659a7f1dd70257738445b4cf4c4f8620d28bbac06139c1fadd3998d8e
MD5 9056e1833dd6b10eab9779c9045e4278
SHA1 ebd6fe92e72f58f981d042ece7af9f52e1fdf4de
SHA512 febb0bffe79eb054181a4a005f1622c10802cd70b3d34874638238f45c0aeb194903b0480d747d1f3b485a846ec2ae0e20c51153ced6d64d79ffcab9097829e3
TLSH
T1964148F7C7E8897D890196F4BB152E1FCE2A0E14576C3C5AC8D4AE0B53E28B5D24068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 eae4404f8b34c87ef56f988c29fac7a87d301ad9f7aba0b34d2f96efb9b8edd4
MD5 65448530f4ae3fe58f648a6e275307ec
SHA1 0bafb55a74e4351e69ac4e0d10809127198c5152
SHA512 b0f9311d6d5fda5c8fffcc31d224fa7bd6ea876b79a3ea4c45ae8d8b42d0409c0d75fa1649b504be5a2a5bbdb0562053c301f99752cd5b4c480a342c0dd01ba8
SSDEEP 192:Du+Bv1UraAaaIEd9NAP09t5aiHEZHjuM7sHxfzeHNgUnZup+ujhnaSK:DbBv1UraAaaIEd9NAP09t5aiHEZHjuMr
TLSH
T1D0E16DF753B1C96D9A1696F09A09AD1B8F580530071C78B6C9E07E1793F36B2E201B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 89f63160f90aa4b88fdb29f81265acd4f54580167c898d4b54cd4de26d86b2e8
MD5 460bf5510988aee671973d07b29f8d21
SHA1 df38e1d2728754db68b0e77481266d3ef2a00306
SHA512 a2aafd16cfdf9092b2a9069b6ec4a294503fa3313a10a8a3a09e2b8803629ad792d2a17ded499e394f26e71979e9ac6de73135d562018968a6602acf0492a7fc
SSDEEP 96:QAUcfCQUcATtkUc1kKUciLIUc4eJUcKP/UcZfoUcy3UcaRUVi9Ucr5/UceJxhUc3:QAUmUPkU+UzIU8JUH/UmoUzU5UmUM/Ub
TLSH
T193B18157D6FF780B207809AF3D447C0BA969A43142A2B8F6DB63926CB4C25F34729473
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3d26188c0052719adbe526c3cb8dc412ee8a37bbfdad9d3a30208e1cb58e2db7
MD5 33c881ffcbed205809783f0597b04bf4
SHA1 5e7350fd0d9e2a6748a82763f80554199976f87e
SHA512 b396e2109a893cd22da51eb12a7855302c01133f01b48394a19b68683f6e8f82b51dbb04ba8c90e25850402ae7792b22f3a31f07b4ed5d9e657ee0e58bb77b88
SSDEEP 192:FRWPD7q9kSyKUFv7XF+p3/PRpXB619HHsb+WNn3GIhxYEzk4e8yIsnAUgE:FRWPfikX31boFXX21wWkYaBE
TLSH
T12A52C72FEA15697B6CCBD229FD667B27D7F1103222941E84E6FC8A1C16E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e8168eb66b7e09e631dc9806fbb288c47794d1af68d8d68f73c351b75e9afa3a
MD5 32c47a672532d5b5dfd4f411384f5d8a
SHA1 075db2ed77cda9e81dc5bfc12363c237d778b830
SHA512 0a6ff90d0844ecb17bb88eb3bfe9e1defcabfda9edf4be95f71c11fc01da2c4bc90634bce3990cf9e95031633c28ebe1e071080b32d23dc10464149c3feca68f
SSDEEP 192:FRWPS7q9kSyKUov7MF+p3h9jPRp2Bt9HHsb+WNn3GIK+22zk4H8yIsnAUge:FRWPqikX30goF7Xa1wWU2Y0e
TLSH
T1BA42B62EAA15697B6CCBD229FD667B27D7F1103222D41E84E6FC8A2C16E76CC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4c5a9fe4b99867ea65eda71d814723725e24f80e77508134f0fec8ae61927d02
MD5 cd44caf80233104ddf0b130fe8e0c113
SHA1 dda5b06116db07735917f3008b701f8b7a18fdcf
SHA512 0cdb0c8a79608e99dcb7fb6dadf1091c4d6ae0edae89fe31fca28562ecddbfb333141cbb221cb9e7884446f868dd65f6331b59e4d2aa4f5cd3079ffa4aba3505
SSDEEP 192:FRWPS7q9kSyKUov7XF+p3gPRp2B619HHsb+WNn3GIhxY4zk4a8yIsnAUgE:FRWPqikX30boFCXj1wWkYW1E
TLSH
T11052C72EEE15697B6CCBD229FD667B27D7F1102221C41E84E6FC8A2C16E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5b2c63a305785eeaaa81667ec37b4af1e0bff64d1d5a44d21e828f0ef0ef2316
MD5 742def58f6c08738ac3fe7c549e3dba0
SHA1 f12555e3c461b9a6e3cb23c4a97952b35401ff79
SHA512 109b62115a64cc909f2a3e03ec2c843ec1ee59e80a2e6e73757f67d18c288ef22cb5e4a66b422725e659b2aed3b12a993b81220faf46f475d14d60ee11d96849
TLSH
T13FB0128180019512C00203F43643248CB1199F14B60F170143E06A22C8251618429051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58824a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58824a.TMP
Size 96B
SHA256 83f99f4e21eb32ce7628fcd562e26d0ce94b30ddd05b89a82ff5121ab2208fd1
MD5 b0fbcb2329d1867b75d269a047447bbc
SHA1 97b505d438e98d1bd8070b8ad351a93be3ae9bb1
SHA512 5b15e24caa23b98de34908d6cc2f7926431edb3aeb7566ae872ac90d3a28d858a84d2ed3868e91008177edbc5212bbfadbdc6bc6e2a916ba857354d86f238d02
TLSH
T146B00266D1127312C08303F12995E5D87560DF7AC603531692E12F6BED29BB095F6560
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 4d742b84794f48a7dc21be3e6df2966af34306cfdcb1b1db88a403695b66e28f
MD5 9b2a9d3876d4115e48f835d514868687
SHA1 a6767884c5e65467bf6975266a05e1b61e186a82
SHA512 da22e7f114b30bcf2567cdf5079191c8b9ba7be06f919e5202053ed58307f4fd9a96732674614c60bc1e74eed2f735a0131ee4b083ccef983d0805aba1588790
SSDEEP 3072:Q0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:Q3m7Rkm1tYpBeh2BAoM
TLSH
T105C3123B5D75A83759B9BB1EB08E0B1F1EF14AA7C920DE92C8D85B0423F97CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 41afc7f4f57756e383076c6c8aac704fb834bd8322283a63d9e622cb4067568f
MD5 0e1dd3e2c688b93e2e916cd14180f8ca
SHA1 4f2b772ad559dac5e9f8fdd48b80765d3eae07f4
SHA512 e52284367341adf357a8b1939198409c45767a5582274667bd3536d753caf3b28a7d1696139ca0b248adb6969a8e50c98dd93c30eba0121aab36b199b11fb86a
SSDEEP 3072:00Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:03m7Rkm1tYpBeh2BAoM
TLSH
T1E5C3123B5D75A83759B9BB0EB08E0B1F1EF14AA7C930DA92C8D85B0423F97CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3cac963d59d4f96473559f56895c466817288476304b3278ada8f051af765cf9
MD5 1c4e9c910db5fd30e110620e8272b2e8
SHA1 cd7a5acb4c2f58f3705a4f31f5c1edd5cacd3e85
SHA512 213711c85b174a22ab912e9ae981d14b47a378b6218d59d586bf0eb02dd23f3976097cf79387912227bd967a42224b409d65cf60709b3c748e5d079cf1967c65
SSDEEP 3072:/xGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/gm7Rkm1tYpBeh2BAoM
TLSH
T1F8C312275E75E8375879BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c9545ee163c9fd834d1eb43ff25250e5cdc422510e3532528d0f65462bcdcf7d
MD5 159331a12370f9e339f0ef88e79c2554
SHA1 7e95c46d9151b9617b25ec437298a5bc69d44139
SHA512 586c187b3aec59082e64bfca1e660566b0203e0e6b24b2ca202c6edc470e9a7c925d97c8d2d82857c14a9e0907a0f0e2d42780f5a835982b81d169a994d09dfe
SSDEEP 3072:V9Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:VUm7Rkm1tYpBeh2BAoM
TLSH
T116C312275D75F83759A9B71EB08E0B1F0EF14AA6C920DA92C8D85B0423FA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ab432464fe2f030e47fa8c4d34783fe6c7b76916e6114b04c57545e5ae29d4ae
MD5 6da7423218a6250820c0cc9e31644f03
SHA1 516261edbce40f7a77ab42e840a8a15a56933c83
SHA512 cc742ba28f2842173b44b8c23e4537546e30db5bea9bde97a87055529ff189d5b224ff000a1bdd5def8805b1bbb21c672017e241beb806b068fcaac20d749b2e
SSDEEP 3072:09Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:0Um7Rkm1tYpBeh2BAoM
TLSH
T166C312275D75F83759A9B71EB08E0B1F0EF14AA6C920DE91C8D85B0423FA7CC0A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download